diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 7506fe63..298bdb6e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -29,12 +29,7 @@ jobs:
         uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: 3.47.0
-
-      - name: Use homebrew ruby
-        run: |
-          echo "/opt/homebrew/opt/ruby/bin" >> $GITHUB_PATH
-          echo "/opt/homebrew/bin" >> $GITHUB_PATH
+          flutter-version: 3.47.2
 
       - name: Install deps
         run: flutter pub get
@@ -48,9 +43,6 @@ jobs:
       - name: Generate boringtun bindings
         run: cd ios/boringtun && ./bindings.sh
 
-      - name: Update CocoaPods
-        run: pod repo update
-
       - name: Build iOS
         run: flutter build ipa --release --obfuscate --split-debug-info=build/debug-info --build-number=${{ github.run_number }}
 
@@ -106,7 +98,7 @@ jobs:
         uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: 3.47.0
+          flutter-version: 3.47.2
 
       - name: Configure Flutter JDK
         run: flutter config --jdk-dir "$JAVA_HOME"
@@ -179,7 +171,7 @@ jobs:
         uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: 3.47.0
+          flutter-version: 3.47.2
 
       - name: Accept licenses
         run: yes | flutter doctor --android-licenses
diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index dda4e555..077899a4 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -47,7 +47,7 @@ jobs:
         uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: 3.47.0
+          flutter-version: 3.47.2
 
       - name: get deps
         run: flutter pub get
@@ -76,7 +76,7 @@ jobs:
   #       uses: subosito/flutter-action@v2
   #       with:
   #         channel: stable
-  #         flutter-version: 3.47.0
+  #         flutter-version: 3.47.2
 
   #     - name: get deps
   #       run: flutter pub get
@@ -87,9 +87,6 @@ jobs:
   #     - name: Generate boringtun bindings
   #       run: cd boringtun && ./bindings.sh
 
-  #     - name: Update CocoaPods
-  #       run: pod repo update
-
   #     # - name: build project
   #     #   run: flutter build ios
 
diff --git a/client/android/app/src/main/res/values-night-v31/styles.xml b/client/android/app/src/main/res/values-night-v31/styles.xml
index 15edd042..714dc7b3 100644
--- a/client/android/app/src/main/res/values-night-v31/styles.xml
+++ b/client/android/app/src/main/res/values-night-v31/styles.xml
@@ -2,17 +2,16 @@
 <resources>
     <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is on -->
     <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <item name="android:forceDarkAllowed">false</item>
-        <item name="android:windowFullscreen">false</item>
-        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:statusBarColor">@android:color/transparent</item>
         <item name="android:navigationBarColor">@android:color/transparent</item>
         <item name="android:enforceNavigationBarContrast">false</item>
         <item name="android:enforceStatusBarContrast">false</item>
+        <item name="android:forceDarkAllowed">false</item>
+        <item name="android:windowFullscreen">false</item>
+        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
         <item name="android:windowSplashScreenBackground">#4F79FA</item>
         <item name="android:windowSplashScreenAnimatedIcon">@drawable/android12splash</item>
-        <item name="android:windowSplashScreenIconBackgroundColor">#4F79FA</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.
          This theme determines the color of the Android Window while your
diff --git a/client/android/app/src/main/res/values-night/styles.xml b/client/android/app/src/main/res/values-night/styles.xml
index a58bd353..140b9331 100644
--- a/client/android/app/src/main/res/values-night/styles.xml
+++ b/client/android/app/src/main/res/values-night/styles.xml
@@ -5,13 +5,13 @@
         <!-- Show a splash screen on the activity. Automatically removed when
              the Flutter engine draws its first frame -->
         <item name="android:windowBackground">@drawable/launch_background</item>
-        <item name="android:forceDarkAllowed">false</item>
-        <item name="android:windowFullscreen">false</item>
-        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:statusBarColor">@android:color/transparent</item>
         <item name="android:navigationBarColor">@android:color/transparent</item>
         <item name="android:enforceNavigationBarContrast">false</item>
         <item name="android:enforceStatusBarContrast">false</item>
+        <item name="android:forceDarkAllowed">false</item>
+        <item name="android:windowFullscreen">false</item>
+        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.
diff --git a/client/android/app/src/main/res/values-v31/styles.xml b/client/android/app/src/main/res/values-v31/styles.xml
index 447fbea3..b242d631 100644
--- a/client/android/app/src/main/res/values-v31/styles.xml
+++ b/client/android/app/src/main/res/values-v31/styles.xml
@@ -2,17 +2,16 @@
 <resources>
     <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is off -->
     <style name="LaunchTheme" parent="@android:style/Theme.Light.NoTitleBar">
-        <item name="android:forceDarkAllowed">false</item>
-        <item name="android:windowFullscreen">false</item>
-        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:statusBarColor">@android:color/transparent</item>
         <item name="android:navigationBarColor">@android:color/transparent</item>
         <item name="android:enforceNavigationBarContrast">false</item>
         <item name="android:enforceStatusBarContrast">false</item>
+        <item name="android:forceDarkAllowed">false</item>
+        <item name="android:windowFullscreen">false</item>
+        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
         <item name="android:windowSplashScreenBackground">#4F79FA</item>
         <item name="android:windowSplashScreenAnimatedIcon">@drawable/android12splash</item>
-        <item name="android:windowSplashScreenIconBackgroundColor">#4F79FA</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.
          This theme determines the color of the Android Window while your
diff --git a/client/android/app/src/main/res/values/styles.xml b/client/android/app/src/main/res/values/styles.xml
index 2562bf60..798fe291 100644
--- a/client/android/app/src/main/res/values/styles.xml
+++ b/client/android/app/src/main/res/values/styles.xml
@@ -5,13 +5,13 @@
         <!-- Show a splash screen on the activity. Automatically removed when
              the Flutter engine draws its first frame -->
         <item name="android:windowBackground">@drawable/launch_background</item>
-        <item name="android:forceDarkAllowed">false</item>
-        <item name="android:windowFullscreen">false</item>
-        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:statusBarColor">@android:color/transparent</item>
         <item name="android:navigationBarColor">@android:color/transparent</item>
         <item name="android:enforceNavigationBarContrast">false</item>
         <item name="android:enforceStatusBarContrast">false</item>
+        <item name="android:forceDarkAllowed">false</item>
+        <item name="android:windowFullscreen">false</item>
+        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.
diff --git a/client/ios/.gitignore b/client/ios/.gitignore
index 7a7f9873..cc037f9c 100644
--- a/client/ios/.gitignore
+++ b/client/ios/.gitignore
@@ -10,10 +10,9 @@
 **/.vagrant/
 **/DerivedData/
 Icon?
-**/Pods/
-**/.symlinks/
 profile
 xcuserdata
+**/xcshareddata/swiftpm/
 **/.generated/
 Flutter/App.framework
 Flutter/Flutter.framework
diff --git a/client/ios/Flutter/AppFrameworkInfo.plist b/client/ios/Flutter/AppFrameworkInfo.plist
index 1dc6cf76..391a902b 100644
--- a/client/ios/Flutter/AppFrameworkInfo.plist
+++ b/client/ios/Flutter/AppFrameworkInfo.plist
@@ -20,7 +20,5 @@
   <string>????</string>
   <key>CFBundleVersion</key>
   <string>1.0</string>
-  <key>MinimumOSVersion</key>
-  <string>13.0</string>
 </dict>
 </plist>
diff --git a/client/ios/Flutter/Debug.xcconfig b/client/ios/Flutter/Debug.xcconfig
index ec97fc6f..592ceee8 100644
--- a/client/ios/Flutter/Debug.xcconfig
+++ b/client/ios/Flutter/Debug.xcconfig
@@ -1,2 +1 @@
-#include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"
 #include "Generated.xcconfig"
diff --git a/client/ios/Flutter/Release.xcconfig b/client/ios/Flutter/Release.xcconfig
index c4855bfe..592ceee8 100644
--- a/client/ios/Flutter/Release.xcconfig
+++ b/client/ios/Flutter/Release.xcconfig
@@ -1,2 +1 @@
-#include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
diff --git a/client/ios/Podfile b/client/ios/Podfile
deleted file mode 100644
index 1b6ef802..00000000
--- a/client/ios/Podfile
+++ /dev/null
@@ -1,43 +0,0 @@
-# Uncomment this line to define a global platform for your project
-platform :ios, '15.6'
-
-# CocoaPods analytics sends network stats synchronously affecting flutter build latency.
-ENV['COCOAPODS_DISABLE_STATS'] = 'true'
-
-project 'Runner', {
-  'Debug' => :debug,
-  'Profile' => :release,
-  'Release' => :release,
-}
-
-def flutter_root
-  generated_xcode_build_settings_path = File.expand_path(File.join('..', 'Flutter', 'Generated.xcconfig'), __FILE__)
-  unless File.exist?(generated_xcode_build_settings_path)
-    raise "#{generated_xcode_build_settings_path} must exist. If you're running pod install manually, make sure flutter pub get is executed first"
-  end
-
-  File.foreach(generated_xcode_build_settings_path) do |line|
-    matches = line.match(/FLUTTER_ROOT\=(.*)/)
-    return matches[1].strip if matches
-  end
-  raise "FLUTTER_ROOT not found in #{generated_xcode_build_settings_path}. Try deleting Generated.xcconfig, then run flutter pub get"
-end
-
-require File.expand_path(File.join('packages', 'flutter_tools', 'bin', 'podhelper'), flutter_root)
-
-flutter_ios_podfile_setup
-
-target 'Runner' do
-  use_frameworks!
-
-  flutter_install_all_ios_pods File.dirname(File.realpath(__FILE__))
-  target 'RunnerTests' do
-    inherit! :search_paths
-  end
-end
-
-post_install do |installer|
-  installer.pods_project.targets.each do |target|
-    flutter_additional_ios_build_settings(target)
-  end
-end
diff --git a/client/ios/Podfile.lock b/client/ios/Podfile.lock
deleted file mode 100644
index ce14a2c7..00000000
--- a/client/ios/Podfile.lock
+++ /dev/null
@@ -1,129 +0,0 @@
-PODS:
-  - app_links (6.4.1):
-    - Flutter
-  - device_info_plus (0.0.1):
-    - Flutter
-  - Flutter (1.0.0)
-  - flutter_local_notifications (0.0.1):
-    - Flutter
-  - flutter_native_splash (2.4.3):
-    - Flutter
-  - flutter_secure_storage (6.0.0):
-    - Flutter
-  - local_auth_darwin (0.0.1):
-    - Flutter
-    - FlutterMacOS
-  - mobile_scanner (7.0.0):
-    - Flutter
-    - FlutterMacOS
-  - package_info_plus (0.4.5):
-    - Flutter
-  - permission_handler_apple (9.4.8):
-    - Flutter
-  - share_plus (0.0.1):
-    - Flutter
-  - shared_preferences_foundation (0.0.1):
-    - Flutter
-    - FlutterMacOS
-  - sqlite3 (3.50.4):
-    - sqlite3/common (= 3.50.4)
-  - sqlite3/common (3.50.4)
-  - sqlite3/dbstatvtab (3.50.4):
-    - sqlite3/common
-  - sqlite3/fts5 (3.50.4):
-    - sqlite3/common
-  - sqlite3/math (3.50.4):
-    - sqlite3/common
-  - sqlite3/perf-threadsafe (3.50.4):
-    - sqlite3/common
-  - sqlite3/rtree (3.50.4):
-    - sqlite3/common
-  - sqlite3_flutter_libs (0.0.1):
-    - Flutter
-    - FlutterMacOS
-    - sqlite3 (~> 3.50.2)
-    - sqlite3/dbstatvtab
-    - sqlite3/fts5
-    - sqlite3/math
-    - sqlite3/perf-threadsafe
-    - sqlite3/rtree
-  - url_launcher_ios (0.0.1):
-    - Flutter
-  - wireguard_plugin (0.0.1):
-    - Flutter
-    - FlutterMacOS
-
-DEPENDENCIES:
-  - app_links (from `.symlinks/plugins/app_links/ios`)
-  - device_info_plus (from `.symlinks/plugins/device_info_plus/ios`)
-  - Flutter (from `Flutter`)
-  - flutter_local_notifications (from `.symlinks/plugins/flutter_local_notifications/ios`)
-  - flutter_native_splash (from `.symlinks/plugins/flutter_native_splash/ios`)
-  - flutter_secure_storage (from `.symlinks/plugins/flutter_secure_storage/ios`)
-  - local_auth_darwin (from `.symlinks/plugins/local_auth_darwin/darwin`)
-  - mobile_scanner (from `.symlinks/plugins/mobile_scanner/darwin`)
-  - package_info_plus (from `.symlinks/plugins/package_info_plus/ios`)
-  - permission_handler_apple (from `.symlinks/plugins/permission_handler_apple/ios`)
-  - share_plus (from `.symlinks/plugins/share_plus/ios`)
-  - shared_preferences_foundation (from `.symlinks/plugins/shared_preferences_foundation/darwin`)
-  - sqlite3_flutter_libs (from `.symlinks/plugins/sqlite3_flutter_libs/darwin`)
-  - url_launcher_ios (from `.symlinks/plugins/url_launcher_ios/ios`)
-  - wireguard_plugin (from `.symlinks/plugins/wireguard_plugin/darwin`)
-
-SPEC REPOS:
-  trunk:
-    - sqlite3
-
-EXTERNAL SOURCES:
-  app_links:
-    :path: ".symlinks/plugins/app_links/ios"
-  device_info_plus:
-    :path: ".symlinks/plugins/device_info_plus/ios"
-  Flutter:
-    :path: Flutter
-  flutter_local_notifications:
-    :path: ".symlinks/plugins/flutter_local_notifications/ios"
-  flutter_native_splash:
-    :path: ".symlinks/plugins/flutter_native_splash/ios"
-  flutter_secure_storage:
-    :path: ".symlinks/plugins/flutter_secure_storage/ios"
-  local_auth_darwin:
-    :path: ".symlinks/plugins/local_auth_darwin/darwin"
-  mobile_scanner:
-    :path: ".symlinks/plugins/mobile_scanner/darwin"
-  package_info_plus:
-    :path: ".symlinks/plugins/package_info_plus/ios"
-  permission_handler_apple:
-    :path: ".symlinks/plugins/permission_handler_apple/ios"
-  share_plus:
-    :path: ".symlinks/plugins/share_plus/ios"
-  shared_preferences_foundation:
-    :path: ".symlinks/plugins/shared_preferences_foundation/darwin"
-  sqlite3_flutter_libs:
-    :path: ".symlinks/plugins/sqlite3_flutter_libs/darwin"
-  url_launcher_ios:
-    :path: ".symlinks/plugins/url_launcher_ios/ios"
-  wireguard_plugin:
-    :path: ".symlinks/plugins/wireguard_plugin/darwin"
-
-SPEC CHECKSUMS:
-  app_links: 585674be3c6661708e6cd794ab4f39fb9d8356f9
-  device_info_plus: bf2e3232933866d73fe290f2942f2156cdd10342
-  Flutter: cabc95a1d2626b1b06e7179b784ebcf0c0cde467
-  flutter_local_notifications: ff50f8405aaa0ccdc7dcfb9022ca192e8ad9688f
-  flutter_native_splash: df59bb2e1421aa0282cb2e95618af4dcb0c56c29
-  flutter_secure_storage: d33dac7ae2ea08509be337e775f6b59f1ff45f12
-  local_auth_darwin: 63c73d6d28cc3e239be2b6aa460ea6e317cd5100
-  mobile_scanner: 77265f3dc8d580810e91849d4a0811a90467ed5e
-  package_info_plus: c0502532a26c7662a62a356cebe2692ec5fe4ec4
-  permission_handler_apple: ee2fe0fd04551b304eb002714ff067c371c822ed
-  share_plus: 8b6f8b3447e494cca5317c8c3073de39b3600d1f
-  shared_preferences_foundation: 5086985c1d43c5ba4d5e69a4e8083a389e2909e6
-  sqlite3: 73513155ec6979715d3904ef53a8d68892d4032b
-  sqlite3_flutter_libs: 7bea6d85399aebaeb54e4f9845dcac6f5033cf22
-  url_launcher_ios: bb13df5870e8c4234ca12609d04010a21be43dfa
-  wireguard_plugin: 4d2720563b180d23101f7162ecdbf57203e82e8e
-
-PODFILE CHECKSUM: ae9e65fc23486119b8e977fd41d9213f251e537a
-
-COCOAPODS: 1.16.2
diff --git a/client/ios/Runner.xcodeproj/project.pbxproj b/client/ios/Runner.xcodeproj/project.pbxproj
index 39b0488f..1d10f848 100644
--- a/client/ios/Runner.xcodeproj/project.pbxproj
+++ b/client/ios/Runner.xcodeproj/project.pbxproj
@@ -7,7 +7,6 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
-		13AC128328D127CC1FFFF558 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = B65B0851E892D176C6678C51 /* Pods_Runner.framework */; };
 		1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */ = {isa = PBXBuildFile; fileRef = 1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */; };
 		284986622E1FAAA700BBCE47 /* NetworkExtension.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 287C99B22E1D2FA400965674 /* NetworkExtension.framework */; };
 		287C99BB2E1D2FA400965674 /* VPNExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 287C99B12E1D2FA400965674 /* VPNExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
@@ -15,10 +14,10 @@
 		331C808B294A63AB00263BE5 /* RunnerTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 331C807B294A618700263BE5 /* RunnerTests.swift */; };
 		3B3967161E833CAA004F5970 /* AppFrameworkInfo.plist in Resources */ = {isa = PBXBuildFile; fileRef = 3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */; };
 		74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 74858FAE1ED2DC5600515810 /* AppDelegate.swift */; };
+		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
 		97C146FC1CF9000F007C117D /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FA1CF9000F007C117D /* Main.storyboard */; };
 		97C146FE1CF9000F007C117D /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FD1CF9000F007C117D /* Assets.xcassets */; };
 		97C147011CF9000F007C117D /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FF1CF9000F007C117D /* LaunchScreen.storyboard */; };
-		DACB2DBAE80BDD7607EE4779 /* Pods_RunnerTests.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 2EA0093455776E9C2E8600EF /* Pods_RunnerTests.framework */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -53,27 +52,19 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		0CD8742B0F10B07586941587 /* Pods-RunnerTests.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.profile.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.profile.xcconfig"; sourceTree = "<group>"; };
 		1498D2321E8E86230040F4C2 /* GeneratedPluginRegistrant.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GeneratedPluginRegistrant.h; sourceTree = "<group>"; };
 		1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = GeneratedPluginRegistrant.m; sourceTree = "<group>"; };
-		2870EE742E20076800A83A9A /* wireguard_plugin.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; path = wireguard_plugin.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		2870EE782E2008B400A83A9A /* wireguard_plugin.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; path = wireguard_plugin.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		287C99B12E1D2FA400965674 /* VPNExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = VPNExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
 		287C99B22E1D2FA400965674 /* NetworkExtension.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = NetworkExtension.framework; path = System/Library/Frameworks/NetworkExtension.framework; sourceTree = SDKROOT; };
 		287C9A272E1D43DB00965674 /* Runner.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Runner.entitlements; sourceTree = "<group>"; };
 		2886A14D2E28ED64006A7931 /* MockVPNManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MockVPNManager.swift; sourceTree = "<group>"; };
-		28F6C5EA2E1FD71200C01098 /* wireguard_plugin.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; path = wireguard_plugin.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		2EA0093455776E9C2E8600EF /* Pods_RunnerTests.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_RunnerTests.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		331C807B294A618700263BE5 /* RunnerTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RunnerTests.swift; sourceTree = "<group>"; };
 		331C8081294A63A400263BE5 /* RunnerTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RunnerTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = AppFrameworkInfo.plist; path = Flutter/AppFrameworkInfo.plist; sourceTree = "<group>"; };
-		424B254BB5DDF4D176DA0E7E /* Pods-RunnerTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.debug.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.debug.xcconfig"; sourceTree = "<group>"; };
-		5DA50AA8F82E69D4A7D35633 /* Pods-Runner.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.profile.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.profile.xcconfig"; sourceTree = "<group>"; };
-		6E29205A5B56791C6A58AB8C /* Pods-Runner.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.release.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"; sourceTree = "<group>"; };
 		74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Runner-Bridging-Header.h"; sourceTree = "<group>"; };
 		74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
+		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = "<group>"; };
-		8DA37A462F22DF4069A30F0C /* Pods-RunnerTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.release.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.release.xcconfig"; sourceTree = "<group>"; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = "<group>"; };
 		9740EEB31CF90195004384FC /* Generated.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Generated.xcconfig; path = Flutter/Generated.xcconfig; sourceTree = "<group>"; };
 		97C146EE1CF9000F007C117D /* Runner.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Runner.app; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -81,8 +72,6 @@
 		97C146FD1CF9000F007C117D /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		97C147001CF9000F007C117D /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
 		97C147021CF9000F007C117D /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-		B65B0851E892D176C6678C51 /* Pods_Runner.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Runner.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		BD3CFBCA806DBFB89630EE74 /* Pods-Runner.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.debug.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
@@ -119,7 +108,6 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				DACB2DBAE80BDD7607EE4779 /* Pods_RunnerTests.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -127,7 +115,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				13AC128328D127CC1FFFF558 /* Pods_Runner.framework in Frameworks */,
+				78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -146,6 +134,7 @@
 		9740EEB11CF90186004384FC /* Flutter */ = {
 			isa = PBXGroup;
 			children = (
+				78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */,
 				3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */,
 				9740EEB21CF90195004384FC /* Debug.xcconfig */,
 				7AFA3C8E1D35360C0083082E /* Release.xcconfig */,
@@ -162,7 +151,6 @@
 				287C99B42E1D2FA400965674 /* VPNExtension */,
 				97C146EF1CF9000F007C117D /* Products */,
 				331C8082294A63A400263BE5 /* RunnerTests */,
-				DE2536E81B1975928E1692FE /* Pods */,
 				DCED99F8D798CA792151538F /* Frameworks */,
 			);
 			sourceTree = "<group>";
@@ -196,29 +184,11 @@
 		DCED99F8D798CA792151538F /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
-				2870EE782E2008B400A83A9A /* wireguard_plugin.framework */,
-				2870EE742E20076800A83A9A /* wireguard_plugin.framework */,
-				28F6C5EA2E1FD71200C01098 /* wireguard_plugin.framework */,
 				287C99B22E1D2FA400965674 /* NetworkExtension.framework */,
-				B65B0851E892D176C6678C51 /* Pods_Runner.framework */,
-				2EA0093455776E9C2E8600EF /* Pods_RunnerTests.framework */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
 		};
-		DE2536E81B1975928E1692FE /* Pods */ = {
-			isa = PBXGroup;
-			children = (
-				BD3CFBCA806DBFB89630EE74 /* Pods-Runner.debug.xcconfig */,
-				6E29205A5B56791C6A58AB8C /* Pods-Runner.release.xcconfig */,
-				5DA50AA8F82E69D4A7D35633 /* Pods-Runner.profile.xcconfig */,
-				424B254BB5DDF4D176DA0E7E /* Pods-RunnerTests.debug.xcconfig */,
-				8DA37A462F22DF4069A30F0C /* Pods-RunnerTests.release.xcconfig */,
-				0CD8742B0F10B07586941587 /* Pods-RunnerTests.profile.xcconfig */,
-			);
-			path = Pods;
-			sourceTree = "<group>";
-		};
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
@@ -246,7 +216,6 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 331C8087294A63A400263BE5 /* Build configuration list for PBXNativeTarget "RunnerTests" */;
 			buildPhases = (
-				C42D5465F1F179E1EECF14FB /* [CP] Check Pods Manifest.lock */,
 				331C807D294A63A400263BE5 /* Sources */,
 				331C807F294A63A400263BE5 /* Resources */,
 				46C1966B05CC6B3688F00188 /* Frameworks */,
@@ -265,15 +234,12 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 97C147051CF9000F007C117D /* Build configuration list for PBXNativeTarget "Runner" */;
 			buildPhases = (
-				12E55229B7D8012912191D7E /* [CP] Check Pods Manifest.lock */,
 				9740EEB61CF901F6004384FC /* Run Script */,
 				97C146EA1CF9000F007C117D /* Sources */,
 				97C146EB1CF9000F007C117D /* Frameworks */,
 				97C146EC1CF9000F007C117D /* Resources */,
 				287C99BC2E1D2FA400965674 /* Embed Foundation Extensions */,
 				3B06AD1E1E4923F5004D2608 /* Thin Binary */,
-				BCC7D29F7E18EB3A195C9935 /* [CP] Embed Pods Frameworks */,
-				7A28395B068B05A97BF2ECFE /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -281,6 +247,9 @@
 				287C99BA2E1D2FA400965674 /* PBXTargetDependency */,
 			);
 			name = Runner;
+			packageProductDependencies = (
+				78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
+			);
 			productName = Runner;
 			productReference = 97C146EE1CF9000F007C117D /* Runner.app */;
 			productType = "com.apple.product-type.application";
@@ -317,6 +286,9 @@
 				Base,
 			);
 			mainGroup = 97C146E51CF9000F007C117D;
+			packageReferences = (
+				781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */,
+			);
 			preferredProjectObjectVersion = 77;
 			productRefGroup = 97C146EF1CF9000F007C117D /* Products */;
 			projectDirPath = "";
@@ -358,28 +330,6 @@
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXShellScriptBuildPhase section */
-		12E55229B7D8012912191D7E /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-Runner-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
 		3B06AD1E1E4923F5004D2608 /* Thin Binary */ = {
 			isa = PBXShellScriptBuildPhase;
 			alwaysOutOfDate = 1;
@@ -396,23 +346,6 @@
 			shellPath = /bin/sh;
 			shellScript = "/bin/sh \"$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh\" embed_and_thin\n";
 		};
-		7A28395B068B05A97BF2ECFE /* [CP] Copy Pods Resources */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources-${CONFIGURATION}-input-files.xcfilelist",
-			);
-			name = "[CP] Copy Pods Resources";
-			outputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources-${CONFIGURATION}-output-files.xcfilelist",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
 		9740EEB61CF901F6004384FC /* Run Script */ = {
 			isa = PBXShellScriptBuildPhase;
 			alwaysOutOfDate = 1;
@@ -428,45 +361,6 @@
 			shellPath = /bin/sh;
 			shellScript = "/bin/sh \"$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh\" build\n";
 		};
-		BCC7D29F7E18EB3A195C9935 /* [CP] Embed Pods Frameworks */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-input-files.xcfilelist",
-			);
-			name = "[CP] Embed Pods Frameworks";
-			outputFileListPaths = (
-				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-output-files.xcfilelist",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		C42D5465F1F179E1EECF14FB /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
-				"${PODS_ROOT}/Manifest.lock",
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(DERIVED_FILE_DIR)/Pods-RunnerTests-checkManifestLockResult.txt",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
-			showEnvVarsInLog = 0;
-		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
@@ -784,7 +678,6 @@
 		};
 		331C8088294A63A400263BE5 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 424B254BB5DDF4D176DA0E7E /* Pods-RunnerTests.debug.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
@@ -804,7 +697,6 @@
 		};
 		331C8089294A63A400263BE5 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 8DA37A462F22DF4069A30F0C /* Pods-RunnerTests.release.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
@@ -822,7 +714,6 @@
 		};
 		331C808A294A63A400263BE5 /* Profile */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 0CD8742B0F10B07586941587 /* Pods-RunnerTests.profile.xcconfig */;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
@@ -1076,6 +967,20 @@
 			defaultConfigurationName = Release;
 		};
 /* End XCConfigurationList section */
+
+/* Begin XCLocalSwiftPackageReference section */
+		781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */ = {
+			isa = XCLocalSwiftPackageReference;
+			relativePath = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage;
+		};
+/* End XCLocalSwiftPackageReference section */
+
+/* Begin XCSwiftPackageProductDependency section */
+		78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = FlutterGeneratedPluginSwiftPackage;
+		};
+/* End XCSwiftPackageProductDependency section */
 	};
 	rootObject = 97C146E61CF9000F007C117D /* Project object */;
 }
diff --git a/client/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme b/client/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
index e3773d42..c3fedb29 100644
--- a/client/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
+++ b/client/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
@@ -5,6 +5,24 @@
    <BuildAction
       parallelizeBuildables = "YES"
       buildImplicitDependencies = "YES">
+      <PreActions>
+         <ExecutionAction
+            ActionType = "Xcode.IDEStandardExecutionActionsCore.ExecutionActionType.ShellScriptAction">
+            <ActionContent
+               title = "Run Prepare Flutter Framework Script"
+               scriptText = "/bin/sh &quot;$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh&quot; prepare&#10;">
+               <EnvironmentBuildable>
+                  <BuildableReference
+                     BuildableIdentifier = "primary"
+                     BlueprintIdentifier = "97C146ED1CF9000F007C117D"
+                     BuildableName = "Runner.app"
+                     BlueprintName = "Runner"
+                     ReferencedContainer = "container:Runner.xcodeproj">
+                  </BuildableReference>
+               </EnvironmentBuildable>
+            </ActionContent>
+         </ExecutionAction>
+      </PreActions>
       <BuildActionEntries>
          <BuildActionEntry
             buildForTesting = "YES"
diff --git a/client/ios/Runner.xcworkspace/contents.xcworkspacedata b/client/ios/Runner.xcworkspace/contents.xcworkspacedata
index 21a3cc14..1d526a16 100644
--- a/client/ios/Runner.xcworkspace/contents.xcworkspacedata
+++ b/client/ios/Runner.xcworkspace/contents.xcworkspacedata
@@ -4,7 +4,4 @@
    <FileRef
       location = "group:Runner.xcodeproj">
    </FileRef>
-   <FileRef
-      location = "group:Pods/Pods.xcodeproj">
-   </FileRef>
 </Workspace>
diff --git a/client/lib/enterprise/screens/mfa/next/next_mfa_openid_screen.dart b/client/lib/enterprise/screens/mfa/next/next_mfa_openid_screen.dart
index 7f0cea93..2166b599 100644
--- a/client/lib/enterprise/screens/mfa/next/next_mfa_openid_screen.dart
+++ b/client/lib/enterprise/screens/mfa/next/next_mfa_openid_screen.dart
@@ -1,18 +1,17 @@
-import 'package:material_ui/material_ui.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:mobile/open/widgets/icons/openid_open.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/open/widgets/next/icons/next_icon.dart';
 import 'package:mobile/open/widgets/next/next_app_bar.dart';
 import 'package:mobile/open/widgets/next/next_button.dart';
 import 'package:mobile/open/widgets/next/next_icon_button.dart';
+import 'package:mobile/open/widgets/toaster/toast_manager.dart';
 import 'package:mobile/theme/next/color.dart';
 import 'package:mobile/theme/next/text.dart';
 import 'package:url_launcher/url_launcher.dart';
 
+import '../../../../logging.dart';
 import '../openid_mfa_screen.dart';
 import '../openid_mfa_waiting_screen.dart';
-import '../../../../logging.dart';
-import 'package:mobile/open/widgets/toaster/toast_manager.dart';
 import 'next_mfa_openid_waiting_screen.dart';
 
 class NextOpenIdMfaScreen extends HookConsumerWidget {
@@ -29,7 +28,7 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
-    final String title = "Two-factor authentication";
+    final String title = "Continue with OpenID";
     final String providerName = screenData.openidDisplayName ?? 'OpenID';
     final toaster = ref.read(toastManagerProvider.notifier);
 
@@ -48,10 +47,7 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
         ),
         body: SafeArea(
           child: Padding(
-            padding: const EdgeInsets.symmetric(
-              horizontal: 20,
-              vertical: 20,
-            ),
+            padding: const EdgeInsets.fromLTRB(20, 4, 20, 20),
             child: Column(
               crossAxisAlignment: CrossAxisAlignment.start,
               children: [
@@ -63,24 +59,14 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
                 ),
                 const SizedBox(height: 8),
                 Text(
-                  "In order to connect to VPN please login with $providerName. To do so, please click \"Authenticate with $providerName\" button below.",
-                  style: NextText.bodySm400.copyWith(
+                  "Confirm your identity to continue. You'll be redirected to your identity provider to complete verification.",
+                  style: NextText.bodyXs400.copyWith(
                     color: NextColor.fgWhite60,
                   ),
                 ),
-                const SizedBox(height: 16),
-                Text(
-                  "This will open a new window in your Web Browser and automatically redirect you to the $providerName login page. After authenticating with $providerName please get back here.",
-                  style: NextText.bodySm400.copyWith(
-                    color: NextColor.fgWhite60,
-                  ),
-                ),
-                const Spacer(),
-                Center(child: DgIconOpenidOpen(size: 160)),
                 const Spacer(),
-                const SizedBox(height: 20),
                 NextButton(
-                  text: 'Authenticate with $providerName',
+                  text: 'Continue with $providerName',
                   width: double.infinity,
                   onTap: () async {
                     final navigator = Navigator.of(context);
@@ -91,7 +77,6 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
                           message: "Failed to open the browser.",
                         );
                       } else {
-                        // Navigate to waiting screen and await result
                         final result = await navigator.push<String?>(
                           MaterialPageRoute(
                             builder: (context) => NextOpenIdMfaWaitingScreen(
@@ -103,7 +88,6 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
                           ),
                         );
 
-                        // Return the result to the tunnel service
                         if (context.mounted) {
                           navigator.pop(result);
                         }
@@ -116,13 +100,6 @@ class NextOpenIdMfaScreen extends HookConsumerWidget {
                     }
                   },
                 ),
-                const SizedBox(height: 12),
-                NextButton(
-                  text: 'Cancel',
-                  style: NextButtonStyle.outlined,
-                  width: double.infinity,
-                  onTap: () => Navigator.of(context).pop(),
-                ),
               ],
             ),
           ),
diff --git a/client/lib/enterprise/screens/mfa/next/next_mfa_openid_waiting_screen.dart b/client/lib/enterprise/screens/mfa/next/next_mfa_openid_waiting_screen.dart
index 31782a1e..b74abb7f 100644
--- a/client/lib/enterprise/screens/mfa/next/next_mfa_openid_waiting_screen.dart
+++ b/client/lib/enterprise/screens/mfa/next/next_mfa_openid_waiting_screen.dart
@@ -1,30 +1,26 @@
 import 'package:dio/dio.dart';
-import 'package:material_ui/material_ui.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/data/proxy/mfa.dart';
 import 'package:mobile/open/api.dart';
-import 'package:mobile/open/widgets/icons/openid_wait.dart';
 import 'package:mobile/open/widgets/next/icons/next_icon.dart';
 import 'package:mobile/open/widgets/next/next_app_bar.dart';
 import 'package:mobile/open/widgets/next/next_button.dart';
 import 'package:mobile/open/widgets/next/next_icon_button.dart';
+import 'package:mobile/open/widgets/toaster/toast_manager.dart';
 import 'package:mobile/theme/next/color.dart';
 import 'package:mobile/theme/next/text.dart';
 
-import '../openid_mfa_waiting_screen.dart';
 import '../../../../../logging.dart';
 import '../../../../../utils/error_handler.dart';
-import 'package:mobile/open/widgets/toaster/toast_manager.dart';
+import '../openid_mfa_waiting_screen.dart';
 
 class NextOpenIdMfaWaitingScreen extends HookConsumerWidget {
   final OpenIdMfaWaitingScreenData screenData;
 
   const NextOpenIdMfaWaitingScreen({super.key, required this.screenData});
 
-  /// Polls the proxy until the user finishes the browser login, [isCancelled]
-  /// returns true or the 2 minute timeout elapses. Returns null unless a
-  /// preshared key came back.
   Future<FinishMfaResponse?> _pollOpenidMfa(bool Function() isCancelled) async {
     final request = FinishMfaRequest(token: screenData.token);
     final uri = Uri.parse(screenData.proxyUrl);
@@ -74,10 +70,6 @@ class NextOpenIdMfaWaitingScreen extends HookConsumerWidget {
     final toaster = ref.read(toastManagerProvider.notifier);
 
     useEffect(() {
-      // `isActive` goes false synchronously inside `pop()`, so this covers the
-      // Cancel button, the back arrow and a swipe back. It both stops the
-      // polling loop and keeps a late result from popping the screen
-      // underneath this one while the pop transition is still running.
       bool isGone() => route != null && !route.isActive;
 
       _pollOpenidMfa(isGone)
@@ -120,10 +112,7 @@ class NextOpenIdMfaWaitingScreen extends HookConsumerWidget {
         ),
         body: SafeArea(
           child: Padding(
-            padding: const EdgeInsets.symmetric(
-              horizontal: 20,
-              vertical: 20,
-            ),
+            padding: .fromLTRB(20, 4, 20, 20),
             child: Column(
               crossAxisAlignment: CrossAxisAlignment.start,
               children: [
@@ -136,14 +125,11 @@ class NextOpenIdMfaWaitingScreen extends HookConsumerWidget {
                 const SizedBox(height: 8),
                 Text(
                   "Waiting for authentication in your browser...",
-                  style: NextText.bodySm400.copyWith(
+                  style: NextText.bodyXs400.copyWith(
                     color: NextColor.fgWhite60,
                   ),
                 ),
                 const Spacer(),
-                Center(child: DgIconOpenidWait(size: 160)),
-                const Spacer(),
-                const SizedBox(height: 20),
                 NextButton(
                   text: 'Cancel',
                   style: NextButtonStyle.outlined,
diff --git a/client/lib/open/screens/instance/instance_screen.dart b/client/lib/open/screens/instance/instance_screen.dart
index 8a36062d..df320040 100644
--- a/client/lib/open/screens/instance/instance_screen.dart
+++ b/client/lib/open/screens/instance/instance_screen.dart
@@ -1,8 +1,8 @@
 import 'package:drift/drift.dart' as drift;
-import 'package:material_ui/material_ui.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:flutter_svg/svg.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/data/db/database.dart';
 import 'package:mobile/data/plugin/plugin.dart';
 import 'package:mobile/open/api.dart';
@@ -444,7 +444,6 @@ class _LocationItem extends HookConsumerWidget {
       }
     }, []);
 
-    // set connected flag
     useEffect(() {
       final connected = checkConnected(activeTunnel);
       isConnected.value = connected;
@@ -542,18 +541,15 @@ class _LocationItem extends HookConsumerWidget {
                   onTap: () async {
                     print("Location traffic pref: ${location.trafficMethod}");
                     isLoading.value = true;
-                    // check if there is active tunnel if so ask user if he want to change the active connection
                     if (activeTunnel != null) {
                       if (!isConnected.value) {
                         talker.debug("Connection change started");
-                        // connection is on another location so ask if user want to change active to this one
                         final bool? changeConnection = await showDialog<bool>(
                           context: context,
                           builder: (BuildContext context) {
                             return ConnectionConflictDialog();
                           },
                         );
-                        // user cancelled the operation
                         if (changeConnection == null ||
                             changeConnection == false) {
                           talker.debug("Connection change cancelled");
@@ -567,27 +563,33 @@ class _LocationItem extends HookConsumerWidget {
                           talker.debug("Previous connection closed");
                         }
                       } else {
-                        // active connection is the current location means disconnect
                         await disconnect();
                         isLoading.value = false;
                         return;
                       }
                     }
-                    // connect
                     try {
                       final permissionsGranted = await wireguardPlugin
                           .requestPermissions();
                       if (permissionsGranted) {
                         if (context.mounted) {
-                          await TunnelService.connect(
+                          final result = await TunnelService.connect(
                             context: context,
-                            toaster: ref.read(toastManagerProvider.notifier),
                             instance: instance,
                             location: location,
                             wireguardPlugin: wireguardPlugin,
                             biometricsStatus: biometricStatus,
                             db: ref.read(databaseProvider),
                           );
+                          if (result.status == ConnectStatus.failed) {
+                            ref
+                                .read(toastManagerProvider.notifier)
+                                .showError(
+                                  message: result.message!,
+                                  logMessage: result.logMessage,
+                                  error: result.error,
+                                );
+                          }
                           talker.debug(
                             "Location ${location.name} (${location.id}) connected",
                           );
diff --git a/client/lib/open/screens/instance/next_instance_screen.dart b/client/lib/open/screens/instance/next_instance_screen.dart
index 62a2a195..53c7abef 100644
--- a/client/lib/open/screens/instance/next_instance_screen.dart
+++ b/client/lib/open/screens/instance/next_instance_screen.dart
@@ -1,8 +1,8 @@
 import 'package:collection/collection.dart';
 import 'package:drift/drift.dart' as drift;
-import 'package:material_ui/material_ui.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/data/db/database.dart';
 import 'package:mobile/data/plugin/plugin.dart';
 import 'package:mobile/open/api.dart';
@@ -20,6 +20,7 @@ import 'package:mobile/open/widgets/next/next_bottom_sheet.dart';
 import 'package:mobile/open/widgets/next/next_drawer.dart';
 import 'package:mobile/open/widgets/next/next_location_card.dart';
 import 'package:mobile/open/widgets/next/next_menu.dart';
+import 'package:mobile/open/widgets/toaster/toast_manager.dart';
 import 'package:mobile/plugin.dart';
 import 'package:mobile/router/routes.dart';
 import 'package:mobile/theme/next/color.dart';
@@ -30,7 +31,6 @@ import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:wireguard_plugin/wireguard_plugin.dart';
 
 import '../../../logging.dart';
-import 'package:mobile/open/widgets/toaster/toast_manager.dart';
 import '../../widgets/next/next_icon_button.dart';
 
 part 'next_instance_screen.g.dart';
@@ -433,7 +433,7 @@ class _LocationList extends HookConsumerWidget {
         }
 
         if (context.mounted) {
-          await showNextBottomSheet(
+          final result = await showNextBottomSheet<ConnectResult>(
             context: context,
             child: NextConnectDialog(
               instance: data.instance,
@@ -441,25 +441,37 @@ class _LocationList extends HookConsumerWidget {
               onConnect: (traffic, mfa) async {
                 final permissionsGranted = await wireguardPlugin
                     .requestPermissions();
-                if (permissionsGranted) {
-                  if (context.mounted) {
-                    await TunnelService.connect(
-                      context: context,
-                      toaster: toaster,
-                      instance: data.instance,
-                      location: location,
-                      wireguardPlugin: wireguardPlugin,
-                      biometricsStatus: biometricStatus,
-                      db: ref.read(databaseProvider),
-                      trafficMethod: traffic,
-                      mfaMethod: mfa,
-                    );
-                  }
+                if (!permissionsGranted || !context.mounted) {
+                  return const ConnectResult.cancelled();
                 }
+                return await TunnelService.connect(
+                  context: context,
+                  instance: data.instance,
+                  location: location,
+                  wireguardPlugin: wireguardPlugin,
+                  biometricsStatus: biometricStatus,
+                  db: ref.read(databaseProvider),
+                  trafficMethod: traffic,
+                  mfaMethod: mfa,
+                );
               },
             ),
           );
-          talker.debug("Connected to ${location.name}");
+
+          switch (result?.status) {
+            case ConnectStatus.connected:
+              talker.debug("Connected to ${location.name}");
+              toaster.show(message: "${location.name} connected");
+            case ConnectStatus.failed:
+              toaster.showError(
+                message: result!.message!,
+                logMessage: result.logMessage,
+                error: result.error,
+              );
+            case ConnectStatus.cancelled:
+            case null:
+              break;
+          }
         }
       } catch (e) {
         toaster.showError(message: "Failed to connect", error: e);
@@ -503,8 +515,6 @@ class _LocationList extends HookConsumerWidget {
             location: connectedLocation,
             isConnected: true,
             routingMethod: activeTunnel?.traffic,
-            // gated so a stored preference never renders an MFA chip on a
-            // location whose MFA has since been disabled server-side
             mfaMethod: TunnelService.checkMfaEnabled(connectedLocation)
                 ? connectedLocation.mfaMethod
                 : null,
diff --git a/client/lib/open/screens/instance/services/tunnel_service.dart b/client/lib/open/screens/instance/services/tunnel_service.dart
index 982d685d..3dc2a23e 100644
--- a/client/lib/open/screens/instance/services/tunnel_service.dart
+++ b/client/lib/open/screens/instance/services/tunnel_service.dart
@@ -1,36 +1,78 @@
 import 'dart:convert';
 import 'dart:io';
 
-import 'package:dio/dio.dart';
 import 'package:drift/drift.dart' as drift;
 import 'package:material_ui/material_ui.dart';
 import 'package:mobile/data/db/database.dart';
 import 'package:mobile/data/plugin/plugin.dart';
 import 'package:mobile/data/proxy/mfa.dart';
 import 'package:mobile/enterprise/postures.dart';
+import 'package:mobile/enterprise/screens/mfa/next/next_mfa_openid_screen.dart';
 import 'package:mobile/enterprise/screens/mfa/openid_mfa_screen.dart';
 import 'package:mobile/open/api.dart';
 import 'package:mobile/open/riverpod/biometrics_state.dart';
 import 'package:mobile/open/screens/instance/widgets/mfa_method_dialog.dart';
 import 'package:mobile/open/screens/instance/widgets/routing_method_dialog.dart';
+import 'package:mobile/open/screens/next/mfa/next_mfa_biometric_screen.dart';
+import 'package:mobile/open/screens/next/mfa/next_mfa_code_screen.dart';
 import 'package:mobile/open/screens/next/mfa/next_mfa_email_screen.dart';
-import 'package:mobile/enterprise/screens/mfa/next/next_mfa_openid_screen.dart';
 import 'package:mobile/open/screens/next/mfa/next_mfa_totp_screen.dart';
-import 'package:mobile/open/widgets/toaster/toast_manager.dart';
-import 'package:mobile/utils/error_handler.dart';
-import 'package:mobile/utils/secure_storage.dart';
 
 import '../../../../data/db/enums.dart';
 import '../../../../logging.dart';
 import '../../../../utils/notifications.dart';
 
+/// How a connect attempt ended. Reporting it - a toast, a snackbar, nothing at
+/// all - is the caller's business, the service only states what happened.
+enum ConnectStatus { connected, cancelled, failed }
+
+class ConnectResult {
+  final ConnectStatus status;
+
+  /// Safe, user facing text. Set only when [status] is [ConnectStatus.failed].
+  final String? message;
+
+  /// Detail for the log, never displayed.
+  final String? logMessage;
+  final Object? error;
+
+  const ConnectResult.connected()
+    : status = ConnectStatus.connected,
+      message = null,
+      logMessage = null,
+      error = null;
+
+  const ConnectResult.cancelled()
+    : status = ConnectStatus.cancelled,
+      message = null,
+      logMessage = null,
+      error = null;
+
+  const ConnectResult.failed({
+    required this.message,
+    this.logMessage,
+    this.error,
+  }) : status = ConnectStatus.failed;
+}
+
+/// Outcome of a single pre-connect step (MFA, posture check). [presharedKey] is
+/// set when the step succeeded and [failure] when it failed with something the
+/// user should be told about; both stay null when the user simply backed out.
+class _StepOutcome {
+  final String? presharedKey;
+  final ConnectResult? failure;
+
+  const _StepOutcome.success(this.presharedKey) : failure = null;
+  const _StepOutcome.failed(this.failure) : presharedKey = null;
+  const _StepOutcome.cancelled() : presharedKey = null, failure = null;
+}
+
 /// Handles MFA flows and tunnel connection
 class TunnelService {
   /// Main service method - displays traffic & MFA dialogs, handles
   /// interface configuration and connection.
-  static Future<void> connect({
+  static Future<ConnectResult> connect({
     required BuildContext context,
-    required ToastManager toaster,
     required DefguardInstance instance,
     required Location location,
     required dynamic wireguardPlugin,
@@ -39,27 +81,21 @@ class TunnelService {
     RoutingMethod? trafficMethod,
     MfaMethod? mfaMethod,
   }) async {
-    // prepare navigator to avoid "context use across async gaps"
     final navigator = Navigator.of(context);
 
-    // handle traffic type selection if necessary
     late RoutingMethod selectedTrafficMethod;
     if (trafficMethod != null) {
       selectedTrafficMethod = trafficMethod;
     } else if (instance.clientTrafficPolicy ==
         ClientTrafficPolicy.disableAllTraffic) {
-      // instance enforces predefined traffic
       selectedTrafficMethod = RoutingMethod.predefined;
     } else if (instance.clientTrafficPolicy ==
         ClientTrafficPolicy.forceAllTraffic) {
-      // instance enforces all traffic
       selectedTrafficMethod = RoutingMethod.all;
     } else {
-      // instance allows traffic type selection - use stored method or display selection dialog
       if (location.trafficMethod != null) {
         selectedTrafficMethod = location.trafficMethod!;
       } else {
-        // no pre selected traffic choice available, ask user
         RoutingMethodDialogIntention dialogIntention = checkMfaEnabled(location)
             ? RoutingMethodDialogIntention.next
             : RoutingMethodDialogIntention.connect;
@@ -71,42 +107,31 @@ class TunnelService {
             clientTrafficPolicy: instance.clientTrafficPolicy,
           ),
         );
-        // smth went wrong or user canceled the operation
         if (userSelection == null) {
-          return;
+          return const ConnectResult.cancelled();
         }
         selectedTrafficMethod = userSelection;
       }
     }
 
-    // prepare wireguard plugin payload
     PluginConnectPayload payload = _makePayload(
       instance,
       location,
       selectedTrafficMethod,
     );
 
-    // the method that actually authorized this connection - stays null when no
-    // MFA was performed, which is what keeps non-MFA locations from having a
-    // phantom method remembered for them
     MfaMethod? authorizedWith;
 
-    // handle MFA if configured
     if (checkMfaEnabled(location)) {
-      // Request notification permissions for MFA session expiry alerts
       await requestNotificationPermissions();
       late MfaMethod selectedMfaMethod;
       if (location.locationMfaMode == LocationMfaMode.external) {
-        // location setup for openid mfa login - the server dictates the method,
-        // so this stays ahead of any caller-supplied choice
         selectedMfaMethod = MfaMethod.openid;
       } else if (mfaMethod != null &&
           !(mfaMethod == MfaMethod.biometric &&
               !biometricsStatus.canOpenStorage)) {
-        // caller already collected the choice from the user
         selectedMfaMethod = mfaMethod;
       } else {
-        // non-openid mfa setup, use stored method or show method choice dialog
         if (location.mfaMethod == null ||
             (location.mfaMethod == MfaMethod.biometric &&
                 !biometricsStatus.canOpenStorage)) {
@@ -119,8 +144,7 @@ class TunnelService {
             ),
           );
           if (userSelection == null) {
-            // dialog dismissed
-            return;
+            return const ConnectResult.cancelled();
           }
           selectedMfaMethod = userSelection;
         } else {
@@ -128,40 +152,36 @@ class TunnelService {
         }
       }
 
-      // perform MFA to get the preshared key
-      final presharedKey = await _performMfa(
+      final mfaOutcome = await _performMfa(
         navigator: navigator,
-        toaster: toaster,
         proxyUrl: instance.proxyUrl,
         payload: payload,
         method: selectedMfaMethod,
         secureStorageKey: instance.secureStorageKey,
         openidDisplayName: instance.openidDisplayName,
       );
-      if (presharedKey == null) {
-        // user dismissed the dialog
-        return;
+      if (mfaOutcome.failure != null) {
+        return mfaOutcome.failure!;
+      }
+      if (mfaOutcome.presharedKey == null) {
+        return const ConnectResult.cancelled();
       }
-      payload.presharedKey = presharedKey;
+      payload.presharedKey = mfaOutcome.presharedKey;
       authorizedWith = selectedMfaMethod;
     } else if (payload.postureCheckRequired) {
-      final presharedKey = await _performPostureCheck(
-        toaster: toaster,
+      final postureOutcome = await _performPostureCheck(
         proxyUrl: instance.proxyUrl,
         payload: payload,
         pollingToken: instance.poolingToken,
       );
-      if (presharedKey == null) {
-        return;
+      if (postureOutcome.failure != null) {
+        return postureOutcome.failure!;
       }
-      payload.presharedKey = presharedKey;
+      payload.presharedKey = postureOutcome.presharedKey;
     }
 
-    // start the tunnel
     await wireguardPlugin.startTunnel(jsonEncode(payload.toJson()));
 
-    // only remember what the caller explicitly collected from the user - the
-    // legacy dialogs keep owning their own "Remember my choice" checkbox
     await _rememberPreferences(
       db,
       instance,
@@ -169,6 +189,8 @@ class TunnelService {
       trafficMethod: trafficMethod,
       mfaMethod: mfaMethod != null ? authorizedWith : null,
     );
+
+    return const ConnectResult.connected();
   }
 
   /// Stores the connection preferences on the location row so the next connect
@@ -184,8 +206,6 @@ class TunnelService {
     RoutingMethod? trafficMethod,
     MfaMethod? mfaMethod,
   }) async {
-    // only the "none" policy leaves the routing choice to the user - under an
-    // enforced policy the value is the server's, not a preference
     final traffic =
         instance.clientTrafficPolicy == ClientTrafficPolicy.none &&
             trafficMethod != null
@@ -219,46 +239,50 @@ class TunnelService {
   }
 
   /// Performs posture-only authorization and returns runtime preshared key.
-  static Future<String?> _performPostureCheck({
-    required ToastManager toaster,
+  static Future<_StepOutcome> _performPostureCheck({
     required String proxyUrl,
     required PluginConnectPayload payload,
     required String pollingToken,
   }) async {
     try {
-      return await _authorizePostureOnly(
+      final presharedKey = await _authorizePostureOnly(
         proxyUrl,
         payload.devicePublicKey,
         payload.networkId,
         pollingToken,
       );
+      return _StepOutcome.success(presharedKey);
     } on PostureCheckException catch (e) {
-      toaster.showError(
-        message: e.message,
-        logMessage: 'Posture check failed',
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message: e.message,
+          logMessage: 'Posture check failed',
+          error: e,
+        ),
       );
     } on HttpException catch (e) {
-      toaster.showError(
-        message: 'Posture check request failed. Please try again.',
-        logMessage: 'Posture check request failed',
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message: 'Posture check request failed. Please try again.',
+          logMessage: 'Posture check request failed',
+          error: e,
+        ),
       );
     } catch (e) {
-      toaster.showError(
-        message: 'Posture check failed. Please try again.',
-        logMessage: 'Posture-only connect failed!',
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message: 'Posture check failed. Please try again.',
+          logMessage: 'Posture-only connect failed!',
+          error: e,
+        ),
       );
     }
-    return null;
   }
 
   /// Performs MFA using specified method.
-  /// Returns preshared key.
-  static Future<String?> _performMfa({
+  /// Returns the runtime preshared key on success.
+  static Future<_StepOutcome> _performMfa({
     required NavigatorState navigator,
-    required ToastManager toaster,
     required String proxyUrl,
     required PluginConnectPayload payload,
     required MfaMethod method,
@@ -266,7 +290,6 @@ class TunnelService {
     String? openidDisplayName,
   }) async {
     try {
-      // get session token
       final startMfaResponse = await _startMfa(
         proxyUrl,
         payload.devicePublicKey,
@@ -274,73 +297,69 @@ class TunnelService {
         method,
         payload.postureCheckRequired,
       );
+
+      String? presharedKey;
       if (method == MfaMethod.openid) {
-        // perform openid-based MFA
-        return await _handleOpenid(
+        presharedKey = await _handleOpenid(
           navigator: navigator,
           token: startMfaResponse.token,
           proxyUrl: proxyUrl,
           method: method,
           openidDisplayName: openidDisplayName,
         );
-      }
-      if (method == MfaMethod.biometric) {
+      } else if (method == MfaMethod.biometric) {
         if (startMfaResponse.challenge == null) {
           throw "Challenge not found in start response";
         }
         if (secureStorageKey == null) {
           throw "Storage key not provided";
         }
-        final secureStorage = await getBiometricInstanceStorage(
-          secureStorageKey,
-          prompt: "Confirm to connect",
-        );
-        final signed = signChallenge(
-          startMfaResponse.challenge!,
-          secureStorage.privateKey,
-        );
-        final finishData = FinishMfaRequest(
+        presharedKey = await _handleBiometric(
+          navigator: navigator,
+          proxyUrl: proxyUrl,
           token: startMfaResponse.token,
-          code: signed,
+          challenge: startMfaResponse.challenge!,
+          secureStorageKey: secureStorageKey,
         );
-        final response = await proxyApi.finishMfa(
-          Uri.parse(proxyUrl),
-          finishData,
+      } else {
+        presharedKey = await _handleCodeInput(
+          navigator: navigator,
+          token: startMfaResponse.token,
+          proxyUrl: proxyUrl,
+          method: method,
         );
-        return response.presharedKey;
       }
-      // perform email or totp MFA
-      return await _handleCodeInput(
-        navigator: navigator,
-        toaster: toaster,
-        token: startMfaResponse.token,
-        proxyUrl: proxyUrl,
-        method: method,
-      );
+
+      return presharedKey == null
+          ? const _StepOutcome.cancelled()
+          : _StepOutcome.success(presharedKey);
     } on MfaMethodNotAvailableException catch (e) {
       final methodString = e.method.toReadableString();
-      toaster.showError(
-        message:
-            "$methodString is not configured on your account. Select a different MFA method.",
-        logMessage:
-            "MFA method $methodString was not configured on the account. Connect Failed.",
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message:
+              "$methodString is not configured on your account. Select a different MFA method.",
+          logMessage:
+              "MFA method $methodString was not configured on the account. Connect Failed.",
+          error: e,
+        ),
       );
-      return null;
     } on HttpException catch (e) {
-      toaster.showError(
-        message: "MFA request failed. Please try again.",
-        logMessage: "Connect MFA failed!",
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message: "MFA request failed. Please try again.",
+          logMessage: "Connect MFA failed!",
+          error: e,
+        ),
       );
-      return null;
     } catch (e) {
-      toaster.showError(
-        message: "MFA failed. Please try again.",
-        logMessage: "MFA flow error!",
-        error: e,
+      return _StepOutcome.failed(
+        ConnectResult.failed(
+          message: "MFA failed. Please try again.",
+          logMessage: "MFA flow error!",
+          error: e,
+        ),
       );
-      return null;
     }
   }
 
@@ -369,91 +388,51 @@ class TunnelService {
     return presharedKey;
   }
 
-  /// Handles non-openid MFA flows (totp, email)
+  /// Handles biometric MFA flow
+  static Future<String?> _handleBiometric({
+    required NavigatorState navigator,
+    required String proxyUrl,
+    required String token,
+    required String challenge,
+    required String secureStorageKey,
+  }) async {
+    final presharedKey = await Navigator.of(navigator.context).push<String?>(
+      MaterialPageRoute(
+        builder: (context) => NextMfaBiometricScreen(
+          screenData: NextMfaBiometricScreenData(
+            proxyUrl: proxyUrl,
+            token: token,
+            challenge: challenge,
+            secureStorageKey: secureStorageKey,
+          ),
+        ),
+      ),
+    );
+    if (presharedKey != null) {
+      talker.info("Biometric authentication successful");
+    }
+    return presharedKey;
+  }
+
+  /// Handles code based MFA flows (totp, email)
   static Future<String?> _handleCodeInput({
     required NavigatorState navigator,
-    required ToastManager toaster,
     required String token,
     required String proxyUrl,
     required MfaMethod method,
   }) async {
-    try {
-      Widget screen;
-      if (method == MfaMethod.email) {
-        screen = NextMfaEmailScreen(
-          onSubmit: (code, setError) async {
-            try {
-              final finishData = FinishMfaRequest(token: token, code: code);
-              final response = await proxyApi.finishMfa(
-                Uri.parse(proxyUrl),
-                finishData,
-              );
-              if (navigator.mounted) {
-                Navigator.of(navigator.context).pop(response.presharedKey);
-              }
-            } on DioException catch (e) {
-              if (e.response?.statusCode == 401) {
-                setError('Enter valid code');
-              } else {
-                toaster.showError(
-                  message: ErrorHandler.getHumanReadableError(e),
-                  logMessage: "Email MFA code submit failed!",
-                  error: e,
-                );
-              }
-            } catch (e) {
-              toaster.showError(
-                message: ErrorHandler.getHumanReadableError(e),
-                logMessage: "Email MFA code submit failed!",
-                error: e,
-              );
-            }
-          },
-        );
-      } else {
-        screen = NextMfaTotpScreen(
-          onSubmit: (code, setError) async {
-            try {
-              final finishData = FinishMfaRequest(token: token, code: code);
-              final response = await proxyApi.finishMfa(
-                Uri.parse(proxyUrl),
-                finishData,
-              );
-              if (navigator.mounted) {
-                Navigator.of(navigator.context).pop(response.presharedKey);
-              }
-            } on DioException catch (e) {
-              if (e.response?.statusCode == 401) {
-                setError('Enter valid code');
-              } else {
-                toaster.showError(
-                  message: ErrorHandler.getHumanReadableError(e),
-                  logMessage: "TOTP MFA code submit failed!",
-                  error: e,
-                );
-              }
-            } catch (e) {
-              toaster.showError(
-                message: ErrorHandler.getHumanReadableError(e),
-                logMessage: "TOTP MFA code submit failed!",
-                error: e,
-              );
-            }
-          },
-        );
-      }
+    final screenData = NextMfaCodeScreenData(proxyUrl: proxyUrl, token: token);
+    final Widget screen = method == MfaMethod.email
+        ? NextMfaEmailScreen(screenData: screenData)
+        : NextMfaTotpScreen(screenData: screenData);
 
-      final presharedKey = await Navigator.of(
-        navigator.context,
-      ).push<String?>(MaterialPageRoute(builder: (context) => screen));
-      if (presharedKey != null) {
-        talker.info("Code authentication successful");
-      }
-      return presharedKey;
-    } catch (e) {
-      talker.error("MFA code input error: $e");
-      return null;
+    final presharedKey = await Navigator.of(
+      navigator.context,
+    ).push<String?>(MaterialPageRoute(builder: (context) => screen));
+    if (presharedKey != null) {
+      talker.info("Code authentication successful");
     }
+    return presharedKey;
   }
 
   /// Calls `/client-mfa/start` endpoint, returns `StartMfaResponse` with session token.
diff --git a/client/lib/open/screens/instance/widgets/next_connect_dialog.dart b/client/lib/open/screens/instance/widgets/next_connect_dialog.dart
index b436e4ca..589df8dd 100644
--- a/client/lib/open/screens/instance/widgets/next_connect_dialog.dart
+++ b/client/lib/open/screens/instance/widgets/next_connect_dialog.dart
@@ -1,8 +1,8 @@
 import 'dart:math' as math;
 
-import 'package:material_ui/material_ui.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/data/db/database.dart';
 import 'package:mobile/data/db/enums.dart';
 import 'package:mobile/open/riverpod/biometrics_state.dart';
@@ -18,7 +18,8 @@ import 'package:mobile/theme/next/text.dart';
 class NextConnectDialog extends HookConsumerWidget {
   final DefguardInstance instance;
   final Location location;
-  final Future<void> Function(RoutingMethod traffic, MfaMethod? mfa) onConnect;
+  final Future<ConnectResult> Function(RoutingMethod traffic, MfaMethod? mfa)
+  onConnect;
 
   const NextConnectDialog({
     super.key,
@@ -30,8 +31,6 @@ class NextConnectDialog extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final biometricsStatus = ref.watch(biometricsCapabilityProvider);
-    // must stay the same predicate TunnelService branches on, otherwise the
-    // sheet offers a factor the connect flow never asks for
     final isMfaEnabled = TunnelService.checkMfaEnabled(location);
 
     final bool canChangeTraffic =
@@ -139,9 +138,7 @@ class NextConnectDialog extends HookConsumerWidget {
                     const SizedBox(width: 8),
                     Expanded(
                       child: Text(
-                        selectedMfaMethod.value.toUiString(
-                          openidDisplayName: instance.openidDisplayName,
-                        ),
+                        selectedMfaMethod.value.toUiString(),
                         style: NextText.bodySm400.copyWith(
                           color: NextColor.fgWhite100,
                         ),
@@ -197,9 +194,9 @@ class NextConnectDialog extends HookConsumerWidget {
                   : RoutingMethod.predefined;
               final mfa = isMfaEnabled ? selectedMfaMethod.value : null;
 
-              await onConnect(traffic, mfa);
+              final result = await onConnect(traffic, mfa);
               if (context.mounted) {
-                Navigator.of(context).pop();
+                Navigator.of(context).pop(result);
               }
             } finally {
               isLoading.value = false;
diff --git a/client/lib/open/screens/next/mfa/next_mfa_biometric_screen.dart b/client/lib/open/screens/next/mfa/next_mfa_biometric_screen.dart
new file mode 100644
index 00000000..cf3849ec
--- /dev/null
+++ b/client/lib/open/screens/next/mfa/next_mfa_biometric_screen.dart
@@ -0,0 +1,164 @@
+import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
+import 'package:mobile/data/proxy/mfa.dart';
+import 'package:mobile/open/api.dart';
+import 'package:mobile/open/widgets/next/icons/next_icon.dart';
+import 'package:mobile/open/widgets/next/next_app_bar.dart';
+import 'package:mobile/open/widgets/next/next_button.dart';
+import 'package:mobile/open/widgets/next/next_icon_button.dart';
+import 'package:mobile/open/widgets/rive_asset_animation.dart';
+import 'package:mobile/open/widgets/toaster/toast_manager.dart';
+import 'package:mobile/theme/next/color.dart';
+import 'package:mobile/theme/next/spacing.dart';
+import 'package:mobile/theme/next/text.dart';
+import 'package:mobile/utils/secure_storage.dart';
+
+class NextMfaBiometricScreenData {
+  final String proxyUrl;
+  final String token;
+  final String challenge;
+  final String secureStorageKey;
+
+  const NextMfaBiometricScreenData({
+    required this.proxyUrl,
+    required this.token,
+    required this.challenge,
+    required this.secureStorageKey,
+  });
+}
+
+class NextMfaBiometricScreen extends HookConsumerWidget {
+  final NextMfaBiometricScreenData screenData;
+
+  const NextMfaBiometricScreen({super.key, required this.screenData});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final toaster = ref.read(toastManagerProvider.notifier);
+    final isLoading = useState(false);
+    final hasFailed = useState(false);
+
+    final handleVerify = useCallback(() async {
+      final navigator = Navigator.of(context);
+      isLoading.value = true;
+
+      late SecureInstanceStorage storage;
+      try {
+        storage = await getBiometricInstanceStorage(
+          screenData.secureStorageKey,
+          prompt: "Confirm to connect",
+        );
+      } on UserCanceledAuth catch (e) {
+        toaster.showError(
+          message: "Biometric verification cancelled.",
+          logMessage: "User canceled biometric MFA",
+          error: e,
+        );
+        isLoading.value = false;
+        hasFailed.value = true;
+        return;
+      } catch (e) {
+        toaster.showError(
+          message: "Biometric authentication failed.",
+          logMessage:
+              "Biometric MFA failed! Reason: ${getErrorMessageFromBiometricsException(e)}",
+          error: e,
+        );
+        isLoading.value = false;
+        hasFailed.value = true;
+        return;
+      }
+
+      try {
+        final signed = signChallenge(screenData.challenge, storage.privateKey);
+        final response = await proxyApi.finishMfa(
+          Uri.parse(screenData.proxyUrl),
+          FinishMfaRequest(token: screenData.token, code: signed),
+        );
+        if (navigator.mounted) {
+          navigator.pop(response.presharedKey);
+          return;
+        }
+      } catch (e) {
+        toaster.showError(
+          message: "Verification failed. Please try again.",
+          logMessage: "Biometric MFA challenge submit failed!",
+          error: e,
+        );
+      }
+      isLoading.value = false;
+      hasFailed.value = true;
+    }, [screenData]);
+
+    return Container(
+      decoration: const BoxDecoration(gradient: NextColor.gradientPrimary),
+      child: Scaffold(
+        backgroundColor: Colors.transparent,
+        appBar: NextAppBar(
+          context: context,
+          showLogo: false,
+          actionLeft: NextIconButton(
+            icon: 'arrow_small',
+            direction: NextIconDirection.left,
+            onTap: () => Navigator.of(context).maybePop(),
+          ),
+        ),
+        body: SafeArea(
+          child: Padding(
+            padding: const EdgeInsets.fromLTRB(20, 4, 20, 20),
+            child: Column(
+              children: [
+                Expanded(
+                  child: SingleChildScrollView(
+                    child: Column(
+                      mainAxisAlignment: MainAxisAlignment.start,
+                      crossAxisAlignment: CrossAxisAlignment.center,
+                      children: [
+                        const SizedBox(height: 70),
+                        const Center(
+                          child: SizedBox(
+                            height: 100,
+                            width: 100,
+                            child: RiveAssetAnimation(
+                              "assets/next/rive/biometric_face.riv",
+                            ),
+                          ),
+                        ),
+                        const SizedBox(height: 60),
+                        Text(
+                          "Biometric verification",
+                          style: NextText.h4.copyWith(
+                            color: NextColor.fgWhite100,
+                          ),
+                          textAlign: TextAlign.center,
+                        ),
+                        const SizedBox(height: 8),
+                        Text(
+                          "Confirm your identity using Face ID to continue.",
+                          style: NextText.bodySm400.copyWith(
+                            color: NextColor.fgWhite80,
+                          ),
+                          textAlign: TextAlign.center,
+                        ),
+                      ],
+                    ),
+                  ),
+                ),
+                const SizedBox(height: NextSpacing.xl),
+                NextButton(
+                  text: hasFailed.value ? "Retry" : "Verify now",
+                  style: NextButtonStyle.primary,
+                  size: NextButtonSize.big,
+                  width: double.infinity,
+                  loading: isLoading.value,
+                  onTap: handleVerify,
+                ),
+              ],
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/client/lib/open/screens/next/mfa/next_mfa_code_screen.dart b/client/lib/open/screens/next/mfa/next_mfa_code_screen.dart
new file mode 100644
index 00000000..9802448e
--- /dev/null
+++ b/client/lib/open/screens/next/mfa/next_mfa_code_screen.dart
@@ -0,0 +1,72 @@
+import 'package:dio/dio.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:material_ui/material_ui.dart';
+import 'package:mobile/data/proxy/mfa.dart';
+import 'package:mobile/open/api.dart';
+import 'package:mobile/open/widgets/next/next_code_entry_layout.dart';
+import 'package:mobile/open/widgets/toaster/toast_manager.dart';
+import 'package:mobile/utils/error_handler.dart';
+
+class NextMfaCodeScreenData {
+  final String proxyUrl;
+  final String token;
+
+  const NextMfaCodeScreenData({required this.proxyUrl, required this.token});
+}
+
+class NextMfaCodeScreen extends ConsumerWidget {
+  final NextMfaCodeScreenData screenData;
+  final String title;
+  final String description;
+  final String fieldLabel;
+
+  final String logLabel;
+
+  const NextMfaCodeScreen({
+    super.key,
+    required this.screenData,
+    required this.title,
+    required this.description,
+    required this.fieldLabel,
+    required this.logLabel,
+  });
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final toaster = ref.read(toastManagerProvider.notifier);
+
+    return NextCodeEntryLayout(
+      title: title,
+      description: description,
+      fieldLabel: fieldLabel,
+      onSubmit: (code, setError) async {
+        final navigator = Navigator.of(context);
+        try {
+          final response = await proxyApi.finishMfa(
+            Uri.parse(screenData.proxyUrl),
+            FinishMfaRequest(token: screenData.token, code: code),
+          );
+          if (navigator.mounted) {
+            navigator.pop(response.presharedKey);
+          }
+        } on DioException catch (e) {
+          if (e.response?.statusCode == 401) {
+            setError('Enter valid code');
+            return;
+          }
+          toaster.showError(
+            message: ErrorHandler.getHumanReadableError(e),
+            logMessage: "$logLabel MFA code submit failed!",
+            error: e,
+          );
+        } catch (e) {
+          toaster.showError(
+            message: ErrorHandler.getHumanReadableError(e),
+            logMessage: "$logLabel MFA code submit failed!",
+            error: e,
+          );
+        }
+      },
+    );
+  }
+}
diff --git a/client/lib/open/screens/next/mfa/next_mfa_email_screen.dart b/client/lib/open/screens/next/mfa/next_mfa_email_screen.dart
index 8eb3ccf3..0c7ab9b0 100644
--- a/client/lib/open/screens/next/mfa/next_mfa_email_screen.dart
+++ b/client/lib/open/screens/next/mfa/next_mfa_email_screen.dart
@@ -1,18 +1,19 @@
 import 'package:material_ui/material_ui.dart';
-import 'package:mobile/open/widgets/next/next_code_entry_layout.dart';
+import 'package:mobile/open/screens/next/mfa/next_mfa_code_screen.dart';
 
 class NextMfaEmailScreen extends StatelessWidget {
-  final NextCodeEntrySubmit onSubmit;
+  final NextMfaCodeScreenData screenData;
 
-  const NextMfaEmailScreen({super.key, required this.onSubmit});
+  const NextMfaEmailScreen({super.key, required this.screenData});
 
   @override
   Widget build(BuildContext context) {
-    return NextCodeEntryLayout(
+    return NextMfaCodeScreen(
+      screenData: screenData,
       title: 'Two-factor authentication',
       description: 'Paste the authentication code you received in the email.',
       fieldLabel: 'Authentication Code',
-      onSubmit: onSubmit,
+      logLabel: 'Email',
     );
   }
 }
diff --git a/client/lib/open/screens/next/mfa/next_mfa_totp_screen.dart b/client/lib/open/screens/next/mfa/next_mfa_totp_screen.dart
index 1d17fb17..f65b59e3 100644
--- a/client/lib/open/screens/next/mfa/next_mfa_totp_screen.dart
+++ b/client/lib/open/screens/next/mfa/next_mfa_totp_screen.dart
@@ -1,19 +1,20 @@
 import 'package:material_ui/material_ui.dart';
-import 'package:mobile/open/widgets/next/next_code_entry_layout.dart';
+import 'package:mobile/open/screens/next/mfa/next_mfa_code_screen.dart';
 
 class NextMfaTotpScreen extends StatelessWidget {
-  final NextCodeEntrySubmit onSubmit;
+  final NextMfaCodeScreenData screenData;
 
-  const NextMfaTotpScreen({super.key, required this.onSubmit});
+  const NextMfaTotpScreen({super.key, required this.screenData});
 
   @override
   Widget build(BuildContext context) {
-    return NextCodeEntryLayout(
+    return NextMfaCodeScreen(
+      screenData: screenData,
       title: 'Two-factor authentication',
       description:
           'Paste the authentication code from your Authenticator Application.',
       fieldLabel: 'Authentication Code',
-      onSubmit: onSubmit,
+      logLabel: 'TOTP',
     );
   }
 }
diff --git a/client/lib/open/screens/splash.dart b/client/lib/open/screens/splash.dart
index aefc76d4..080cc0b5 100644
--- a/client/lib/open/screens/splash.dart
+++ b/client/lib/open/screens/splash.dart
@@ -5,7 +5,10 @@ import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:mobile/data/db/database.dart';
 import 'package:mobile/router/routes.dart';
-import 'package:mobile/theme/next/color.dart';
+
+const _splashBackground = Color(0xFF4F79FA);
+
+const _splashCanvasSize = 288.0;
 
 class AppSplash extends HookConsumerWidget {
   const AppSplash({super.key});
@@ -44,10 +47,10 @@ class AppSplash extends HookConsumerWidget {
       return null;
     }, [instancesAsync.data, timerDone.value]);
 
-    return Container(
-      decoration: const BoxDecoration(gradient: NextColor.gradientPrimary),
-      child: SafeArea(
-        child: Center(child: Image.asset("assets/splash/logo.png", width: 160)),
+    return ColoredBox(
+      color: _splashBackground,
+      child: Center(
+        child: Image.asset("assets/splash/logo.png", width: _splashCanvasSize),
       ),
     );
   }
diff --git a/client/lib/open/widgets/toaster/next_toast.dart b/client/lib/open/widgets/toaster/next_toast.dart
index 91e20129..96de673c 100644
--- a/client/lib/open/widgets/toaster/next_toast.dart
+++ b/client/lib/open/widgets/toaster/next_toast.dart
@@ -1,5 +1,5 @@
-import 'package:material_ui/material_ui.dart';
 import 'package:flutter/widget_previews.dart';
+import 'package:material_ui/material_ui.dart';
 import 'package:mobile/open/widgets/next/icons/next_icon.dart';
 import 'package:mobile/open/widgets/next/next_preview_wrapper.dart';
 import 'package:mobile/open/widgets/toaster/toast_manager.dart';
@@ -49,30 +49,33 @@ class NextToast extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    return Container(
-      width: double.infinity,
-      constraints: const BoxConstraints(maxWidth: 400),
-      padding: const EdgeInsets.fromLTRB(12, 10, 12, 10),
-      decoration: BoxDecoration(
-        color: _backgroundColor,
-        borderRadius: BorderRadius.circular(8),
-      ),
-      child: Row(
-        mainAxisSize: MainAxisSize.min,
-        mainAxisAlignment: MainAxisAlignment.start,
-        crossAxisAlignment: CrossAxisAlignment.center,
-        children: [
-          _icon,
-          const SizedBox(width: NextSpacing.md),
-          Flexible(
-            child: Text(
-              message,
-              style: NextText.bodySm400.copyWith(color: _textColor),
-              maxLines: 4,
-              overflow: TextOverflow.ellipsis,
+    return Material(
+      type: MaterialType.transparency,
+      child: Container(
+        width: double.infinity,
+        constraints: const BoxConstraints(maxWidth: 400),
+        padding: const EdgeInsets.fromLTRB(12, 10, 12, 10),
+        decoration: BoxDecoration(
+          color: _backgroundColor,
+          borderRadius: BorderRadius.circular(8),
+        ),
+        child: Row(
+          mainAxisSize: MainAxisSize.min,
+          mainAxisAlignment: MainAxisAlignment.start,
+          crossAxisAlignment: CrossAxisAlignment.center,
+          children: [
+            _icon,
+            const SizedBox(width: NextSpacing.md),
+            Flexible(
+              child: Text(
+                message,
+                style: NextText.bodySm400.copyWith(color: _textColor),
+                maxLines: 4,
+                overflow: TextOverflow.ellipsis,
+              ),
             ),
-          ),
-        ],
+          ],
+        ),
       ),
     );
   }
diff --git a/client/pubspec.yaml b/client/pubspec.yaml
index cec95ad2..b3bb1700 100644
--- a/client/pubspec.yaml
+++ b/client/pubspec.yaml
@@ -179,7 +179,6 @@ flutter_native_splash:
 
   android_12:
     image: assets/splash/logo.png
-    icon_background_color: "#4F79FA"
 
   web: false
   android: true
diff --git a/wireguard_plugin/darwin/.gitignore b/wireguard_plugin/darwin/.gitignore
index 034771fc..899d2d05 100644
--- a/wireguard_plugin/darwin/.gitignore
+++ b/wireguard_plugin/darwin/.gitignore
@@ -36,3 +36,5 @@ Icon?
 /Flutter/Generated.xcconfig
 /Flutter/ephemeral/
 /Flutter/flutter_export_environment.sh
+.build/
+.swiftpm/
diff --git a/wireguard_plugin/darwin/Classes/Decodabe+Encodable.swift b/wireguard_plugin/darwin/Classes/Decodabe+Encodable.swift
deleted file mode 120000
index 44ee836e..00000000
--- a/wireguard_plugin/darwin/Classes/Decodabe+Encodable.swift
+++ /dev/null
@@ -1 +0,0 @@
-../../../client/ios/VPNExtension/Decodabe+Encodable.swift
\ No newline at end of file
diff --git a/wireguard_plugin/darwin/Classes/Shared.swift b/wireguard_plugin/darwin/Classes/Shared.swift
deleted file mode 120000
index 2d0e2b4b..00000000
--- a/wireguard_plugin/darwin/Classes/Shared.swift
+++ /dev/null
@@ -1 +0,0 @@
-../../../client/ios/VPNExtension/Shared.swift
\ No newline at end of file
diff --git a/wireguard_plugin/darwin/wireguard_plugin.podspec b/wireguard_plugin/darwin/wireguard_plugin.podspec
index dc0a8dd4..3d72d433 100644
--- a/wireguard_plugin/darwin/wireguard_plugin.podspec
+++ b/wireguard_plugin/darwin/wireguard_plugin.podspec
@@ -13,7 +13,7 @@ A new Flutter plugin project.
   s.license          = { :file => '../LICENSE' }
   s.author           = { 'Your Company' => 'email@example.com' }
   s.source           = { :path => '.' }
-  s.source_files = 'Classes/**/*.{swift,h,m}'
+  s.source_files = 'wireguard_plugin/Sources/wireguard_plugin/**/*.{swift,h,m}'
   s.ios.dependency 'Flutter'
   s.osx.dependency 'FlutterMacOS'
   s.ios.deployment_target = '15.0'
diff --git a/wireguard_plugin/darwin/wireguard_plugin/Package.swift b/wireguard_plugin/darwin/wireguard_plugin/Package.swift
new file mode 100644
index 00000000..67880ad7
--- /dev/null
+++ b/wireguard_plugin/darwin/wireguard_plugin/Package.swift
@@ -0,0 +1,31 @@
+// swift-tools-version: 5.9
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+import PackageDescription
+
+let package = Package(
+    name: "wireguard_plugin",
+    platforms: [
+        .iOS("15.0"),
+        .macOS("11.0")
+    ],
+    products: [
+        .library(name: "wireguard-plugin", targets: ["wireguard_plugin"])
+    ],
+    dependencies: [
+        .package(name: "FlutterFramework", path: "../FlutterFramework")
+    ],
+    targets: [
+        .target(
+            name: "wireguard_plugin",
+            dependencies: [
+                .product(name: "FlutterFramework", package: "FlutterFramework")
+            ],
+            linkerSettings: [
+                // Mirrors `s.frameworks` and OTHER_LDFLAGS in wireguard_plugin.podspec.
+                .linkedFramework("NetworkExtension"),
+                .linkedFramework("Network")
+            ]
+        )
+    ]
+)
diff --git a/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Decodabe+Encodable.swift b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Decodabe+Encodable.swift
new file mode 120000
index 00000000..3a9007e3
--- /dev/null
+++ b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Decodabe+Encodable.swift
@@ -0,0 +1 @@
+../../../../../client/ios/VPNExtension/Decodabe+Encodable.swift
\ No newline at end of file
diff --git a/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Shared.swift b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Shared.swift
new file mode 120000
index 00000000..f41be46a
--- /dev/null
+++ b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/Shared.swift
@@ -0,0 +1 @@
+../../../../../client/ios/VPNExtension/Shared.swift
\ No newline at end of file
diff --git a/wireguard_plugin/darwin/Classes/VPNError.swift b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/VPNError.swift
similarity index 100%
rename from wireguard_plugin/darwin/Classes/VPNError.swift
rename to wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/VPNError.swift
diff --git a/wireguard_plugin/darwin/Classes/VPNManager.swift b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/VPNManager.swift
similarity index 100%
rename from wireguard_plugin/darwin/Classes/VPNManager.swift
rename to wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/VPNManager.swift
diff --git a/wireguard_plugin/darwin/Classes/WireguardPlugin.swift b/wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/WireguardPlugin.swift
similarity index 100%
rename from wireguard_plugin/darwin/Classes/WireguardPlugin.swift
rename to wireguard_plugin/darwin/wireguard_plugin/Sources/wireguard_plugin/WireguardPlugin.swift