From eebecb14793eb4e540e469413232edc6c4f8f8b9 Mon Sep 17 00:00:00 2001
From: Dominik Schmidt <dev@dominik-schmidt.de>
Date: Tue, 9 Jun 2026 18:22:33 +0200
Subject: [PATCH] import remaining e2ee functionality

---
 .gitignore                                    |   1 +
 .woodpecker.star                              |  36 ++-
 packages/web-app-files/src/HandleUpload.ts    |  84 +++--
 .../src/components/AppBar/CreateAndUpload.vue |  32 +-
 .../components/SideBar/ActivitiesPanel.vue    |  61 +++-
 .../components/SideBar/Shares/FileLinks.vue   |   7 +
 .../src/composables/actions/files/index.ts    |   1 +
 .../actions/files/useFileActionsCreateLink.ts |   8 +
 .../files/useFileActionsCreateNewFile.ts      |  49 +--
 .../files/useFileActionsCreateNewFolder.ts    |  17 +-
 .../useFileActionsCreateSpaceFromResource.ts  |   2 +-
 .../files/useFileActionsDownloadArchive.ts    |   6 +
 .../actions/files/useFileActionsRename.ts     |  14 +
 .../actions/files/useFileActionsVaultLock.ts  | 145 +++++++++
 .../composables/extensions/useFileActions.ts  |  24 +-
 .../extensions/useFolderVaultIndicator.ts}    |  30 +-
 .../useKeyboardFileSpaceActions.ts            |  14 +-
 packages/web-app-files/src/extensions.ts      |   3 +
 .../src/views/spaces/GenericSpace.vue         |  20 ++
 .../tests/unit/HandleUpload.spec.ts           |  26 ++
 .../components/AppBar/CreateAndUpload.spec.ts |  18 +-
 .../SideBar/ActivitiesPanel.spec.ts           |  66 +++-
 .../SideBar/Details/FileDetails.spec.ts       |   1 +
 .../SideBar/Shares/FileLinks.spec.ts          |   9 +-
 .../files/useFileActionsCreateLink.spec.ts    |  13 +-
 .../files/useFileActionsRename.spec.ts        |  21 ++
 .../files/useFileActionsVaultLock.spec.ts     | 125 ++++++++
 .../useFolderVaultIndicator.spec.ts           |  67 ++++
 .../useKeyboardFileSpaceActions.spec.ts       |  98 ++++++
 packages/web-app-preview/src/App.vue          |  16 +-
 .../web-app-preview/tests/unit/app.spec.ts    |  42 ++-
 packages/web-app-rclone-crypt/package.json    |   2 +-
 .../web-app-rclone-crypt/src/crypto/engine.ts | 113 ++-----
 .../src/extensions/folderVault.ts             |   4 +-
 .../src/extensions/lockVault.ts               | 119 -------
 packages/web-app-rclone-crypt/src/index.ts    |  18 +-
 .../web-app-rclone-crypt/src/resolveVault.ts  |  43 +--
 .../web-app-rclone-crypt/src/vaultPath.ts     |  29 +-
 .../src/views/UnlockVault.vue                 |  64 +++-
 .../tests/unit/crypto/engine.spec.ts          | 109 +++++++
 .../tests/unit/resolveVault.spec.ts           |  54 ++++
 .../components/AppTemplates/AppWrapper.vue    | 138 +--------
 .../src/components/SearchBarFilter.vue        |   4 +-
 .../actions/files/useFileActions.ts           |   4 +-
 .../actions/files/useFileActionsRestore.ts    |  31 +-
 .../actions/files/useFileActionsUndoDelete.ts |  30 +-
 .../helpers/useFileActionsDeleteResources.ts  |  44 +--
 .../appDefaults/useAppFileHandling.ts         |  29 +-
 .../appDefaults/useAppFolderHandling.ts       |  41 +--
 .../composables/download/useDownloadFile.ts   |  49 ++-
 .../piniaStores/extensionRegistry/types.ts    |  60 +++-
 .../composables/piniaStores/folderVault.ts    |  93 +++---
 .../composables/resources/useLoadPreview.ts   |   7 +
 .../src/composables/search/useSearch.ts       |  34 +-
 packages/web-pkg/src/helpers/folderVault.ts   | 181 ++++++-----
 packages/web-pkg/src/helpers/index.ts         |   1 +
 packages/web-pkg/src/helpers/vaultEngine.ts   |  51 +++
 packages/web-pkg/src/helpers/vaultMimeType.ts |  40 +++
 .../web-pkg/src/services/client/client.ts     |   7 +-
 .../src/services/client/vaultWebDav.ts        | 269 ++++++++++++++++
 .../src/services/folder/folderService.ts      |   4 +-
 .../folder/loaders/loaderFavorites.ts         |  29 +-
 .../services/folder/loaders/loaderSpace.ts    |  39 +--
 .../web-pkg/src/services/uppy/uppyService.ts  |  34 ++
 .../components/sidebar/FileSideBar.spec.ts    |  12 +-
 .../piniaStores/folderVault.spec.ts           |  79 +++++
 .../resources/useLoadPreview.spec.ts          |  33 +-
 .../tests/unit/helpers/folderVault.spec.ts    | 211 +++++++++++++
 .../tests/unit/helpers/vaultEngine.spec.ts    |  48 +++
 .../tests/unit/services/client.spec.ts        |   5 +-
 .../unit/services/client/vaultWebDav.spec.ts  | 293 ++++++++++++++++++
 .../web-runtime/src/container/bootstrap.ts    |   3 -
 .../web-runtime/src/container/sse/files.ts    |  24 +-
 .../web-runtime/src/container/sse/types.ts    |   2 -
 packages/web-runtime/src/index.ts             |   1 -
 .../src/router/setupVaultUnlockGuard.ts       |  13 +-
 .../tests/unit/container/sse/files.spec.ts    |   3 -
 .../tests/unit/container/sse/helpers.spec.ts  |   3 -
 .../tests/unit/container/sse/shares.spec.ts   |   3 -
 .../tests/unit/container/sse/spaces.spec.ts   |   3 -
 .../unit/router/setupVaultUnlockGuard.spec.ts | 132 ++++++++
 .../src/mocks/defaultComponentMocks.ts        |   2 +-
 tests/e2e/cucumber/environment/index.ts       |  22 ++
 .../features/rclone-crypt/vault.feature       |  66 ++++
 tests/e2e/cucumber/steps/rcloneCrypt.ts       | 199 +++++++++++-
 tests/e2e/support/utils/dragDrop.ts           | 107 +++++--
 tests/woodpecker/config-opencloud.json        |   3 +-
 87 files changed, 3183 insertions(+), 914 deletions(-)
 create mode 100644 packages/web-app-files/src/composables/actions/files/useFileActionsVaultLock.ts
 rename packages/{web-app-rclone-crypt/src/extensions/resourceIndicator.ts => web-app-files/src/composables/extensions/useFolderVaultIndicator.ts} (67%)
 create mode 100644 packages/web-app-files/tests/unit/composables/actions/files/useFileActionsVaultLock.spec.ts
 create mode 100644 packages/web-app-files/tests/unit/composables/extensions/useFolderVaultIndicator.spec.ts
 create mode 100644 packages/web-app-files/tests/unit/composables/keyboardActions/useKeyboardFileSpaceActions.spec.ts
 delete mode 100644 packages/web-app-rclone-crypt/src/extensions/lockVault.ts
 create mode 100644 packages/web-app-rclone-crypt/tests/unit/crypto/engine.spec.ts
 create mode 100644 packages/web-app-rclone-crypt/tests/unit/resolveVault.spec.ts
 create mode 100644 packages/web-pkg/src/helpers/vaultEngine.ts
 create mode 100644 packages/web-pkg/src/helpers/vaultMimeType.ts
 create mode 100644 packages/web-pkg/src/services/client/vaultWebDav.ts
 create mode 100644 packages/web-pkg/tests/unit/composables/piniaStores/folderVault.spec.ts
 create mode 100644 packages/web-pkg/tests/unit/helpers/folderVault.spec.ts
 create mode 100644 packages/web-pkg/tests/unit/helpers/vaultEngine.spec.ts
 create mode 100644 packages/web-pkg/tests/unit/services/client/vaultWebDav.spec.ts
 create mode 100644 packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts

diff --git a/.gitignore b/.gitignore
index 1534439eeeb..20d5431c4c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,6 +27,7 @@ reports
 tests/opencloud
 tests/testing-app
 playwright-report
+test-results
 
 /webpack.json
 /webpack-build-log.json
diff --git a/.woodpecker.star b/.woodpecker.star
index f74cbef4f07..bbf7ca1876a 100644
--- a/.woodpecker.star
+++ b/.woodpecker.star
@@ -97,6 +97,14 @@ config = {
                 "app-store",
             ],
         },
+        "rclone-crypt": {
+            "earlyFail": True,
+            "skip": False,
+            "rcloneNeeded": True,
+            "suites": [
+                "rclone-crypt",
+            ],
+        },
         "a11y": {
             "earlyFail": True,
             "skip": False,
@@ -538,6 +546,31 @@ def unitTests(ctx):
         ],
     }]
 
+def installRclone(params):
+    # The rclone-crypt e2e suite shells out to the rclone CLI to build encrypted
+    # vault fixtures on the backend and to verify decryption against the
+    # reference implementation. rclone is a single static binary; pin the
+    # version (crypt format stays reproducible) AND verify the archive against a
+    # pinned SHA256 before extracting, so a tampered or corrupted download fails
+    # the step instead of installing an unverified binary.
+    if not params["rcloneNeeded"]:
+        return []
+    version = "v1.74.0"
+    archive = "rclone-%s-linux-amd64.zip" % version
+
+    # SHA256 of the official archive, from https://downloads.rclone.org/v1.74.0/SHA256SUMS
+    sha256 = "61de0a78d8776fe3e080f8385ebe96d817f2ee6a6003fe36b2d9f3b49d3e36ea"
+    url = "https://downloads.rclone.org/%s/%s" % (version, archive)
+    return [
+        "command -v unzip || (apt-get update && apt-get install -y unzip)",
+        "curl -fsSL %s -o /tmp/rclone.zip" % url,
+        # abort the step on any checksum mismatch, before we trust the archive
+        "echo '%s  /tmp/rclone.zip' | sha256sum -c -" % sha256,
+        "unzip -j /tmp/rclone.zip '*/rclone' -d /usr/local/bin",
+        "chmod +x /usr/local/bin/rclone",
+        "rclone version",
+    ]
+
 def e2eTests(ctx):
     default = {
         "skip": False,
@@ -547,6 +580,7 @@ def e2eTests(ctx):
         "suites": [],
         "features": [],
         "tikaNeeded": False,
+        "rcloneNeeded": False,
         "federationServer": False,
         "failOnUncaughtConsoleError": False,
         "extraServerEnvironment": {},
@@ -658,7 +692,7 @@ def e2eTests(ctx):
                          "name": "e2e-tests",
                          "image": OC_CI_NODEJS,
                          "environment": environment,
-                         "commands": [
+                         "commands": installRclone(params) + [
                              command,
                          ],
                      }] + \
diff --git a/packages/web-app-files/src/HandleUpload.ts b/packages/web-app-files/src/HandleUpload.ts
index 629b6672f41..e709c37964c 100644
--- a/packages/web-app-files/src/HandleUpload.ts
+++ b/packages/web-app-files/src/HandleUpload.ts
@@ -20,6 +20,7 @@ import {
   OcUppyMeta,
   OcUppyBody,
   resolveFolderVault,
+  encryptVaultPath,
   streamToBlob
 } from '@opencloud-eu/web-pkg'
 import { locationSpacesGeneric, UppyService } from '@opencloud-eu/web-pkg'
@@ -304,8 +305,7 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
   async createDirectoryTree(
     filesToUpload: OcUppyFile[],
     uploadFolder: Resource,
-    mergedFolders: string[] = [],
-    vaultEngine: FolderVaultEngine | null = null
+    mergedFolders: string[] = []
   ): Promise<{ filesToUpload: OcUppyFile[]; folderFiles: OcUppyFile[] }> {
     const { webdav } = this.clientService
     const space = unref(this.space)
@@ -374,16 +374,8 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
         this.uppyService.publish('addedForUpload', [uppyFile])
 
         try {
-          // Inside a vault every path segment we create on the server must
-          // be ciphertext. The directoryTree itself stays in cleartext for
-          // tracking purposes; we only translate the path right before the
-          // MKCOL call.
-          const cleartextPath = urlJoin(currentFolderPath, path)
-          const mkcolPath = vaultEngine
-            ? await vaultEngine.encryptPath(cleartextPath)
-            : cleartextPath
           const folder = await webdav.createFolder(space, {
-            path: mkcolPath,
+            path: urlJoin(currentFolderPath, path),
             fetchFolder: isRoot // FIXME: remove once we get the fileId from the server here
           })
           this.uppyService.publish('uploadSuccess', {
@@ -445,20 +437,6 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
     const uploadFolder = this.getUploadFolder(uploadId)
     let filesToUpload = this.prepareFiles(files, uploadFolder)
 
-    // Vault-aware upload: when the target folder lives inside a vault, swap
-    // every file's content for its ciphertext and rewrite the upload endpoint
-    // to the encrypted server path before Uppy starts pushing bytes. Folder
-    // creation (MKCOL) inside createDirectoryTree is vault-aware too — it
-    // pulls the engine out of the same registry.
-    const vaultEngine = resolveFolderVault(
-      this.extensionRegistry,
-      unref(this.space),
-      uploadFolder?.path
-    )
-    if (vaultEngine) {
-      filesToUpload = await this.applyVaultEncryption(filesToUpload, uploadFolder, vaultEngine)
-    }
-
     if (!this.directoryTreeCreateEnabled) {
       // if directory tree creation is disabled, we need to remove all folder files
       // from the upload queue (both locally and from Uppy's state to prevent upload attempts)
@@ -511,15 +489,29 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
       }
     }
 
+    // Vault-aware upload: when the target folder lives inside a vault, swap
+    // every file's content for its ciphertext and rewrite the upload endpoint
+    // to the encrypted server path before Uppy starts pushing bytes. Folder
+    // creation (MKCOL) inside createDirectoryTree is vault-aware too - it
+    // pulls the engine out of the same registry.
+    //
+    // This MUST run *after* conflict handling: getConflicts compares file
+    // names against the (cleartext) resource store, so encrypting names any
+    // earlier would hide every real name collision and silently overwrite.
+    // It also encrypts the cleartext names produced by a "keep both" choice.
+    const vaultEngine = await resolveFolderVault(
+      this.extensionRegistry,
+      unref(this.space),
+      uploadFolder?.path
+    )
+    if (vaultEngine) {
+      filesToUpload = await this.applyVaultEncryption(filesToUpload, uploadFolder, vaultEngine)
+    }
+
     this.uppyService.publish('uploadStarted')
     let folderFiles: OcUppyFile[] = []
     if (this.directoryTreeCreateEnabled) {
-      const result = await this.createDirectoryTree(
-        filesToUpload,
-        uploadFolder,
-        mergedFolders,
-        vaultEngine
-      )
+      const result = await this.createDirectoryTree(filesToUpload, uploadFolder, mergedFolders)
       filesToUpload = result.filesToUpload
       folderFiles = result.folderFiles
     }
@@ -544,7 +536,7 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
    * Replace each file's content + name with their encrypted forms and rewrite
    * the upload endpoint so Uppy/Tus pushes ciphertext to the encrypted
    * server path. Sub-paths inside a drag-drop are walked segment-by-segment
-   * — every segment of `relativeFolder` ends up as ciphertext on the wire,
+   * - every segment of `relativeFolder` ends up as ciphertext on the wire,
    * even though we keep the original cleartext tree on `file.meta` for
    * progress UI / directory creation tracking.
    */
@@ -554,29 +546,25 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
     vaultEngine: FolderVaultEngine
   ): Promise<OcUppyFile[]> {
     const space = unref(this.space)
-    const encryptedFolderPath = await vaultEngine.encryptPath(uploadFolder.path)
+    const encryptedFolderPath = await encryptVaultPath(vaultEngine, uploadFolder.path)
 
     const updated: Record<string, OcUppyFile> = {}
     for (const file of filesToUpload) {
       if (file.type === 'directory') {
-        // Folder entries don't get an HTTP payload of their own — the MKCOLs
+        // Folder entries don't get an HTTP payload of their own - the MKCOLs
         // happen in createDirectoryTree (which is also vault-aware). Skip
         // here so we don't try to encrypt a non-existent content stream.
         continue
       }
 
-      // Walk the cleartext relativeFolder segment-by-segment so each part
-      // is encrypted independently (rclone-crypt's filename EME operates
-      // per segment) and join the ciphertext segments back into a path the
-      // server understands.
+      // relativeFolder is already relative to the upload target, so encrypt it
+      // as one vault-relative path (the engine handles its own segments). The
+      // filename is just a one-segment path.
       const clearRelative = file.meta.relativeFolder || ''
-      const encryptedRelativeSegments: string[] = []
-      for (const segment of clearRelative.split('/').filter(Boolean)) {
-        encryptedRelativeSegments.push(await vaultEngine.encryptName(segment, uploadFolder.path))
-      }
-      const encryptedRelativeFolder = encryptedRelativeSegments.join('/')
-
-      const encryptedName = await vaultEngine.encryptName(file.name, uploadFolder.path)
+      const encryptedRelativeFolder = clearRelative
+        ? await vaultEngine.encryptPath(clearRelative)
+        : ''
+      const encryptedName = await vaultEngine.encryptPath(file.name)
 
       // Feed the engine the Blob's native stream instead of materialising the
       // whole plaintext first. The engine internals still collect today
@@ -585,11 +573,11 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
       // rclone-crypt blocks straight onto nacl can be swapped in without
       // touching this call site.
       //
-      // FIXME(poc-vault): the output is still collected into a Blob because
+      // TODO(vault): the output is still collected into a Blob because
       // Uppy + tus-js-client require `file.data` to be `Blob`-shaped with a
       // working `.slice()` for chunked uploads. End-to-end streaming would
       // need either a stream-aware uppy plugin or replacing the transport;
-      // both are out of PoC scope. The engine API stays streaming so that
+      // both are out of scope for now. The engine API stays streaming so that
       // change lands as a pure replacement here.
       // Drive the engine end-to-end with streams. Collection only happens
       // because Uppy + tus need a sliceable Blob for file.data, not because
@@ -609,7 +597,7 @@ export class HandleUpload extends BasePlugin<PluginOpts, OcUppyMeta, OcUppyBody>
       }
 
       // Mutate in-place so existing meta (uploadId, spaceId, …) is preserved.
-      // We keep meta.relativeFolder in cleartext on purpose — directoryTree
+      // We keep meta.relativeFolder in cleartext on purpose - directoryTree
       // creation reads it to decide which folders to MKCOL and translates
       // the path itself at the very last step.
       file.data = cipherBlob
diff --git a/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue b/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
index e8ad00fa0ab..2c4002fec89 100644
--- a/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
+++ b/packages/web-app-files/src/components/AppBar/CreateAndUpload.vue
@@ -41,15 +41,7 @@ import {
 
 import { computed, onMounted, onBeforeUnmount, unref, watch } from 'vue'
 import { SpaceResource, isPublicSpaceResource } from '@opencloud-eu/web-client'
-import {
-  decryptResourceInPlace,
-  markVaultStatus,
-  resolveFolderVault,
-  useService,
-  useUpload,
-  UppyService,
-  UploadResult
-} from '@opencloud-eu/web-pkg'
+import { useService, useUpload, UppyService, UploadResult } from '@opencloud-eu/web-pkg'
 import { HandleUpload } from '../../HandleUpload'
 import { useGettext } from 'vue3-gettext'
 import { storeToRefs } from 'pinia'
@@ -152,28 +144,13 @@ const onUploadComplete = async (result: UploadResult) => {
     return
   }
 
-  // Vault-aware refresh: the cleartext currentFolder path means nothing to
-  // the server, so encrypt before listing and decrypt the children back to
-  // cleartext before they enter the store. Without this the upload would
-  // pop up with the encrypted blob name.
-  const clearPath = unref(currentFolder).path
-  const vaultEngine = resolveFolderVault(extensionRegistry, unref(computedSpace), clearPath)
-  const listPath = vaultEngine ? await vaultEngine.encryptPath(clearPath) : clearPath
-
   const { children } = await clientService.webdav.listFiles(unref(computedSpace), {
-    path: listPath
+    path: unref(currentFolder).path
   })
 
   const existingIds = new Set(resourcesStore.resources.map((r) => r.id))
   const newResources = children.filter((child) => !existingIds.has(child.id))
 
-  // Decrypt only the resources we're actually about to upsert — children
-  // already in the store are already cleartext. Parallel because
-  // decryptResourceInPlace mutates only the resource it's given.
-  if (vaultEngine && newResources.length) {
-    await Promise.all(newResources.map((r) => decryptResourceInPlace(vaultEngine, r)))
-  }
-  markVaultStatus(extensionRegistry, unref(computedSpace), newResources)
   resourcesStore.upsertResources(newResources)
 }
 
@@ -192,7 +169,10 @@ const isMovingIntoSameFolder = computed(() => {
 })
 
 const isPasteHereButtonDisabled = computed(() => {
-  return !unref(canUpload) || unref(isMovingIntoSameFolder)
+  // Pasting into a vault isn't supported (the worker can't re-encrypt the moved
+  // content), so the button is disabled inside one - matching the context-menu
+  // paste action, which the "Paste here" button bypasses.
+  return !unref(canUpload) || unref(isMovingIntoSameFolder) || unref(currentFolder)?.isInVault
 })
 
 const pasteHereButtonTooltip = computed(() => {
diff --git a/packages/web-app-files/src/components/SideBar/ActivitiesPanel.vue b/packages/web-app-files/src/components/SideBar/ActivitiesPanel.vue
index 21b0283aed9..00366d78abe 100644
--- a/packages/web-app-files/src/components/SideBar/ActivitiesPanel.vue
+++ b/packages/web-app-files/src/components/SideBar/ActivitiesPanel.vue
@@ -40,7 +40,16 @@
 <script setup lang="ts">
 import { computed, inject, Ref, ref, unref, watch } from 'vue'
 import { useGettext } from 'vue3-gettext'
-import { formatDateFromDateTime, useClientService, UserAvatar } from '@opencloud-eu/web-pkg'
+import {
+  FolderVaultEngine,
+  formatDateFromDateTime,
+  getVaultClaim,
+  resolveFolderVault,
+  useClientService,
+  useExtensionRegistry,
+  useGetMatchingSpace,
+  UserAvatar
+} from '@opencloud-eu/web-pkg'
 import { useTask } from 'vue-concurrency'
 import { call, Resource } from '@opencloud-eu/web-client'
 import { DateTime } from 'luxon'
@@ -49,10 +58,42 @@ import escape from 'lodash-es/escape'
 
 const { $ngettext, current: currentLanguage } = useGettext()
 const clientService = useClientService()
+const extensionRegistry = useExtensionRegistry()
+const { getMatchingSpace } = useGetMatchingSpace()
 const resource = inject<Ref<Resource>>('resource')
 const activities = ref<Activity[]>([])
 const activitiesLimit = 200
 
+// Inside an unlocked vault the activity feed carries the encrypted blob names
+// the server stores. Decrypt every resource-name variable in place so the
+// feed reads like the user's cleartext file names. user/sharee are people and
+// never encrypted; cleartext segments (the vault root, a parent folder) make
+// decryptPath throw on the base32 decode, so we keep them as-is.
+const decryptActivityNames = async (items: Activity[], engine: FolderVaultEngine) => {
+  for (const activity of items) {
+    const variables = activity.template?.variables as Record<string, any> | undefined
+    if (!variables) {
+      continue
+    }
+    for (const [key, value] of Object.entries(variables)) {
+      if (key === 'user' || key === 'sharee' || !value) {
+        continue
+      }
+      for (const field of ['name', 'displayName'] as const) {
+        if (typeof value[field] !== 'string') {
+          continue
+        }
+        try {
+          // a resource name is a one-segment relative path
+          value[field] = await engine.decryptPath(value[field])
+        } catch {
+          // not a vault-encrypted segment - leave it untouched
+        }
+      }
+    }
+  }
+}
+
 const activitiesFooterText = computed(() => {
   return $ngettext(
     'Showing %{activitiesCount} activity',
@@ -65,12 +106,28 @@ const activitiesFooterText = computed(() => {
 })
 
 const loadActivitiesTask = useTask(function* (signal) {
-  activities.value = yield* call(
+  const loaded = yield* call(
     clientService.graphAuthenticated.activities.listActivities(
       `itemid:${unref(resource).fileId} AND limit:${activitiesLimit} AND sort:desc`,
       { signal }
     )
   )
+
+  // Only resolve the (possibly index-loading) engine and decrypt names when
+  // the vault scheme actually encrypts names. A content-only scheme leaves
+  // activity names in clear text, so there is nothing to decrypt and no need
+  // to touch the engine at all. claimsPath is a cheap, sync, engine-free check.
+  const res = unref(resource)
+  const space = res ? getMatchingSpace(res) : null
+  const claim = space ? getVaultClaim(extensionRegistry, space, res.path) : null
+  if (claim?.encryptsNames) {
+    const vaultEngine = yield* call(resolveFolderVault(extensionRegistry, space, res.path))
+    if (vaultEngine) {
+      yield* call(decryptActivityNames(loaded, vaultEngine))
+    }
+  }
+
+  activities.value = loaded
 }).restartable()
 
 const isLoading = computed(() => {
diff --git a/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue b/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
index 654bd5ddaf9..0738a9cd83b 100644
--- a/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
+++ b/packages/web-app-files/src/components/SideBar/Shares/FileLinks.vue
@@ -126,6 +126,13 @@ const canCreateLinks = computed(() => {
   if (!ability.can('create-all', 'PublicLink')) {
     return false
   }
+  // Public links rebase the path at the link target, dropping the vault's
+  // cleartext `.vault` anchor so the share can no longer be claimed and
+  // unlocked. Block link creation inside or at a vault root; collaborator
+  // shares stay available (see markVaultStatus).
+  if (unref(resource)?.isInVault) {
+    return false
+  }
   return canShare({ space: unref(space), resource: unref(resource) })
 })
 
diff --git a/packages/web-app-files/src/composables/actions/files/index.ts b/packages/web-app-files/src/composables/actions/files/index.ts
index 1cf249fa41d..eb8095d2f2f 100644
--- a/packages/web-app-files/src/composables/actions/files/index.ts
+++ b/packages/web-app-files/src/composables/actions/files/index.ts
@@ -17,3 +17,4 @@ export * from './useFileActionsRename'
 export * from './useFileActionsShowShares'
 export * from './useFileActionsShowDetails'
 export * from './useFileActionsToggleHideShare'
+export * from './useFileActionsVaultLock'
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateLink.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateLink.ts
index 78c4951b8e8..028bd59bb31 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateLink.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateLink.ts
@@ -76,6 +76,14 @@ export const useFileActionsCreateLink = ({
         return false
       }
 
+      // Public links rebase the path at the link target, dropping the vault's
+      // cleartext `.vault` anchor so the share can no longer be claimed and
+      // unlocked. Block link creation for vault roots and contents alike;
+      // collaborator sharing stays available (see markVaultStatus).
+      if (resource.isInVault) {
+        return false
+      }
+
       if (isProjectSpaceResource(resource) && resource.disabled) {
         return false
       }
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFile.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFile.ts
index 29e572d9b9c..8cdce1b8b1d 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFile.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFile.ts
@@ -6,13 +6,10 @@ import { computed, Ref, unref } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import {
   ApplicationFileExtension,
-  decryptResourceInPlace,
   FileAction,
   FileActionOptions,
   markVaultStatus,
   resolveFileNameDuplicate,
-  resolveFolderVault,
-  streamToArrayBuffer,
   useAppsStore,
   useClientService,
   useEmbedMode,
@@ -52,7 +49,7 @@ export const useFileActionsCreateNewFile = ({ space }: { space?: Ref<SpaceResour
     resourcesStore.upsertResource(resource)
 
     // Folder-typed new-menu entries (e.g. vault from rclone-crypt, notebooks
-    // from notes) may not register an editor route — when there's nothing to
+    // from notes) may not register an editor route - when there's nothing to
     // open we navigate into the freshly-created folder instead so the user
     // ends up inside it. Anything that *does* have a route (apps like notes)
     // keeps using openEditor.
@@ -78,7 +75,7 @@ export const useFileActionsCreateNewFile = ({ space }: { space?: Ref<SpaceResour
     extension: string,
     appFileExtension: ApplicationFileExtension
   ) => {
-    // Apps may override the default name shown in the create modal — e.g.
+    // Apps may override the default name shown in the create modal - e.g.
     // rclone-crypt wants "New vault.vault" instead of "New file.vault".
     // Fall back to the generic "New file" prefix when no override is set.
     const baseName = appFileExtension.newFileMenu?.defaultName?.() ?? $gettext('New file')
@@ -111,17 +108,6 @@ export const useFileActionsCreateNewFile = ({ space }: { space?: Ref<SpaceResour
 
         try {
           let resource: Resource
-          // Vault-aware: the picker/modal works in cleartext (what the user
-          // sees in the listing), but webdav needs the encrypted segment
-          // names. Look up the engine for the parent and translate before
-          // calling out — then decrypt the response so the upserted resource
-          // matches the rest of the (cleartext) listing.
-          const cleartextParentPath = unref(currentFolder).path
-          const vaultEngine = resolveFolderVault(
-            extensionRegistry,
-            unref(space),
-            cleartextParentPath
-          )
           if (appFileExtension.createFileHandler) {
             resource = await appFileExtension.createFileHandler({
               fileName,
@@ -129,27 +115,15 @@ export const useFileActionsCreateNewFile = ({ space }: { space?: Ref<SpaceResour
               currentFolder: unref(currentFolder)
             })
           } else if (appFileExtension.type === 'folder') {
-            const cleartextPath = join(cleartextParentPath, fileName)
-            const path = vaultEngine ? await vaultEngine.encryptPath(cleartextPath) : cleartextPath
+            const path = join(unref(currentFolder).path, fileName)
             resource = await (clientService.webdav as WebDAV).createFolder(unref(space), { path })
           } else {
-            const cleartextPath = join(cleartextParentPath, fileName)
-            const path = vaultEngine ? await vaultEngine.encryptPath(cleartextPath) : cleartextPath
-            // In a vault, "create empty file" must still produce a valid
-            // rclone-crypt blob on the server — a 0-byte PUT would have no
-            // header and refuse to decrypt later. Pipe an empty plaintext
-            // stream through encryptContent to get the file-header bytes.
-            const content = vaultEngine
-              ? await streamToArrayBuffer(vaultEngine.encryptContent(new Blob([]).stream()))
-              : undefined
+            const path = join(unref(currentFolder).path, fileName)
             resource = await (clientService.webdav as WebDAV).putFileContents(unref(space), {
-              path,
-              ...(content ? { content } : {})
+              path
             })
           }
-          if (vaultEngine && resource) {
-            await decryptResourceInPlace(vaultEngine, resource)
-          }
+
           markVaultStatus(extensionRegistry, unref(space), [resource])
 
           resourcesStore.upsertResource(resource)
@@ -209,7 +183,16 @@ export const useFileActionsCreateNewFile = ({ space }: { space?: Ref<SpaceResour
         handler: (args) => handler(args, appFileExtension.extension, appFileExtension),
         label: () => $gettext(appFileExtension.newFileMenu.menuTitle()),
         isVisible: () => {
-          return unref(currentFolder)?.canUpload({ user: userStore.user })
+          if (!unref(currentFolder)?.canUpload({ user: userStore.user })) {
+            return false
+          }
+          // No vault inside a vault: creating a ".vault" folder inside an
+          // (already encrypted) vault just yields a confusingly named folder, not
+          // a real nested vault, so hide that entry there.
+          if (appFileExtension.extension === 'vault' && unref(currentFolder)?.isInVault) {
+            return false
+          }
+          return true
         },
         class: 'oc-files-actions-create-new-file',
         ext: appFileExtension.extension,
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFolder.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFolder.ts
index 41976919306..ab2947c7787 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFolder.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateNewFolder.ts
@@ -4,13 +4,9 @@ import { join } from 'path'
 import { computed, nextTick, Ref, unref } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import {
-  decryptResourceInPlace,
   FileAction,
-  markVaultStatus,
   resolveFileNameDuplicate,
-  resolveFolderVault,
   useClientService,
-  useExtensionRegistry,
   useIsResourceNameValid,
   useMessages,
   useModals,
@@ -28,25 +24,14 @@ export const useFileActionsCreateNewFolder = ({ space }: { space?: Ref<SpaceReso
   const { resources, currentFolder } = storeToRefs(resourcesStore)
 
   const clientService = useClientService()
-  const extensionRegistry = useExtensionRegistry()
   const { isFileNameValid } = useIsResourceNameValid()
 
   const addNewFolder = async (folderName: string) => {
     folderName = folderName.trimEnd()
 
     try {
-      // Vault-aware: when the current folder sits inside a vault, the
-      // cleartext folder name has to be encrypted before hitting webdav, and
-      // the returned resource decrypted before it ends up in the store.
-      const cleartextParentPath = unref(currentFolder).path
-      const vaultEngine = resolveFolderVault(extensionRegistry, unref(space), cleartextParentPath)
-      const cleartextPath = join(cleartextParentPath, folderName)
-      const path = vaultEngine ? await vaultEngine.encryptPath(cleartextPath) : cleartextPath
+      const path = join(unref(currentFolder).path, folderName)
       const resource = await clientService.webdav.createFolder(unref(space), { path })
-      if (vaultEngine) {
-        await decryptResourceInPlace(vaultEngine, resource)
-      }
-      markVaultStatus(extensionRegistry, unref(space), [resource])
 
       // FIXME: move to buildResource as soon as it has space context
       if (isShareSpaceResource(unref(space))) {
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateSpaceFromResource.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateSpaceFromResource.ts
index c2499e2df72..32f823801ad 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsCreateSpaceFromResource.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsCreateSpaceFromResource.ts
@@ -142,7 +142,7 @@ export const useFileActionsCreateSpaceFromResource = () => {
 
         // The new space would receive ciphertext blobs (no key follows the
         // resource), so the contents would be unreadable. Hide for any
-        // vault resource — and for the vault root itself, which would
+        // vault resource - and for the vault root itself, which would
         // also lose the path-derived encryption.
         if (resources.some((r) => r.isInVault)) {
           return false
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsDownloadArchive.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsDownloadArchive.ts
index e733fca66ff..76fed9b521c 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsDownloadArchive.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsDownloadArchive.ts
@@ -105,6 +105,12 @@ export const useFileActionsDownloadArchive = () => {
           if (resources.length === 0) {
             return false
           }
+          // The archive is zipped server-side from the raw (ciphertext) blobs
+          // under their encrypted names - we can't decrypt that client-side,
+          // so hide archive download whenever a vault resource is involved.
+          if (resources.some((r) => r.isInVault)) {
+            return false
+          }
           if (resources.length === 1 && !resources[0].isFolder) {
             return false
           }
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsRename.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsRename.ts
index ffcb5fd1d95..e1af01e14bd 100644
--- a/packages/web-app-files/src/composables/actions/files/useFileActionsRename.ts
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsRename.ts
@@ -13,6 +13,7 @@ import {
   FileAction,
   FileActionOptions,
   createFileRouteOptions,
+  getVaultClaim,
   isLocationSharesActive,
   isLocationTrashActive,
   isSameResource,
@@ -20,6 +21,8 @@ import {
   useAbility,
   useCapabilityStore,
   useClientService,
+  useExtensionRegistry,
+  useFolderVaultStore,
   useIsResourceNameValid,
   useMessages,
   useModals,
@@ -41,16 +44,27 @@ export const useFileActionsRename = () => {
   const resourcesStore = useResourcesStore()
   const { setCurrentFolder, upsertResource } = resourcesStore
   const { isFileNameValid } = useIsResourceNameValid()
+  const extensionRegistry = useExtensionRegistry()
+  const folderVaultStore = useFolderVaultStore()
 
   const renameResource = async (space: SpaceResource, resource: Resource, newName: string) => {
     let currentFolder = resourcesStore.currentFolder
 
     try {
       const newPath = join(dirname(resource.path), newName)
+
       await (clientService.webdav as WebDAV).moveFiles(space, resource, space, {
         path: newPath
       })
 
+      // When the renamed resource *is* a vault root, its unlocked engine is
+      // filed under the old path key. Re-file it so the vault stays unlocked
+      // under the new name (no-op when the vault was never unlocked).
+      const claim = getVaultClaim(extensionRegistry, space, resource.path)
+      if (claim?.vaultRoot === resource.path) {
+        folderVaultStore.moveEngine(space.id, resource.path, newPath)
+      }
+
       const isCurrentFolder = isSameResource(resource, currentFolder)
 
       if (isShareSpaceResource(space) && resource.isReceivedShare()) {
diff --git a/packages/web-app-files/src/composables/actions/files/useFileActionsVaultLock.ts b/packages/web-app-files/src/composables/actions/files/useFileActionsVaultLock.ts
new file mode 100644
index 00000000000..6aecda87ff7
--- /dev/null
+++ b/packages/web-app-files/src/composables/actions/files/useFileActionsVaultLock.ts
@@ -0,0 +1,145 @@
+import { computed, Ref, unref } from 'vue'
+import { useGettext } from 'vue3-gettext'
+import { dirname } from 'path'
+import { Resource, SpaceResource } from '@opencloud-eu/web-client'
+import {
+  createFileRouteOptions,
+  ExtensionRegistry,
+  FileAction,
+  FileActionOptions,
+  FolderVaultClaim,
+  getVaultClaim,
+  useExtensionRegistry,
+  useFolderVaultStore,
+  useGetMatchingSpace,
+  useMessages,
+  useRouter
+} from '@opencloud-eu/web-pkg'
+
+// Lock and unlock are scheme-agnostic: a vault counts as unlocked exactly when
+// an engine sits in the folder-vault store, and the per-scheme bits (which
+// resource is a vault root, where the unlock UI lives) come straight from the
+// claim a folder-vault extension reports via `getVaultClaim`. So these actions
+// live with the generic file actions and work for any folder-vault scheme, not
+// just rclone-crypt.
+function claimForRoot(
+  extensionRegistry: ExtensionRegistry,
+  space: SpaceResource | undefined,
+  resource: Resource | undefined
+): FolderVaultClaim | null {
+  if (!space || !resource?.path) {
+    return null
+  }
+  const claim = getVaultClaim(extensionRegistry, space, resource.path)
+  // Only the root carries the lock/unlock affordance; content inside a vault
+  // is not a thing you lock on its own.
+  return claim && claim.vaultRoot === resource.path ? claim : null
+}
+
+export const useFileActionsLockVault = (): { actions: Ref<FileAction[]> } => {
+  const { $gettext } = useGettext()
+  const vaultStore = useFolderVaultStore()
+  const extensionRegistry = useExtensionRegistry()
+  const { showMessage } = useMessages()
+  const { getMatchingSpace } = useGetMatchingSpace()
+  const router = useRouter()
+
+  const actions = computed((): FileAction[] => [
+    {
+      name: 'lock-vault',
+      icon: 'lock',
+      iconFillType: 'line',
+      label: () => $gettext('Lock vault'),
+      category: 'tertiary',
+      handler: ({ resources }: FileActionOptions) => {
+        const resource = resources?.[0]
+        const space = getMatchingSpace(resource)
+        if (!claimForRoot(extensionRegistry, space, resource)) {
+          return
+        }
+        const vaultRoot = resource.path
+        vaultStore.clearEngine(resource.storageId, vaultRoot)
+        showMessage({
+          title: $gettext('»%{vault}« was locked', { vault: resource.name })
+        })
+        // If the user is sitting inside the freshly-locked vault, bounce them to
+        // its parent so they aren't left staring at ciphertext names. From
+        // outside (clicked the vault entry in a parent listing) no redirect is
+        // needed. Compare paths segment-wise - a bare substring match would also
+        // fire for a sibling like `my.vault-notes` - and rebuild the route from
+        // the space so multi-segment drive aliases survive.
+        const driveAliasAndItem =
+          (unref(router.currentRoute).params?.driveAliasAndItem as string | undefined) || ''
+        const itemPath =
+          '/' +
+          (driveAliasAndItem.startsWith(space.driveAlias)
+            ? driveAliasAndItem.slice(space.driveAlias.length)
+            : driveAliasAndItem
+          ).replace(/^\/+/, '')
+        const insideVault = itemPath === vaultRoot || itemPath.startsWith(`${vaultRoot}/`)
+        if (insideVault) {
+          router.push(createFileRouteOptions(space, { path: dirname(vaultRoot) }))
+        }
+      },
+      isVisible: ({ resources }: FileActionOptions) => {
+        const resource = resources?.[0]
+        const space = getMatchingSpace(resource)
+        if (!claimForRoot(extensionRegistry, space, resource)) {
+          return false
+        }
+        return vaultStore.isUnlocked(resource.storageId, resource.path)
+      },
+      class: 'oc-files-actions-lock-vault'
+    }
+  ])
+
+  return { actions }
+}
+
+export const useFileActionsUnlockVault = (): { actions: Ref<FileAction[]> } => {
+  const { $gettext } = useGettext()
+  const vaultStore = useFolderVaultStore()
+  const extensionRegistry = useExtensionRegistry()
+  const { getMatchingSpace } = useGetMatchingSpace()
+  const router = useRouter()
+
+  const actions = computed((): FileAction[] => [
+    {
+      name: 'unlock-vault',
+      icon: 'lock-unlock',
+      iconFillType: 'line',
+      label: () => $gettext('Unlock vault'),
+      category: 'tertiary',
+      handler: ({ resources }: FileActionOptions) => {
+        const resource = resources?.[0]
+        const space = getMatchingSpace(resource)
+        const claim = claimForRoot(extensionRegistry, space, resource)
+        if (!claim?.unlockRoute) {
+          return
+        }
+        // Send the user through the scheme's unlock UI but bring them back to
+        // the current (parent) location, not into the vault. That keeps the
+        // surrounding listing in view - the vault entry just flips from locked
+        // to unlocked. The claim already carries the route + its query (space,
+        // vault root); we only add where to return to.
+        const redirectUrl = unref(router.currentRoute).fullPath
+        router.push({
+          ...claim.unlockRoute,
+          query: { ...claim.unlockRoute.query, redirectUrl }
+        })
+      },
+      isVisible: ({ resources }: FileActionOptions) => {
+        const resource = resources?.[0]
+        const space = getMatchingSpace(resource)
+        const claim = claimForRoot(extensionRegistry, space, resource)
+        if (!claim?.unlockRoute) {
+          return false
+        }
+        return !vaultStore.isUnlocked(resource.storageId, resource.path)
+      },
+      class: 'oc-files-actions-unlock-vault'
+    }
+  ])
+
+  return { actions }
+}
diff --git a/packages/web-app-files/src/composables/extensions/useFileActions.ts b/packages/web-app-files/src/composables/extensions/useFileActions.ts
index be0a962f697..09a8162292c 100644
--- a/packages/web-app-files/src/composables/extensions/useFileActions.ts
+++ b/packages/web-app-files/src/composables/extensions/useFileActions.ts
@@ -21,7 +21,9 @@ import {
   useFileActionsRename,
   useFileActionsShowDetails,
   useFileActionsShowShares,
-  useFileActionsToggleHideShare
+  useFileActionsToggleHideShare,
+  useFileActionsLockVault,
+  useFileActionsUnlockVault
 } from '../actions'
 import { unref } from 'vue'
 
@@ -45,6 +47,8 @@ export const useFileActions = (): ActionExtension[] => {
   const { actions: setSpaceImageActions } = useSpaceActionsSetImage()
   const { actions: showDetailsActions } = useFileActionsShowDetails()
   const { actions: toggleHideShareActions } = useFileActionsToggleHideShare()
+  const { actions: lockVaultActions } = useFileActionsLockVault()
+  const { actions: unlockVaultActions } = useFileActionsUnlockVault()
 
   return [
     {
@@ -217,6 +221,24 @@ export const useFileActions = (): ActionExtension[] => {
         ...unref(toggleHideShareActions)[0],
         category: 'tertiary'
       }
+    },
+    {
+      id: 'com.github.opencloud-eu.web.files.context-action.lock-vault',
+      extensionPointIds: [contextActionsExtensionPoint.id, fileSideBarActionsExtensionPoint.id],
+      type: 'action',
+      action: {
+        ...unref(lockVaultActions)[0],
+        category: 'tertiary'
+      }
+    },
+    {
+      id: 'com.github.opencloud-eu.web.files.context-action.unlock-vault',
+      extensionPointIds: [contextActionsExtensionPoint.id, fileSideBarActionsExtensionPoint.id],
+      type: 'action',
+      action: {
+        ...unref(unlockVaultActions)[0],
+        category: 'tertiary'
+      }
     }
   ]
 }
diff --git a/packages/web-app-rclone-crypt/src/extensions/resourceIndicator.ts b/packages/web-app-files/src/composables/extensions/useFolderVaultIndicator.ts
similarity index 67%
rename from packages/web-app-rclone-crypt/src/extensions/resourceIndicator.ts
rename to packages/web-app-files/src/composables/extensions/useFolderVaultIndicator.ts
index 48f2db6b987..3a4b94032b3 100644
--- a/packages/web-app-rclone-crypt/src/extensions/resourceIndicator.ts
+++ b/packages/web-app-files/src/composables/extensions/useFolderVaultIndicator.ts
@@ -1,30 +1,44 @@
 import { useGettext } from 'vue3-gettext'
 import {
+  getVaultClaim,
   ResourceIndicator,
   ResourceIndicatorExtension,
-  useFolderVaultStore
+  useExtensionRegistry,
+  useFolderVaultStore,
+  useGetMatchingSpace
 } from '@opencloud-eu/web-pkg'
 import { Resource } from '@opencloud-eu/web-client'
-import { findVaultRoot } from '../vaultPath'
 
-export function useResourceIndicatorExtension(): ResourceIndicatorExtension {
+// Scheme-agnostic vault status indicator: the padlock and its locked/unlocked
+// state come entirely from the folder-vault store + the claim a folder-vault
+// extension reports, so this works for any scheme, not just rclone-crypt.
+export const useFolderVaultIndicator = (): ResourceIndicatorExtension => {
   const { $gettext } = useGettext()
   const vaultStore = useFolderVaultStore()
+  const extensionRegistry = useExtensionRegistry()
+  const { getMatchingSpace } = useGetMatchingSpace()
 
   return {
-    id: 'app.rclone-crypt.indicator',
+    id: 'com.github.opencloud-eu.web.files.folder-vault-indicator',
     type: 'resourceIndicator',
     extensionPointIds: ['global.files.resource-indicator'],
     getResourceIndicators(resource: Resource): ResourceIndicator[] | void {
-      const vaultRoot = findVaultRoot(resource.path)
-      if (!vaultRoot || !resource.storageId) {
+      // Cheap early-out on the hot path: markVaultStatus flags every vault
+      // resource, so non-vault resources skip the claim/space lookup entirely.
+      if (!resource.isInVault || !resource.storageId) {
+        return
+      }
+      const space = getMatchingSpace(resource)
+      const claim = space ? getVaultClaim(extensionRegistry, space, resource.path) : null
+      if (!claim) {
         return
       }
 
+      const vaultRoot = claim.vaultRoot
       const unlocked = vaultStore.isUnlocked(resource.storageId, vaultRoot)
 
       // The vault-root resource itself is what users see when browsing the
-      // parent folder — show open vs. closed lock so the unlock state is
+      // parent folder - show open vs. closed lock so the unlock state is
       // obvious without entering the vault first.
       const isVaultRoot = resource.path === vaultRoot
 
@@ -49,7 +63,7 @@ export function useResourceIndicatorExtension(): ResourceIndicatorExtension {
       }
 
       // Resources inside a vault: only annotate when the vault is actually
-      // unlocked (otherwise the user wouldn't be here in the first place — the
+      // unlocked (otherwise the user wouldn't be here in the first place - the
       // unlock guard intercepts before any listing renders).
       if (!unlocked) {
         return
diff --git a/packages/web-app-files/src/composables/keyboardActions/useKeyboardFileSpaceActions.ts b/packages/web-app-files/src/composables/keyboardActions/useKeyboardFileSpaceActions.ts
index 1281f418ecd..fe0bd87d469 100644
--- a/packages/web-app-files/src/composables/keyboardActions/useKeyboardFileSpaceActions.ts
+++ b/packages/web-app-files/src/composables/keyboardActions/useKeyboardFileSpaceActions.ts
@@ -20,14 +20,23 @@ export const useKeyboardFileSpaceActions = (
   const { actions: pasteFileActions } = useFileActionsPaste()
   const pasteFileAction = unref(pasteFileActions)[0].handler
 
+  // Copy/cut/paste in or out of a vault isn't supported (the worker can't
+  // re-encrypt content) and is blocked on the context-menu actions. The
+  // keyboard shortcuts bypass those isVisible guards, so gate them here too.
+  const selectionInVault = () => resourcesStore.selectedResources.some((r) => r.isInVault)
+  const currentFolderInVault = () => !!resourcesStore.currentFolder?.isInVault
+
   keyActions.bindKeyAction({ modifier: Modifier.Ctrl, primary: Key.C }, () => {
+    if (selectionInVault()) {
+      return
+    }
     copyResources(resourcesStore.selectedResources)
   })
 
   keyActions.bindKeyAction(
     { modifier: Modifier.Ctrl, primary: Key.V },
     () => {
-      if (clipboardStore.resources.length) {
+      if (clipboardStore.resources.length && !currentFolderInVault()) {
         pasteFileAction({ space: unref(space) })
       }
     },
@@ -38,6 +47,9 @@ export const useKeyboardFileSpaceActions = (
   )
 
   keyActions.bindKeyAction({ modifier: Modifier.Ctrl, primary: Key.X }, () => {
+    if (selectionInVault()) {
+      return
+    }
     cutResources(resourcesStore.selectedResources)
   })
 }
diff --git a/packages/web-app-files/src/extensions.ts b/packages/web-app-files/src/extensions.ts
index d9c6d866027..332b8f5887c 100644
--- a/packages/web-app-files/src/extensions.ts
+++ b/packages/web-app-files/src/extensions.ts
@@ -16,6 +16,7 @@ import { computed, markRaw, unref } from 'vue'
 import { SDKSearch } from './search'
 import { useSideBarPanels } from './composables/extensions/useFileSideBars'
 import { useFolderViews } from './composables/extensions/useFolderViews'
+import { useFolderVaultIndicator } from './composables/extensions/useFolderVaultIndicator'
 import { useFileActions } from './composables/extensions/useFileActions'
 import { useSpaceActions } from './composables/extensions/useSpaceActions'
 import { useTrashActions } from './composables/extensions/useTrashActions'
@@ -45,6 +46,7 @@ export const extensions = (appInfo: ApplicationInformation) => {
   const uploadActionExtensions = useUploadActions()
   const folderViewExtensions = useFolderViews()
   const sideBarPanelExtensions = useSideBarPanels()
+  const folderVaultIndicator = useFolderVaultIndicator()
 
   return computed<Extension[]>(() => [
     ...fileActionExtensions,
@@ -53,6 +55,7 @@ export const extensions = (appInfo: ApplicationInformation) => {
     ...uploadActionExtensions,
     ...folderViewExtensions,
     ...sideBarPanelExtensions,
+    folderVaultIndicator,
     {
       id: 'com.github.opencloud-eu.web.files.search',
       extensionPointIds: ['app.search.provider'],
diff --git a/packages/web-app-files/src/views/spaces/GenericSpace.vue b/packages/web-app-files/src/views/spaces/GenericSpace.vue
index ba6b5d0fe90..f82ee83a3c4 100644
--- a/packages/web-app-files/src/views/spaces/GenericSpace.vue
+++ b/packages/web-app-files/src/views/spaces/GenericSpace.vue
@@ -121,8 +121,11 @@ import {
 import {
   ResourceTransfer,
   TransferType,
+  getVaultClaim,
+  useExtensionRegistry,
   useFileActions,
   useLoadPreview,
+  useMessages,
   usePasteWorker,
   useResourcesStore,
   useRouter,
@@ -175,6 +178,8 @@ const props = defineProps<{
 const router = useRouter()
 const userStore = useUserStore()
 const { $gettext, $ngettext } = useGettext()
+const { showMessage } = useMessages()
+const extensionRegistry = useExtensionRegistry()
 const openWithDefaultAppQuery = useRouteQuery('openWithDefaultApp')
 const clientService = useClientService()
 const { startWorker } = usePasteWorker()
@@ -448,6 +453,21 @@ const fileDropped = async (fileTarget: string | { name: string; path: string })
     return
   }
 
+  // ResourceTransfer is vault-unaware (cleartext listing + path join), so a
+  // drag-move into or out of a vault would read/write at the wrong, cleartext
+  // paths. Block it whenever a vault is involved on either side. getVaultClaim
+  // is a cheap, path-based check that also covers a target fetched via
+  // getFileInfo (which doesn't carry the isInVault flag).
+  if (
+    selected.some((r) => r.isInVault) ||
+    getVaultClaim(extensionRegistry, unref(space), targetFolder.path)
+  ) {
+    showMessage({
+      title: $gettext('Moving items into or out of a vault by drag and drop is not supported')
+    })
+    return
+  }
+
   const resourceTransfer = new ResourceTransfer(
     unref(space),
     selected,
diff --git a/packages/web-app-files/tests/unit/HandleUpload.spec.ts b/packages/web-app-files/tests/unit/HandleUpload.spec.ts
index c3b9ece24b2..495fbaa1fb7 100644
--- a/packages/web-app-files/tests/unit/HandleUpload.spec.ts
+++ b/packages/web-app-files/tests/unit/HandleUpload.spec.ts
@@ -13,6 +13,8 @@ import {
   useSpacesStore,
   useExtensionRegistry,
   useResourcesStore,
+  resolveFolderVault,
+  FolderVaultEngine,
   OcUppyFile,
   OcUppyMeta,
   OcUppyBody
@@ -33,6 +35,11 @@ vi.mock('../../src/helpers/resource/actions', () => {
   return { UploadResourceConflict }
 })
 
+vi.mock('@opencloud-eu/web-pkg', async (importOriginal) => ({
+  ...(await importOriginal<any>()),
+  resolveFolderVault: vi.fn()
+}))
+
 type UppyPlugin = UnknownPlugin<OcUppyMeta, OcUppyBody, Record<string, unknown>>
 
 describe('HandleUpload', () => {
@@ -311,6 +318,25 @@ describe('HandleUpload', () => {
         await instance.handleUpload([mock<OcUppyFile>({ name: 'name' })])
         expect(getConflictsMock).not.toHaveBeenCalled()
       })
+      it('checks for conflicts before encrypting vault uploads', async () => {
+        // getConflicts compares file names against the cleartext resource
+        // store, so it has to run before applyVaultEncryption rewrites them to
+        // ciphertext. Otherwise every real collision is missed and the
+        // existing file is silently overwritten.
+        const { instance } = getWrapper()
+        vi.mocked(resolveFolderVault).mockResolvedValueOnce(mock<FolderVaultEngine>())
+        const encryptSpy = vi
+          .spyOn(instance as any, 'applyVaultEncryption')
+          .mockImplementation((...args: unknown[]) => Promise.resolve(args[0]))
+
+        await instance.handleUpload([mock<OcUppyFile>({ name: 'name' })])
+
+        expect(getConflictsMock).toHaveBeenCalled()
+        expect(encryptSpy).toHaveBeenCalled()
+        expect(getConflictsMock.mock.invocationCallOrder[0]).toBeLessThan(
+          encryptSpy.mock.invocationCallOrder[0]
+        )
+      })
       it('does not check for conflicts if uploads target a non-current folder', async () => {
         // setUploadFolder was used to redirect uploads to a folder other than the
         // user's current one. getConflicts can only check the current folder, so
diff --git a/packages/web-app-files/tests/unit/components/AppBar/CreateAndUpload.spec.ts b/packages/web-app-files/tests/unit/components/AppBar/CreateAndUpload.spec.ts
index 65f4ccf9c01..d4ac047e943 100644
--- a/packages/web-app-files/tests/unit/components/AppBar/CreateAndUpload.spec.ts
+++ b/packages/web-app-files/tests/unit/components/AppBar/CreateAndUpload.spec.ts
@@ -91,6 +91,20 @@ describe('CreateAndUpload component', () => {
         clipboardResources: [mock<Resource>({ parentFolderId: 'current-folder' })],
         currentFolder: mock<Resource>({
           id: 'current-folder',
+          isInVault: false,
+          canUpload: vi.fn().mockReturnValue(true)
+        })
+      })
+      const pasteBtn = wrapper.findComponent<typeof OcButton>(elSelector.pasteFilesBtn)
+      expect(pasteBtn.props('disabled')).toStrictEqual(true)
+    })
+    it('should disable the "paste files"-action when the current folder is in a vault', () => {
+      const { wrapper } = getWrapper({
+        clipboardResources: [mock<Resource>({ parentFolderId: 'another-folder' })],
+        clipboardAction: ClipboardActions.Copy,
+        currentFolder: mock<Resource>({
+          id: 'current-folder',
+          isInVault: true,
           canUpload: vi.fn().mockReturnValue(true)
         })
       })
@@ -103,6 +117,7 @@ describe('CreateAndUpload component', () => {
         clipboardAction: ClipboardActions.Copy,
         currentFolder: mock<Resource>({
           id: 'current-folder',
+          isInVault: false,
           canUpload: vi.fn().mockReturnValue(true)
         })
       })
@@ -118,6 +133,7 @@ describe('CreateAndUpload component', () => {
         ],
         currentFolder: mock<Resource>({
           id: 'current-folder',
+          isInVault: false,
           canUpload: vi.fn().mockReturnValue(true)
         })
       })
@@ -206,7 +222,7 @@ describe('CreateAndUpload component', () => {
 function getWrapper({
   clipboardResources = [],
   files = [],
-  currentFolder = mock<Resource>({ canUpload: () => true }),
+  currentFolder = mock<Resource>({ canUpload: () => true, isInVault: false }),
   currentRouteName = 'files-spaces-generic',
   space = mock<SpaceResource>(),
   spaces = [],
diff --git a/packages/web-app-files/tests/unit/components/SideBar/ActivitiesPanel.spec.ts b/packages/web-app-files/tests/unit/components/SideBar/ActivitiesPanel.spec.ts
index 75073cc69de..be0fb12b36f 100644
--- a/packages/web-app-files/tests/unit/components/SideBar/ActivitiesPanel.spec.ts
+++ b/packages/web-app-files/tests/unit/components/SideBar/ActivitiesPanel.spec.ts
@@ -1,9 +1,17 @@
 import ActivitiesPanel from '../../../../src/components/SideBar/ActivitiesPanel.vue'
 import { defaultComponentMocks, defaultPlugins, mount } from '@opencloud-eu/web-test-helpers'
-import { Resource } from '@opencloud-eu/web-client'
+import { Resource, SpaceResource } from '@opencloud-eu/web-client'
 import { mock } from 'vitest-mock-extended'
 import { flushPromises } from '@vue/test-utils'
 import { Activity } from '@opencloud-eu/web-client/graph/generated'
+import { getVaultClaim, resolveFolderVault } from '@opencloud-eu/web-pkg'
+
+vi.mock('@opencloud-eu/web-pkg', async (importOriginal) => ({
+  ...(await importOriginal<any>()),
+  resolveFolderVault: vi.fn(),
+  getVaultClaim: vi.fn(),
+  useGetMatchingSpace: () => ({ getMatchingSpace: () => mock<SpaceResource>() })
+}))
 
 const defaultActivities = [
   {
@@ -98,6 +106,62 @@ describe('ActivitiesPanel', () => {
     await flushPromises()
     expect(wrapper.html()).toMatchSnapshot()
   })
+  it('decrypts vault resource names in the feed and leaves user names untouched', async () => {
+    const engine = {
+      vaultRoot: '/my.vault',
+      decryptPath: vi.fn((segment: string) => Promise.resolve(`DEC(${segment})`))
+    }
+    vi.mocked(getVaultClaim).mockReturnValue({ vaultRoot: '/v', encryptsNames: true } as any)
+    vi.mocked(resolveFolderVault).mockResolvedValueOnce(engine as any)
+
+    const activities = [
+      {
+        id: '1',
+        times: { recordedTime: '2024-07-29T18:34:40Z' },
+        template: {
+          message: '{user} created {resource}.',
+          variables: {
+            user: { id: 'u1', displayName: 'Marie Curie' },
+            resource: { id: 'r1', name: 'encryptedblob' }
+          }
+        }
+      }
+    ] as unknown as Activity[]
+
+    const { wrapper } = getMountedWrapper({ activities })
+    await flushPromises()
+
+    // resource name is decrypted, the user (people) name is rendered untouched
+    expect(engine.decryptPath).toHaveBeenCalledWith('encryptedblob')
+    expect(wrapper.html()).toContain('DEC(encryptedblob)')
+    expect(wrapper.html()).toContain('Marie Curie')
+  })
+
+  it('does not resolve the engine or decrypt for a content-only scheme', async () => {
+    // encryptsNames=false -> names are clear text on the server, nothing to do.
+    vi.mocked(resolveFolderVault).mockClear()
+    vi.mocked(getVaultClaim).mockReturnValue({ vaultRoot: '/v', encryptsNames: false } as any)
+
+    const activities = [
+      {
+        id: '1',
+        times: { recordedTime: '2024-07-29T18:34:40Z' },
+        template: {
+          message: '{user} created {resource}.',
+          variables: {
+            user: { id: 'u1', displayName: 'Marie Curie' },
+            resource: { id: 'r1', name: 'cleartext-name.txt' }
+          }
+        }
+      }
+    ] as unknown as Activity[]
+
+    const { wrapper } = getMountedWrapper({ activities })
+    await flushPromises()
+
+    expect(resolveFolderVault).not.toHaveBeenCalled()
+    expect(wrapper.html()).toContain('cleartext-name.txt')
+  })
 })
 
 function getMountedWrapper({
diff --git a/packages/web-app-files/tests/unit/components/SideBar/Details/FileDetails.spec.ts b/packages/web-app-files/tests/unit/components/SideBar/Details/FileDetails.spec.ts
index ac7ca12faf5..831da4392e0 100644
--- a/packages/web-app-files/tests/unit/components/SideBar/Details/FileDetails.spec.ts
+++ b/packages/web-app-files/tests/unit/components/SideBar/Details/FileDetails.spec.ts
@@ -26,6 +26,7 @@ const getResourceMock = ({
     id: '1',
     type,
     isFolder: type === 'folder',
+    isInVault: false,
     mimeType,
     owner: {
       id: 'marie',
diff --git a/packages/web-app-files/tests/unit/components/SideBar/Shares/FileLinks.spec.ts b/packages/web-app-files/tests/unit/components/SideBar/Shares/FileLinks.spec.ts
index 6118628fa77..5bee1b2bc75 100644
--- a/packages/web-app-files/tests/unit/components/SideBar/Shares/FileLinks.spec.ts
+++ b/packages/web-app-files/tests/unit/components/SideBar/Shares/FileLinks.spec.ts
@@ -113,6 +113,13 @@ describe('FileLinks', () => {
       expect(wrapper.find(selectors.noSharePermissions).exists()).toBeTruthy()
     })
   })
+  describe('for a vault resource', () => {
+    it('hides the add-link button (public links cannot be claimed)', () => {
+      const resource = mock<Resource>({ isFolder: true, canShare: () => true, isInVault: true })
+      const { wrapper } = getWrapper({ resource })
+      expect(wrapper.find(selectors.linkAddButton).exists()).toBeFalsy()
+    })
+  })
   describe('user does not have the permission to create public links', () => {
     const resource = mock<Resource>({
       path: '/lorem.txt',
@@ -138,7 +145,7 @@ describe('FileLinks', () => {
 })
 
 function getWrapper({
-  resource = mock<Resource>({ isFolder: false, canShare: () => true }),
+  resource = mock<Resource>({ isFolder: false, canShare: () => true, isInVault: false }),
   links = defaultLinksList,
   abilities = [{ action: 'create-all', subject: 'PublicLink' }],
   canShare = true
diff --git a/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsCreateLink.spec.ts b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsCreateLink.spec.ts
index e5ec5dc404d..ec9bea09a01 100644
--- a/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsCreateLink.spec.ts
+++ b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsCreateLink.spec.ts
@@ -45,13 +45,22 @@ describe('useFileActionsCreateLink', () => {
       getWrapper({
         setup: ({ actions }) => {
           const resources = [
-            mock<Resource>({ canShare: () => true }),
-            mock<Resource>({ canShare: () => true })
+            mock<Resource>({ canShare: () => true, isInVault: false }),
+            mock<Resource>({ canShare: () => true, isInVault: false })
           ]
           expect(unref(actions)[0].isVisible({ space: null, resources })).toBeTruthy()
         }
       })
     })
+
+    it('should return false for a vault resource (public links cannot be claimed)', () => {
+      getWrapper({
+        setup: ({ actions }) => {
+          const resources = [mock<Resource>({ canShare: () => true, isInVault: true })]
+          expect(unref(actions)[0].isVisible({ space: null, resources })).toBeFalsy()
+        }
+      })
+    })
   })
 
   describe('handler', () => {
diff --git a/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsRename.spec.ts b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsRename.spec.ts
index 3667551cdaf..64c034066e6 100644
--- a/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsRename.spec.ts
+++ b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsRename.spec.ts
@@ -72,6 +72,27 @@ describe('rename', () => {
       })
     })
 
+    it('hands clear-text source and target path to moveFiles inside a vault', () => {
+      getWrapper({
+        setup: async ({ renameResource }, { space, clientService }) => {
+          const resource = {
+            id: '2',
+            path: '/my.vault/report.txt',
+            webDavPath: '/files/admin/my.vault/report.txt',
+            storageId: 'space-1'
+          }
+          await renameResource(space, resource, 'renamed.txt')
+
+          expect(clientService.webdav.moveFiles).toHaveBeenCalledWith(
+            space,
+            expect.objectContaining({ path: '/my.vault/report.txt' }),
+            space,
+            { path: '/my.vault/renamed.txt' }
+          )
+        }
+      })
+    })
+
     it('should handle errors properly', () => {
       vi.spyOn(console, 'error').mockImplementation(() => undefined)
 
diff --git a/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsVaultLock.spec.ts b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsVaultLock.spec.ts
new file mode 100644
index 00000000000..44dd3813d35
--- /dev/null
+++ b/packages/web-app-files/tests/unit/composables/actions/files/useFileActionsVaultLock.spec.ts
@@ -0,0 +1,125 @@
+import { unref } from 'vue'
+import {
+  useFileActionsLockVault,
+  useFileActionsUnlockVault
+} from '../../../../../src/composables/actions/files/useFileActionsVaultLock'
+
+const showMessage = vi.fn()
+const push = vi.fn()
+const clearEngine = vi.fn()
+
+// Module-level knobs the mocked web-pkg reads, reset per test.
+let unlocked = false
+let claim: any = null
+let matchedSpace: any = { id: 'space-1', driveAlias: 'personal/admin' }
+let routeParams: Record<string, unknown> = {}
+
+vi.mock('@opencloud-eu/web-pkg', () => ({
+  createFileRouteOptions: vi.fn(() => ({ name: 'files-spaces-generic' })),
+  getVaultClaim: vi.fn(() => claim),
+  useExtensionRegistry: () => ({}),
+  useFolderVaultStore: () => ({ clearEngine, isUnlocked: () => unlocked }),
+  useGetMatchingSpace: () => ({ getMatchingSpace: () => matchedSpace }),
+  useMessages: () => ({ showMessage }),
+  useRouter: () => ({
+    currentRoute: { fullPath: '/back', params: routeParams },
+    push
+  })
+}))
+
+vi.mock('vue3-gettext', () => ({ useGettext: () => ({ $gettext: (s: string) => s }) }))
+
+const vaultRoot = '/my.vault'
+const rootResource = () => ({ path: vaultRoot, name: 'my.vault', storageId: 'space-1' }) as any
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  unlocked = false
+  claim = { vaultRoot, unlockRoute: { name: 'unlock', query: { spaceId: 'space-1', vaultRoot } } }
+  matchedSpace = { id: 'space-1', driveAlias: 'personal/admin' }
+  routeParams = {}
+})
+
+describe('lock-vault action', () => {
+  it('is visible for an unlocked vault root', () => {
+    unlocked = true
+    const { actions } = useFileActionsLockVault()
+    expect(unref(actions)[0].isVisible({ resources: [rootResource()] } as any)).toBe(true)
+  })
+
+  it('is hidden when the vault root is already locked', () => {
+    unlocked = false
+    const { actions } = useFileActionsLockVault()
+    expect(unref(actions)[0].isVisible({ resources: [rootResource()] } as any)).toBe(false)
+  })
+
+  it('is hidden when the resource is not a vault root', () => {
+    unlocked = true
+    // claim is for the root, but this resource sits inside it -> not a root
+    const inside = { path: '/my.vault/sub', name: 'sub', storageId: 'space-1' } as any
+    const { actions } = useFileActionsLockVault()
+    expect(unref(actions)[0].isVisible({ resources: [inside] } as any)).toBe(false)
+  })
+
+  it('clears the engine and notifies, no redirect when outside the vault', () => {
+    const { actions } = useFileActionsLockVault()
+    unref(actions)[0].handler({ resources: [rootResource()] } as any)
+    expect(clearEngine).toHaveBeenCalledWith('space-1', vaultRoot)
+    expect(showMessage).toHaveBeenCalledTimes(1)
+    expect(push).not.toHaveBeenCalled()
+  })
+
+  it('redirects to the parent when the user sits inside the locked vault', () => {
+    routeParams = { driveAliasAndItem: 'personal/admin/my.vault' }
+    const { actions } = useFileActionsLockVault()
+    unref(actions)[0].handler({ resources: [rootResource()] } as any)
+    expect(clearEngine).toHaveBeenCalledWith('space-1', vaultRoot)
+    expect(push).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not redirect when the user sits in a sibling vault (prefix guard)', () => {
+    // `/my.vault-notes` merely starts with `/my.vault`; a naive substring match
+    // would wrongly bounce the user out. The segment-wise compare must not.
+    routeParams = { driveAliasAndItem: 'personal/admin/my.vault-notes' }
+    const { actions } = useFileActionsLockVault()
+    unref(actions)[0].handler({ resources: [rootResource()] } as any)
+    expect(clearEngine).toHaveBeenCalledWith('space-1', vaultRoot)
+    expect(push).not.toHaveBeenCalled()
+  })
+
+  it('does nothing for a non-root resource', () => {
+    const inside = { path: '/my.vault/sub', name: 'sub', storageId: 'space-1' } as any
+    const { actions } = useFileActionsLockVault()
+    unref(actions)[0].handler({ resources: [inside] } as any)
+    expect(clearEngine).not.toHaveBeenCalled()
+  })
+})
+
+describe('unlock-vault action', () => {
+  it('is visible for a locked vault root', () => {
+    unlocked = false
+    const { actions } = useFileActionsUnlockVault()
+    expect(unref(actions)[0].isVisible({ resources: [rootResource()] } as any)).toBe(true)
+  })
+
+  it('is hidden once the vault root is unlocked', () => {
+    unlocked = true
+    const { actions } = useFileActionsUnlockVault()
+    expect(unref(actions)[0].isVisible({ resources: [rootResource()] } as any)).toBe(false)
+  })
+
+  it('is hidden when the claim carries no unlock route', () => {
+    claim = { vaultRoot }
+    const { actions } = useFileActionsUnlockVault()
+    expect(unref(actions)[0].isVisible({ resources: [rootResource()] } as any)).toBe(false)
+  })
+
+  it('pushes the claim unlock route with the current location as redirect', () => {
+    const { actions } = useFileActionsUnlockVault()
+    unref(actions)[0].handler({ resources: [rootResource()] } as any)
+    expect(push).toHaveBeenCalledWith({
+      name: 'unlock',
+      query: { spaceId: 'space-1', vaultRoot, redirectUrl: '/back' }
+    })
+  })
+})
diff --git a/packages/web-app-files/tests/unit/composables/extensions/useFolderVaultIndicator.spec.ts b/packages/web-app-files/tests/unit/composables/extensions/useFolderVaultIndicator.spec.ts
new file mode 100644
index 00000000000..bc191530479
--- /dev/null
+++ b/packages/web-app-files/tests/unit/composables/extensions/useFolderVaultIndicator.spec.ts
@@ -0,0 +1,67 @@
+import { useFolderVaultIndicator } from '../../../../src/composables/extensions/useFolderVaultIndicator'
+
+let unlocked = false
+let claim: any = null
+let matchedSpace: any = { id: 'space-1' }
+
+vi.mock('@opencloud-eu/web-pkg', () => ({
+  getVaultClaim: vi.fn(() => claim),
+  useExtensionRegistry: () => ({}),
+  useFolderVaultStore: () => ({ isUnlocked: () => unlocked }),
+  useGetMatchingSpace: () => ({ getMatchingSpace: () => matchedSpace })
+}))
+
+vi.mock('vue3-gettext', () => ({ useGettext: () => ({ $gettext: (s: string) => s }) }))
+
+const vaultRoot = '/my.vault'
+const resource = (overrides: Record<string, unknown> = {}) =>
+  ({ id: 'r1', path: vaultRoot, storageId: 'space-1', isInVault: true, ...overrides }) as any
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  unlocked = false
+  claim = { vaultRoot }
+  matchedSpace = { id: 'space-1' }
+})
+
+describe('folder-vault resource indicator', () => {
+  const getIndicators = (res: any) => useFolderVaultIndicator().getResourceIndicators(res)
+
+  it('returns nothing for a resource outside any vault', () => {
+    expect(getIndicators(resource({ isInVault: false }))).toBeUndefined()
+  })
+
+  it('returns nothing when no extension claims the path', () => {
+    claim = null
+    expect(getIndicators(resource())).toBeUndefined()
+  })
+
+  it('shows a closed padlock for a locked vault root', () => {
+    unlocked = false
+    const indicators = getIndicators(resource()) as any[]
+    expect(indicators).toHaveLength(1)
+    expect(indicators[0].icon).toBe('lock-2')
+    expect(indicators[0].fillType).toBe('fill')
+    expect(indicators[0].type).toBe('vault-locked')
+  })
+
+  it('shows an open padlock for an unlocked vault root', () => {
+    unlocked = true
+    const indicators = getIndicators(resource()) as any[]
+    expect(indicators).toHaveLength(1)
+    expect(indicators[0].icon).toBe('lock-unlock')
+    expect(indicators[0].type).toBe('vault-unlocked')
+  })
+
+  it('annotates content inside an unlocked vault', () => {
+    unlocked = true
+    const indicators = getIndicators(resource({ path: '/my.vault/sub/file.txt' })) as any[]
+    expect(indicators).toHaveLength(1)
+    expect(indicators[0].type).toBe('vault-unlocked')
+  })
+
+  it('does not annotate content while the vault is locked', () => {
+    unlocked = false
+    expect(getIndicators(resource({ path: '/my.vault/sub/file.txt' }))).toBeUndefined()
+  })
+})
diff --git a/packages/web-app-files/tests/unit/composables/keyboardActions/useKeyboardFileSpaceActions.spec.ts b/packages/web-app-files/tests/unit/composables/keyboardActions/useKeyboardFileSpaceActions.spec.ts
new file mode 100644
index 00000000000..52980393178
--- /dev/null
+++ b/packages/web-app-files/tests/unit/composables/keyboardActions/useKeyboardFileSpaceActions.spec.ts
@@ -0,0 +1,98 @@
+import { ref } from 'vue'
+import { mock } from 'vitest-mock-extended'
+import { Resource, SpaceResource } from '@opencloud-eu/web-client'
+import { Key, KeyboardActions } from '@opencloud-eu/web-pkg'
+import { useKeyboardFileSpaceActions } from '../../../../src/composables/keyboardActions/useKeyboardFileSpaceActions'
+
+const copyResources = vi.fn()
+const cutResources = vi.fn()
+const pasteHandler = vi.fn()
+
+let selectedResources: Resource[] = []
+let currentFolder: Resource | null = null
+let clipboardResources: Resource[] = []
+
+vi.mock('@opencloud-eu/web-pkg', async (importOriginal) => ({
+  ...(await importOriginal<any>()),
+  useClipboardStore: () => ({
+    copyResources,
+    cutResources,
+    get resources() {
+      return clipboardResources
+    }
+  }),
+  useResourcesStore: () => ({
+    get selectedResources() {
+      return selectedResources
+    },
+    get currentFolder() {
+      return currentFolder
+    }
+  })
+}))
+
+vi.mock('../../../../src/composables/actions', () => ({
+  useFileActionsPaste: () => ({ actions: ref([{ handler: pasteHandler }]) })
+}))
+
+function createKeyActions(): KeyboardActions {
+  const actions = ref<any[]>([])
+  return {
+    actions,
+    bindKeyAction: vi.fn((keys: any, callback: any) => {
+      actions.value.push({ ...keys, modifier: keys.modifier ?? null, callback })
+    })
+  } as unknown as KeyboardActions
+}
+
+function trigger(keyActions: KeyboardActions, primary: Key) {
+  const action = (keyActions as any).actions.value.find((a: any) => a.primary === primary)
+  action?.callback(new KeyboardEvent('keydown'))
+}
+
+function install() {
+  const keyActions = createKeyActions()
+  useKeyboardFileSpaceActions(keyActions, ref(mock<SpaceResource>()))
+  return keyActions
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  selectedResources = []
+  currentFolder = null
+  clipboardResources = []
+})
+
+describe('useKeyboardFileSpaceActions vault gating', () => {
+  it('copies a non-vault selection on Ctrl+C', () => {
+    selectedResources = [mock<Resource>({ isInVault: false })]
+    trigger(install(), Key.C)
+    expect(copyResources).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not copy a vault selection on Ctrl+C', () => {
+    selectedResources = [mock<Resource>({ isInVault: true })]
+    trigger(install(), Key.C)
+    expect(copyResources).not.toHaveBeenCalled()
+  })
+
+  it('does not cut a vault selection on Ctrl+X', () => {
+    selectedResources = [mock<Resource>({ isInVault: true })]
+    trigger(install(), Key.X)
+    expect(cutResources).not.toHaveBeenCalled()
+  })
+
+  it('pastes into a normal folder on Ctrl+V', () => {
+    clipboardResources = [mock<Resource>()]
+    currentFolder = mock<Resource>({ isInVault: false })
+    trigger(install(), Key.V)
+    expect(pasteHandler).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not paste into a vault folder on Ctrl+V', () => {
+    clipboardResources = [mock<Resource>()]
+    currentFolder = mock<Resource>({ isInVault: true })
+    trigger(install(), Key.V)
+    expect(pasteHandler).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/web-app-preview/src/App.vue b/packages/web-app-preview/src/App.vue
index e97287d6c4b..a028b039faa 100644
--- a/packages/web-app-preview/src/App.vue
+++ b/packages/web-app-preview/src/App.vue
@@ -276,13 +276,15 @@ const loadPreviewImage = async (mediaFile: MediaFile) => {
   loadPreviewImageController = new AbortController()
 
   try {
-    // Vault resources (and anything else where the server explicitly says
-    // "no preview") can't be thumbnailed, so skip the preview service and
-    // fetch the full image instead — `getUrlForResource` is vault-aware and
-    // returns a blob URL with cleartext bytes. We only opt out on an
-    // explicit false; when hasPreview is missing we keep the legacy "try
-    // preview service" behaviour.
-    const useFullImage = mediaFile.isImage && mediaFile.resource.hasPreview?.() === false
+    // Vault images can't be thumbnailed server-side (the server only holds
+    // the ciphertext blob), so skip the preview service and fetch the full
+    // image instead - `getUrlForResource` is vault-aware and returns a blob
+    // URL with cleartext bytes. Gate strictly on the vault flag: every other
+    // image keeps the normal preview-service path, including the legacy
+    // no-thumbnail behaviour (do NOT key this off hasPreview(), or plain
+    // images the server has no thumbnail for would download the full
+    // original on every open).
+    const useFullImage = mediaFile.isImage && mediaFile.resource.isInVault
 
     if (mediaFile.isImage && !useFullImage) {
       mediaFile.url = await previewService.loadPreview(
diff --git a/packages/web-app-preview/tests/unit/app.spec.ts b/packages/web-app-preview/tests/unit/app.spec.ts
index 51ee2c20e01..1b2d0dd7cdc 100644
--- a/packages/web-app-preview/tests/unit/app.spec.ts
+++ b/packages/web-app-preview/tests/unit/app.spec.ts
@@ -2,6 +2,7 @@ import App from '../../src/App.vue'
 import { nextTick, ref } from 'vue'
 import { defaultComponentMocks, defaultPlugins, shallowMount } from '@opencloud-eu/web-test-helpers'
 import { FileContext, queryItemAsString } from '@opencloud-eu/web-pkg'
+import { Resource } from '@opencloud-eu/web-client'
 import { mock } from 'vitest-mock-extended'
 
 vi.mock('@panzoom/panzoom')
@@ -115,6 +116,40 @@ describe('Preview app', () => {
         expect.anything()
       )
     })
+
+    it('uses the preview service for a non-vault image even when the server reports no thumbnail', async () => {
+      const { wrapper, mocks, getUrlForResource } = createShallowMountWrapper()
+      await nextTick()
+      // ignore the implicit load for the active file on mount
+      mocks.$previewService.loadPreview.mockClear()
+      getUrlForResource.mockClear()
+
+      const mediaFile = {
+        isImage: true,
+        resource: mock<Resource>({ isInVault: false, hasPreview: () => false })
+      }
+      await (wrapper.vm as any).loadPreviewImage(mediaFile)
+
+      // must NOT download the full original just because there's no thumbnail
+      expect(mocks.$previewService.loadPreview).toHaveBeenCalled()
+      expect(getUrlForResource).not.toHaveBeenCalled()
+    })
+
+    it('fetches the full (decrypted) image via getUrlForResource for a vault image', async () => {
+      const { wrapper, mocks, getUrlForResource } = createShallowMountWrapper()
+      await nextTick()
+      mocks.$previewService.loadPreview.mockClear()
+      getUrlForResource.mockClear()
+
+      const mediaFile = {
+        isImage: true,
+        resource: mock<Resource>({ isInVault: true, hasPreview: () => false })
+      }
+      await (wrapper.vm as any).loadPreviewImage(mediaFile)
+
+      expect(getUrlForResource).toHaveBeenCalled()
+      expect(mocks.$previewService.loadPreview).not.toHaveBeenCalled()
+    })
   })
 
   describe('Generated "mediaFiles"', () => {
@@ -142,6 +177,8 @@ function createShallowMountWrapper({
   mocks.$previewService.loadPreview.mockResolvedValue('')
   vi.mocked(queryItemAsString).mockImplementationOnce(() => '1')
 
+  const getUrlForResource = vi.fn()
+
   return {
     wrapper: shallowMount(App, {
       props: {
@@ -152,7 +189,7 @@ function createShallowMountWrapper({
         activeFiles,
         isFolderLoading: true,
         revokeUrl: vi.fn(),
-        getUrlForResource: vi.fn(),
+        getUrlForResource,
         loadFolderForFileContext: vi.fn()
       },
       global: {
@@ -161,6 +198,7 @@ function createShallowMountWrapper({
         provide: mocks
       }
     }),
-    mocks
+    mocks,
+    getUrlForResource
   }
 }
diff --git a/packages/web-app-rclone-crypt/package.json b/packages/web-app-rclone-crypt/package.json
index 48c6f2ec567..ff53b5a47eb 100644
--- a/packages/web-app-rclone-crypt/package.json
+++ b/packages/web-app-rclone-crypt/package.json
@@ -2,7 +2,7 @@
   "name": "rclone-crypt",
   "version": "0.0.0",
   "private": true,
-  "description": "OpenCloud Web e2ee plugin: read rclone-crypt encrypted folders (PoC)",
+  "description": "OpenCloud Web plugin: browse, edit and upload rclone-crypt encrypted folder vaults",
   "license": "AGPL-3.0",
   "dependencies": {
     "@fyears/rclone-crypt": "^0.0.7"
diff --git a/packages/web-app-rclone-crypt/src/crypto/engine.ts b/packages/web-app-rclone-crypt/src/crypto/engine.ts
index 1c8aad2a761..832c5bf41c5 100644
--- a/packages/web-app-rclone-crypt/src/crypto/engine.ts
+++ b/packages/web-app-rclone-crypt/src/crypto/engine.ts
@@ -1,95 +1,38 @@
 import { Cipher } from '@fyears/rclone-crypt'
 import { FolderVaultEngine } from '@opencloud-eu/web-pkg'
 
-// rclone-crypt's filename encryption (EME) is deterministic, so once the key
-// is derived we keep one Cipher instance per (space, vault, password) tuple.
-// Key derivation (scrypt) is expensive; the cache avoids re-running it on
-// every folder listing.
-const cipherCache = new Map<string, Promise<Cipher>>()
-
-function cacheKey(spaceId: string, vaultRoot: string, password: string): string {
-  return `${spaceId}::${vaultRoot}::${password}`
-}
-
-async function getCipher(spaceId: string, vaultRoot: string, password: string): Promise<Cipher> {
-  const key = cacheKey(spaceId, vaultRoot, password)
-  let cipherPromise = cipherCache.get(key)
-  if (!cipherPromise) {
-    cipherPromise = (async () => {
-      const cipher = new Cipher('base32')
-      // Empty salt makes the cipher fall back to rclone's default salt — this
-      // matches the behaviour of `rclone config` when no password2 is set.
-      await cipher.key(password, '')
-      return cipher
-    })()
-    cipherCache.set(key, cipherPromise)
-  }
-  return cipherPromise
-}
-
-function vaultRelative(vaultRoot: string, fullPath: string): string {
-  if (!fullPath.startsWith(vaultRoot)) {
-    return ''
-  }
-  return fullPath.slice(vaultRoot.length).replace(/^\/+/, '').replace(/\/+$/, '')
-}
-
-function joinUnderVault(vaultRoot: string, relative: string): string {
-  if (!relative) {
-    return vaultRoot
-  }
-  return `${vaultRoot}/${relative}`
-}
-
-export function createEngine(
-  spaceId: string,
-  vaultRoot: string,
-  password: string
-): FolderVaultEngine {
-  const cipherPromise = getCipher(spaceId, vaultRoot, password)
+export function createEngine(vaultRoot: string, password: string): FolderVaultEngine {
+  // Derive the cipher once per engine. rclone-crypt's EME filename encryption
+  // is deterministic and scrypt key derivation is expensive, but the engine
+  // instance is held for the session by the folder-vault store, so a single
+  // derivation per unlock is enough - no separate cipher cache needed.
+  const cipherPromise = (async () => {
+    const cipher = new Cipher('base32')
+    // Empty salt makes the cipher fall back to rclone's default salt - matches
+    // `rclone config` when no password2 is set.
+    await cipher.key(password, '')
+    return cipher
+  })()
 
   return {
     vaultRoot,
-    isLocked: () => false,
-    async encryptPath(clearPath: string): Promise<string> {
-      if (!clearPath.startsWith(vaultRoot)) {
-        // Path is outside our vault — leave it untouched. Returning the vault
-        // root here would silently rewrite unrelated resources onto the vault.
-        return clearPath
-      }
-      const relative = vaultRelative(vaultRoot, clearPath)
-      if (!relative) {
-        return vaultRoot
-      }
-      const cipher = await cipherPromise
-      const encrypted = await cipher.encryptFileName(relative)
-      return joinUnderVault(vaultRoot, encrypted)
-    },
-    async decryptPath(encryptedPath: string): Promise<string> {
-      if (!encryptedPath.startsWith(vaultRoot)) {
-        return encryptedPath
-      }
-      const relative = vaultRelative(vaultRoot, encryptedPath)
-      if (!relative) {
-        return vaultRoot
-      }
-      const cipher = await cipherPromise
-      const decrypted = await cipher.decryptFileName(relative)
-      return joinUnderVault(vaultRoot, decrypted)
-    },
-    async decryptName(encryptedSegment: string, _parentClearPath: string): Promise<string> {
-      if (!encryptedSegment) {
-        return encryptedSegment
+    // encryptPath/decryptPath work on paths RELATIVE to the vault root (e.g.
+    // "sub/x"); the vault root never appears here. rclone-crypt's EME filename
+    // encryption is per segment, but that's this engine's private choice - the
+    // generic caller (encryptVaultPath) just hands over the whole relative path.
+    async encryptPath(relativePath: string): Promise<string> {
+      if (!relativePath) {
+        return relativePath
       }
       const cipher = await cipherPromise
-      return cipher.decryptSegment(encryptedSegment)
+      return cipher.encryptFileName(relativePath)
     },
-    async encryptName(clearSegment: string, _parentClearPath: string): Promise<string> {
-      if (!clearSegment) {
-        return clearSegment
+    async decryptPath(relativePath: string): Promise<string> {
+      if (!relativePath) {
+        return relativePath
       }
       const cipher = await cipherPromise
-      return cipher.encryptSegment(clearSegment)
+      return cipher.decryptFileName(relativePath)
     },
     async verifyKey(sampleEncryptedSegment: string): Promise<boolean> {
       // rclone-crypt throws on bad password (PKCS#7 unpad fails, UTF-8 decode
@@ -105,7 +48,7 @@ export function createEngine(
       }
     },
     encryptContent(plaintext: ReadableStream<Uint8Array>): ReadableStream<Uint8Array> {
-      // FIXME(poc-vault): mirrors decryptContent — buffer the whole input,
+      // TODO(vault): mirrors decryptContent - buffer the whole input,
       // call cipher.encryptData, emit one chunk. Same upgrade path applies.
       return new ReadableStream<Uint8Array>({
         async start(controller) {
@@ -138,12 +81,12 @@ export function createEngine(
       })
     },
     decryptContent(encrypted: ReadableStream<Uint8Array>): ReadableStream<Uint8Array> {
-      // FIXME(poc-vault): @fyears/rclone-crypt's `decryptData` operates on a
+      // TODO(vault): @fyears/rclone-crypt's `decryptData` operates on a
       // single Uint8Array, so we buffer the whole input before decrypting and
       // emit one chunk on the output. The rclone-crypt format itself is
       // chunked (64 KiB blocks + per-block nonce + a 32-byte file header), so
-      // a future implementation — either an upstream stream API or a
-      // hand-rolled one over the salsa primitives — can swap this body for a
+      // a future implementation - either an upstream stream API or a
+      // hand-rolled one over the salsa primitives - can swap this body for a
       // pipe that decrypts block-by-block without breaking callers.
       return new ReadableStream<Uint8Array>({
         async start(controller) {
diff --git a/packages/web-app-rclone-crypt/src/extensions/folderVault.ts b/packages/web-app-rclone-crypt/src/extensions/folderVault.ts
index f90b1feb191..3f99b1a8bd8 100644
--- a/packages/web-app-rclone-crypt/src/extensions/folderVault.ts
+++ b/packages/web-app-rclone-crypt/src/extensions/folderVault.ts
@@ -4,7 +4,9 @@ import { claimsVaultPath, resolveVault } from '../resolveVault'
 export const folderVaultExtension: FolderVaultExtension = {
   id: 'app.rclone-crypt.folder-vault',
   type: 'folderVault',
-  resolve(space, path) {
+  // rclone-crypt has no per-vault index to load, so this resolves
+  // synchronously and the async wrapper just returns a resolved promise.
+  async resolve(space, path) {
     return resolveVault(space, path)
   },
   claimsPath(space, path) {
diff --git a/packages/web-app-rclone-crypt/src/extensions/lockVault.ts b/packages/web-app-rclone-crypt/src/extensions/lockVault.ts
deleted file mode 100644
index 93f084cdb2c..00000000000
--- a/packages/web-app-rclone-crypt/src/extensions/lockVault.ts
+++ /dev/null
@@ -1,119 +0,0 @@
-import { computed, Ref, unref } from 'vue'
-import { useGettext } from 'vue3-gettext'
-import {
-  ActionExtension,
-  FileAction,
-  FileActionOptions,
-  useFolderVaultStore,
-  useMessages,
-  useRouter
-} from '@opencloud-eu/web-pkg'
-import { Resource } from '@opencloud-eu/web-client'
-
-function isVaultRoot(resource: Resource | undefined): boolean {
-  if (!resource) return false
-  if (resource.type !== 'folder' && !resource.isFolder) return false
-  return resource.name?.endsWith('.vault') === true
-}
-
-export const useLockVaultAction = (): Ref<FileAction> => {
-  const { $gettext } = useGettext()
-  const vaultStore = useFolderVaultStore()
-  const { showMessage } = useMessages()
-  const router = useRouter()
-
-  return computed(() => ({
-    name: 'lock-vault',
-    icon: 'lock',
-    iconFillType: 'line',
-    label: () => $gettext('Lock vault'),
-    category: 'tertiary',
-    handler: ({ resources }: FileActionOptions) => {
-      const resource = resources?.[0]
-      if (!resource || !isVaultRoot(resource) || !resource.storageId) return
-      const spaceId = resource.storageId
-      const vaultRoot = resource.path
-      vaultStore.clearSecret(spaceId, vaultRoot)
-      showMessage({
-        title: $gettext('»%{vault}« was locked', { vault: resource.name })
-      })
-      // If the user happens to be sitting inside the freshly-locked vault,
-      // bounce them to the parent so they aren't staring at encrypted
-      // ciphertext names. From outside (clicked on the vault entry in the
-      // parent listing) the current route is fine — no redirect needed.
-      const currentPath =
-        (unref(router.currentRoute).params?.driveAliasAndItem as string | undefined) || ''
-      if (currentPath.includes(vaultRoot.replace(/^\//, ''))) {
-        const parent = vaultRoot.replace(/\/[^/]+$/, '') || '/'
-        router.push(`/files/spaces/${currentPath.split('/')[0]}${parent === '/' ? '' : parent}`)
-      }
-    },
-    isVisible: ({ resources }: FileActionOptions) => {
-      const resource = resources?.[0]
-      if (!resource || !isVaultRoot(resource) || !resource.storageId) return false
-      return vaultStore.isUnlocked(resource.storageId, resource.path)
-    },
-    class: 'oc-files-actions-lock-vault'
-  }))
-}
-
-export function lockVaultActionExtension(action: Ref<FileAction>): ActionExtension {
-  return {
-    id: 'app.rclone-crypt.lock-vault',
-    type: 'action',
-    // String literal matches `contextActionsExtensionPoint.id` in web-app-files
-    // — see other plugins that hook the same point.
-    extensionPointIds: ['global.files.context-actions'],
-    get action() {
-      return unref(action)
-    }
-  } as ActionExtension
-}
-
-export const useUnlockVaultAction = (): Ref<FileAction> => {
-  const { $gettext } = useGettext()
-  const vaultStore = useFolderVaultStore()
-  const router = useRouter()
-
-  return computed(() => ({
-    name: 'unlock-vault',
-    icon: 'lock-unlock',
-    iconFillType: 'line',
-    label: () => $gettext('Unlock vault'),
-    category: 'tertiary',
-    handler: ({ resources }: FileActionOptions) => {
-      const resource = resources?.[0]
-      if (!resource || !isVaultRoot(resource) || !resource.storageId) return
-      // Send the user through the unlock screen but bring them back to the
-      // current (parent) location, not into the vault. That keeps the
-      // surrounding listing in view — the vault entry just flips from locked
-      // to unlocked. Mirror image of the lock action.
-      const back = unref(router.currentRoute).fullPath
-      router.push({
-        name: 'rclone-crypt-unlock',
-        query: {
-          spaceId: resource.storageId,
-          vaultRoot: resource.path,
-          redirectUrl: back
-        }
-      })
-    },
-    isVisible: ({ resources }: FileActionOptions) => {
-      const resource = resources?.[0]
-      if (!resource || !isVaultRoot(resource) || !resource.storageId) return false
-      return !vaultStore.isUnlocked(resource.storageId, resource.path)
-    },
-    class: 'oc-files-actions-unlock-vault'
-  }))
-}
-
-export function unlockVaultActionExtension(action: Ref<FileAction>): ActionExtension {
-  return {
-    id: 'app.rclone-crypt.unlock-vault',
-    type: 'action',
-    extensionPointIds: ['global.files.context-actions'],
-    get action() {
-      return unref(action)
-    }
-  } as ActionExtension
-}
diff --git a/packages/web-app-rclone-crypt/src/index.ts b/packages/web-app-rclone-crypt/src/index.ts
index 5eb4c59c9c0..60e6d337270 100644
--- a/packages/web-app-rclone-crypt/src/index.ts
+++ b/packages/web-app-rclone-crypt/src/index.ts
@@ -3,13 +3,6 @@ import { ref } from 'vue'
 import { ApplicationInformation, defineWebApplication, Extension } from '@opencloud-eu/web-pkg'
 import translations from '../l10n/translations.json'
 import { folderVaultExtension } from './extensions/folderVault'
-import { useResourceIndicatorExtension } from './extensions/resourceIndicator'
-import {
-  lockVaultActionExtension,
-  unlockVaultActionExtension,
-  useLockVaultAction,
-  useUnlockVaultAction
-} from './extensions/lockVault'
 import UnlockVault from './views/UnlockVault.vue'
 
 export default defineWebApplication({
@@ -40,14 +33,7 @@ export default defineWebApplication({
       ]
     }
 
-    const lockVaultAction = useLockVaultAction()
-    const unlockVaultAction = useUnlockVaultAction()
-    const extensions = ref<Extension[]>([
-      folderVaultExtension,
-      useResourceIndicatorExtension(),
-      lockVaultActionExtension(lockVaultAction),
-      unlockVaultActionExtension(unlockVaultAction)
-    ])
+    const extensions = ref<Extension[]>([folderVaultExtension])
 
     const routes = [
       {
@@ -57,7 +43,7 @@ export default defineWebApplication({
         path: '/unlock',
         component: UnlockVault,
         meta: {
-          // hybrid so the same route works inside public links — the runtime's
+          // hybrid so the same route works inside public links - the runtime's
           // public-link auth guard runs first and prompts for the link
           // password before we get to the vault passphrase.
           authContext: 'hybrid',
diff --git a/packages/web-app-rclone-crypt/src/resolveVault.ts b/packages/web-app-rclone-crypt/src/resolveVault.ts
index 7f6cf7da842..2b404eb3108 100644
--- a/packages/web-app-rclone-crypt/src/resolveVault.ts
+++ b/packages/web-app-rclone-crypt/src/resolveVault.ts
@@ -1,34 +1,25 @@
 import { FolderVaultClaim, FolderVaultEngine, useFolderVaultStore } from '@opencloud-eu/web-pkg'
-import {
-  isPersonalSpaceResource,
-  isProjectSpaceResource,
-  SpaceResource
-} from '@opencloud-eu/web-client'
-import { createEngine } from './crypto/engine'
-import { findVaultRoot } from './vaultPath'
-
-function isSupportedSpace(space: SpaceResource): boolean {
-  // PoC: only personal and project spaces. Public links, shares, trash etc.
-  // are out of scope for the first read iteration.
-  return isPersonalSpaceResource(space) || isProjectSpaceResource(space)
-}
+import { SpaceResource } from '@opencloud-eu/web-client'
+import { vaultRootForSpace } from './vaultPath'
 
 /**
  * Returns the vault root + the route the runtime should push to in order
  * to unlock this vault. Used by the UI to detect "locked vault, please
- * route the user to the plugin's unlock page" — even when `resolveVault`
- * itself returns null because no passphrase is in the store yet.
+ * route the user to the plugin's unlock page" - even when `resolveVault`
+ * itself returns null because no engine is in the store yet.
  */
 export function claimsVaultPath(space: SpaceResource, path: string): FolderVaultClaim | null {
-  if (!isSupportedSpace(space) || !path) {
+  if (!path) {
     return null
   }
-  const vaultRoot = findVaultRoot(path)
+  const vaultRoot = vaultRootForSpace(space, path)
   if (!vaultRoot) {
     return null
   }
   return {
     vaultRoot,
+    // rclone-crypt encrypts all path segment names (EME), not just content.
+    encryptsNames: true,
     unlockRoute: {
       name: 'rclone-crypt-unlock',
       query: {
@@ -40,23 +31,17 @@ export function claimsVaultPath(space: SpaceResource, path: string): FolderVault
 }
 
 /**
- * Build a usable engine for (space, path) — or return null if the vault is
- * not unlocked yet. The plugin's unlock page is responsible for writing the
- * passphrase into the folder-vault store; once that's there, this function
- * picks it up.
+ * Look up the unlocked engine for (space, path) - or return null when the
+ * vault isn't unlocked yet. The plugin's unlock page builds the engine and
+ * writes it into the folder-vault store; this function just reads it back.
  */
 export function resolveVault(space: SpaceResource, path: string): FolderVaultEngine | null {
-  if (!isSupportedSpace(space) || !path) {
+  if (!path) {
     return null
   }
-  const vaultRoot = findVaultRoot(path)
+  const vaultRoot = vaultRootForSpace(space, path)
   if (!vaultRoot) {
     return null
   }
-  const vaultStore = useFolderVaultStore()
-  const password = vaultStore.getSecret<string>(space.id, vaultRoot)
-  if (!password) {
-    return null
-  }
-  return createEngine(space.id, vaultRoot, password)
+  return useFolderVaultStore().getEngine(space.id, vaultRoot) ?? null
 }
diff --git a/packages/web-app-rclone-crypt/src/vaultPath.ts b/packages/web-app-rclone-crypt/src/vaultPath.ts
index 3d4ceb4ea83..9a7061dfd79 100644
--- a/packages/web-app-rclone-crypt/src/vaultPath.ts
+++ b/packages/web-app-rclone-crypt/src/vaultPath.ts
@@ -1,12 +1,39 @@
+import { SpaceResource, isShareSpaceResource } from '@opencloud-eu/web-client'
+
+// The single `.vault`-suffix heuristic both detection paths share, so they can't
+// drift. This is the known band-aid until a per-user vault registry replaces it.
+export function looksLikeVaultName(name: string | undefined): boolean {
+  return !!name && name.endsWith('.vault')
+}
+
 // Identify the vault root from a clear-text path: the first segment ending
 // in `.vault` marks the root. Anything outside such a segment is not a
 // vault from this plugin's point of view.
 export function findVaultRoot(path: string | undefined): string | null {
   if (!path) return null
   const segments = path.split('/').filter(Boolean)
-  const idx = segments.findIndex((s) => s.endsWith('.vault'))
+  const idx = segments.findIndex((s) => looksLikeVaultName(s))
   if (idx === -1) {
     return null
   }
   return '/' + segments.slice(0, idx + 1).join('/')
 }
+
+// Resolve the vault root for a (space, path), considering the space - not just
+// the path. Two cases:
+//   1. The `.vault` segment is in the path (the owner browsing their vault, or a
+//      vault nested under a shared normal folder): `findVaultRoot` wins.
+//   2. The whole SPACE is the vault: a directly-shared vault, where the share
+//      root *is* the `.vault` folder. The receiver's paths are rebased to the
+//      share root, so the `.vault` marker only survives in `space.name` /
+//      driveAlias, never in the path. Then the vault root is the space root `/`.
+export function vaultRootForSpace(space: SpaceResource, path: string | undefined): string | null {
+  const inPath = findVaultRoot(path)
+  if (inPath) {
+    return inPath
+  }
+  if (space && isShareSpaceResource(space) && looksLikeVaultName(space.name)) {
+    return '/'
+  }
+  return null
+}
diff --git a/packages/web-app-rclone-crypt/src/views/UnlockVault.vue b/packages/web-app-rclone-crypt/src/views/UnlockVault.vue
index 61dc0cdd34a..0a755a5e432 100644
--- a/packages/web-app-rclone-crypt/src/views/UnlockVault.vue
+++ b/packages/web-app-rclone-crypt/src/views/UnlockVault.vue
@@ -21,12 +21,13 @@
         data-testid="empty-vault-hint"
         v-text="
           $gettext(
-            'This vault is still empty, so there is no right or wrong passphrase yet. The passphrase you enter here will be locked in when the first file gets uploaded.'
+            'This vault is still empty, so there is no right or wrong passphrase yet. The passphrase you enter here will be locked in when the first file gets uploaded and cannot be changed from within OpenCloud afterwards.'
           )
         "
       />
       <form @submit.prevent="onSubmit">
         <oc-text-input
+          id="vault-passphrase"
           ref="passwordInput"
           v-model="password"
           :error-message="errorMessage"
@@ -35,6 +36,16 @@
           autocomplete="off"
           class="mb-3 [&_.oc-text-input-message]:justify-center"
         />
+        <oc-text-input
+          v-if="isEmpty === true"
+          id="vault-passphrase-confirm"
+          v-model="confirmPassword"
+          :error-message="confirmErrorMessage"
+          :label="$gettext('Repeat passphrase')"
+          type="password"
+          autocomplete="off"
+          class="mb-3 [&_.oc-text-input-message]:justify-center"
+        />
         <div class="flex justify-center gap-2">
           <oc-button id="vault-unlock-cancel" appearance="outline" type="button" @click="onCancel">
             <span v-text="$gettext('Cancel')" />
@@ -43,7 +54,7 @@
             id="vault-unlock-submit"
             appearance="filled"
             submit="submit"
-            :disabled="!password || verifying"
+            :disabled="submitDisabled"
           >
             <oc-spinner v-if="verifying" :aria-hidden="true" size="small" />
             <span v-else v-text="submitLabel" />
@@ -76,6 +87,10 @@ const vaultStore = useFolderVaultStore()
 
 const passwordInput = useTemplateRef<HTMLInputElement>('passwordInput')
 const password = ref('')
+// Only used while setting up a still-empty vault: the passphrase is committed by
+// the first upload and can't be changed from within OpenCloud, so we make the
+// user type it twice to catch typos before it's locked in for good.
+const confirmPassword = ref('')
 const verifying = ref(false)
 const errorMessage = ref<string | null>(null)
 // `null` = we haven't probed the server yet, `true` = the vault has no
@@ -91,8 +106,9 @@ const redirectUrl = computed(() => queryItemAsString(unref(route).query.redirect
 const vaultName = computed(() => {
   const root = unref(vaultRoot) || ''
   // Strip the leading path so only the cleartext folder name (e.g.
-  // "myvault.vault") shows up — that's what users recognise.
-  return root.split('/').filter(Boolean).pop() || root
+  // "myvault.vault") shows up - that's what users recognise. For a root vault
+  // "/" (a directly-shared vault) the name lives on the share space instead.
+  return root.split('/').filter(Boolean).pop() || unref(space)?.name || root
 })
 
 const vaultDescription = computed(() =>
@@ -113,14 +129,35 @@ const submitLabel = computed(() =>
   unref(isEmpty) === true ? $gettext('Set passphrase') : $gettext('Unlock')
 )
 
+// Surface the mismatch only once the user has started typing the confirmation,
+// so the field doesn't show an error before they've had a chance to fill it.
+const confirmErrorMessage = computed(() =>
+  unref(isEmpty) === true && unref(confirmPassword) && unref(password) !== unref(confirmPassword)
+    ? $gettext('Passphrases do not match.')
+    : null
+)
+
+const submitDisabled = computed(() => {
+  if (!unref(password) || unref(verifying)) {
+    return true
+  }
+  // Setting up a vault requires both fields to match before we lock it in.
+  return unref(isEmpty) === true && unref(password) !== unref(confirmPassword)
+})
+
 const space = computed(() => spacesStore.spaces.find((s) => s.id === unref(spaceId)))
 
 const onSubmit = async () => {
   errorMessage.value = null
+  // Guard against a programmatic submit slipping past the disabled button.
+  if (unref(isEmpty) === true && unref(password) !== unref(confirmPassword)) {
+    errorMessage.value = $gettext('Passphrases do not match.')
+    return
+  }
   verifying.value = true
   try {
     // 1. Fetch the vault root listing to grab a sample encrypted name we can
-    //    verify the key against. Doesn't decrypt anything — names stay raw.
+    //    verify the key against. Doesn't decrypt anything - names stay raw.
     //    rclone-crypt's filename encryption is deterministic; one valid
     //    decrypt is a strong signal that the key fits.
     if (!unref(space)) {
@@ -132,17 +169,18 @@ const onSubmit = async () => {
     })
     const sample = (children ?? []).find((c) => c?.name)?.name
 
-    // Build a probe engine with the supplied passphrase and ask it to
-    // decrypt our sample. Empty vault → trust the passphrase (nothing to
-    // disagree with). Otherwise success here means "this is the right key".
-    const probeEngine = createEngine(unref(spaceId), unref(vaultRoot), unref(password))
-    const keyOk = sample ? await probeEngine.verifyKey(sample) : true
+    // Build the engine with the supplied passphrase and ask it to decrypt our
+    // sample. Empty vault → trust the passphrase (nothing to disagree with).
+    // Otherwise success here means "this is the right key". The very same engine
+    // is what we stash, so it doubles as the session's unlocked engine.
+    const engine = createEngine(unref(vaultRoot), unref(password))
+    const keyOk = sample ? await engine.verifyKey(sample) : true
     if (!keyOk) {
       errorMessage.value = $gettext('Incorrect passphrase.')
       return
     }
 
-    vaultStore.setSecret(unref(spaceId), unref(vaultRoot), unref(password))
+    vaultStore.setEngine(unref(spaceId), unref(vaultRoot), engine)
 
     const target = unref(redirectUrl)
     // router.push accepts a full URL string and parses path + query for us.
@@ -159,7 +197,7 @@ onMounted(async () => {
   unref(passwordInput)?.focus?.()
   // Probe the vault root listing once to decide if we should switch to
   // "empty vault, any passphrase wins" wording. We don't gate the submit
-  // button on this — onSubmit re-checks against the live listing.
+  // button on this - onSubmit re-checks against the live listing.
   try {
     const targetSpace = unref(space)
     const root = unref(vaultRoot)
@@ -177,7 +215,7 @@ onMounted(async () => {
 
 const onCancel = async () => {
   // Walk one level above the vault root so the user lands back in the folder
-  // they came from instead of inside the locked vault — clicking the vault
+  // they came from instead of inside the locked vault - clicking the vault
   // would otherwise just kick them back to this unlock page.
   const root = unref(vaultRoot) || '/'
   const parent = root.replace(/\/[^/]+$/, '') || '/'
diff --git a/packages/web-app-rclone-crypt/tests/unit/crypto/engine.spec.ts b/packages/web-app-rclone-crypt/tests/unit/crypto/engine.spec.ts
new file mode 100644
index 00000000000..a955352afa6
--- /dev/null
+++ b/packages/web-app-rclone-crypt/tests/unit/crypto/engine.spec.ts
@@ -0,0 +1,109 @@
+import { encryptVaultPath } from '@opencloud-eu/web-pkg'
+import { createEngine } from '../../../src/crypto/engine'
+
+async function collect(stream: ReadableStream<Uint8Array>): Promise<Uint8Array> {
+  const reader = stream.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    chunks.push(value)
+    total += value.byteLength
+  }
+  const out = new Uint8Array(total)
+  let offset = 0
+  for (const c of chunks) {
+    out.set(c, offset)
+    offset += c.byteLength
+  }
+  return out
+}
+
+function streamOf(...chunks: Uint8Array[]): ReadableStream<Uint8Array> {
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      chunks.forEach((c) => controller.enqueue(c))
+      controller.close()
+    }
+  })
+}
+
+describe('rclone-crypt engine', () => {
+  // Password "foobar" with rclone's default salt (no password2). The expected
+  // ciphertexts below are the exact deterministic EME output rclone itself
+  // produces, so these assertions also cross-check our engine against the real
+  // `rclone` CLI that builds the e2e fixtures.
+  // vaultRoot is identity only; the engine encrypts paths RELATIVE to it. The
+  // vault-root <-> full-path conversion is the generic encryptVaultPath helper.
+  const engine = createEngine('/my.vault', 'foobar')
+
+  it('encrypts a vault-relative path to the exact rclone ciphertext and round-trips it', async () => {
+    const relative = 'sub folder/hello world.txt'
+    const encrypted = await engine.encryptPath(relative)
+
+    expect(encrypted).toBe('4f01ckg2opc25l0dphfcs9n77k/rpds02g0ofv53k48ai1jcthsks')
+    expect(await engine.decryptPath(encrypted)).toBe(relative)
+  })
+
+  it('encrypts a bare name (a one-segment path) to the exact rclone ciphertext and round-trips it', async () => {
+    const encrypted = await engine.encryptPath('report.txt')
+
+    expect(encrypted).toBe('unq54c7b9fj4lam8t82q1hofdo')
+    expect(await engine.decryptPath(encrypted)).toBe('report.txt')
+  })
+
+  it('composes with encryptVaultPath on a full path (ties the whole stack to the rclone CLI vector)', async () => {
+    expect(await encryptVaultPath(engine, '/my.vault/sub folder/hello world.txt')).toBe(
+      '/my.vault/4f01ckg2opc25l0dphfcs9n77k/rpds02g0ofv53k48ai1jcthsks'
+    )
+  })
+
+  describe('content encryption', () => {
+    it('round-trips file content through encrypt then decrypt', async () => {
+      const plain = new TextEncoder().encode('hello vault world')
+      const ciphertext = await collect(engine.encryptContent(streamOf(plain)))
+
+      // the stored bytes must differ from the plaintext and carry the header
+      expect(ciphertext.byteLength).toBeGreaterThan(plain.byteLength)
+      expect(Array.from(ciphertext)).not.toEqual(Array.from(plain))
+
+      const back = await collect(engine.decryptContent(streamOf(ciphertext)))
+      expect(new TextDecoder().decode(back)).toBe('hello vault world')
+    })
+
+    it('turns empty content into a valid header blob that decrypts back to empty', async () => {
+      // The decorator relies on this: an empty PUT still has to become a real
+      // rclone-crypt blob (header bytes), or it cannot be decrypted later.
+      const ciphertext = await collect(engine.encryptContent(streamOf(new Uint8Array(0))))
+      expect(ciphertext.byteLength).toBeGreaterThan(0)
+
+      const back = await collect(engine.decryptContent(streamOf(ciphertext)))
+      expect(back.byteLength).toBe(0)
+    })
+
+    it('reassembles content delivered as multiple input chunks', async () => {
+      const a = new TextEncoder().encode('chunk-one-')
+      const b = new TextEncoder().encode('chunk-two')
+      const ciphertext = await collect(engine.encryptContent(streamOf(a, b)))
+
+      const back = await collect(engine.decryptContent(streamOf(ciphertext)))
+      expect(new TextDecoder().decode(back)).toBe('chunk-one-chunk-two')
+    })
+  })
+
+  describe('verifyKey', () => {
+    it('accepts a sample segment that decrypts under the engine key', async () => {
+      expect(await engine.verifyKey('unq54c7b9fj4lam8t82q1hofdo')).toBe(true)
+    })
+
+    it('rejects a sample segment that belongs to a different password', async () => {
+      const wrong = createEngine('/my.vault', 'not-the-passphrase')
+      expect(await wrong.verifyKey('unq54c7b9fj4lam8t82q1hofdo')).toBe(false)
+    })
+
+    it('rejects a segment that is not valid ciphertext at all', async () => {
+      expect(await engine.verifyKey('!!! not base32 !!!')).toBe(false)
+    })
+  })
+})
diff --git a/packages/web-app-rclone-crypt/tests/unit/resolveVault.spec.ts b/packages/web-app-rclone-crypt/tests/unit/resolveVault.spec.ts
new file mode 100644
index 00000000000..d1c778f063e
--- /dev/null
+++ b/packages/web-app-rclone-crypt/tests/unit/resolveVault.spec.ts
@@ -0,0 +1,54 @@
+import { SpaceResource } from '@opencloud-eu/web-client'
+import { claimsVaultPath, resolveVault } from '../../src/resolveVault'
+
+const getEngine = vi.fn()
+vi.mock('@opencloud-eu/web-pkg', () => ({
+  useFolderVaultStore: () => ({ getEngine })
+}))
+
+const shareSpace = (name: string) =>
+  ({ id: 's1', driveType: 'share', name }) as unknown as SpaceResource
+const personalSpace = { id: 'p1', driveType: 'personal', name: 'Admin' } as unknown as SpaceResource
+
+beforeEach(() => vi.clearAllMocks())
+
+describe('claimsVaultPath', () => {
+  it('claims a directly-shared vault (share space whose name ends in .vault) rooted at "/"', () => {
+    const claim = claimsVaultPath(shareSpace('myvault.vault'), '/')
+
+    expect(claim).toMatchObject({ vaultRoot: '/', encryptsNames: true })
+    expect(claim?.unlockRoute).toMatchObject({
+      name: 'rclone-crypt-unlock',
+      query: { spaceId: 's1', vaultRoot: '/' }
+    })
+  })
+
+  it('does not claim a normal share whose name does not end in .vault', () => {
+    expect(claimsVaultPath(shareSpace('documents'), '/')).toBeNull()
+  })
+
+  it('does not claim a non-share space at its root', () => {
+    expect(claimsVaultPath(personalSpace, '/')).toBeNull()
+  })
+
+  it('path-based detection still wins for a nested vault, regardless of space', () => {
+    // owner / vault-nested-under-shared-folder: the `.vault` segment is in the path
+    const claim = claimsVaultPath(personalSpace, '/myvault.vault/sub')
+    expect(claim?.vaultRoot).toBe('/myvault.vault')
+  })
+})
+
+describe('resolveVault', () => {
+  it('reads the engine stored under (shareSpaceId, "/") for a directly-shared vault', () => {
+    const engine = { vaultRoot: '/' } as any
+    getEngine.mockReturnValue(engine)
+
+    expect(resolveVault(shareSpace('myvault.vault'), '/')).toBe(engine)
+    expect(getEngine).toHaveBeenCalledWith('s1', '/')
+  })
+
+  it('returns null (and never hits the store) when no vault is detected', () => {
+    expect(resolveVault(shareSpace('documents'), '/')).toBeNull()
+    expect(getEngine).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/web-pkg/src/components/AppTemplates/AppWrapper.vue b/packages/web-pkg/src/components/AppTemplates/AppWrapper.vue
index 3270201139f..89277248f07 100644
--- a/packages/web-pkg/src/components/AppTemplates/AppWrapper.vue
+++ b/packages/web-pkg/src/components/AppTemplates/AppWrapper.vue
@@ -57,7 +57,6 @@ import {
   useConfigStore,
   useResourcesStore,
   FileContentOptions,
-  FileContext,
   useFileActionsDownloadFile,
   FileActionOptions,
   FileAction,
@@ -90,15 +89,7 @@ import { HttpError } from '@opencloud-eu/web-client'
 import { dirname } from 'path'
 import { useFileActionsOpenWithApp } from '../../composables'
 import { UnsavedChangesModal } from '../Modals'
-import {
-  decryptResourceInPlace,
-  formatFileSize,
-  getSharedDriveItem,
-  markVaultStatus,
-  resolveFolderVault,
-  streamToArrayBuffer,
-  streamToBlob
-} from '../../helpers'
+import { formatFileSize, getSharedDriveItem } from '../../helpers'
 import toNumber from 'lodash-es/toNumber'
 import { useIsMobile } from '@opencloud-eu/design-system/composables'
 import { storeToRefs } from 'pinia'
@@ -304,18 +295,6 @@ const loadResourceTask = useTask(function* (signal) {
     }
     space.value = unref(unref(currentFileContext).space)
     const fileInfo = yield getFileInfo(unref(currentFileContext), { signal })
-    // Decrypt name/path/extension when the resource lives inside a vault, so
-    // every consumer of `resource.value` (top bar, side bar, document title,
-    // resource list…) sees cleartext.
-    const vaultEngine = resolveFolderVault(
-      extensionRegistry,
-      unref(space),
-      unref(unref(currentFileContext).item)
-    )
-    if (vaultEngine) {
-      yield* call(decryptResourceInPlace(vaultEngine, fileInfo))
-    }
-    markVaultStatus(extensionRegistry, unref(space), [fileInfo])
     resource.value = fileInfo
 
     if (isShareSpaceResource(unref(space))) {
@@ -386,93 +365,18 @@ const loadFileTask = useTask(function* (signal) {
     )
 
     if (unref(hasProp('currentContent'))) {
-      // Vault-aware content handling. We do all of this above the webdav
-      // client: ask the server for the raw ciphertext blob using its real
-      // (encrypted) path, run it through the engine's decrypt stream, and
-      // hand the embedded app whatever response type it expected. The webdav
-      // primitives stay completely unaware of vaults.
-      const vaultEngine = resolveFolderVault(extensionRegistry, unref(space), unref(resource)?.path)
-      const originalResponseType = fileContentOptions?.responseType
-      const fetchOptions = vaultEngine
-        ? { ...fileContentOptions, responseType: 'arraybuffer' as const }
-        : fileContentOptions
-
-      // The webdav call needs the encrypted server-side path. resource.path is
-      // already cleartext at this point (we decrypted it in loadResourceTask),
-      // so we re-encrypt for this single request and leave the context the
-      // rest of the UI sees untouched.
-      const baseCtx = unref(currentFileContext)
-      const fetchCtx = vaultEngine
-        ? { ...baseCtx, item: yield* call(vaultEngine.encryptPath(unref(baseCtx.item))) }
-        : baseCtx
-
       const fileContentsResponse = yield* call(
-        getFileContents(fetchCtx, { ...fetchOptions, signal })
+        getFileContents(unref(currentFileContext), { ...fileContentOptions, signal })
       )
-      let body = fileContentsResponse.body
-
-      if (vaultEngine) {
-        // FIXME(poc-vault): engine API is streaming, but both ends still hold
-        // bytes in memory — getFileContents resolves to a full ArrayBuffer,
-        // and editors want string/Blob/ArrayBuffer. End-to-end streaming
-        // hinges on exposing the fetch response.body upstream; landing that
-        // later won't require changes here.
-        const plaintextStream = vaultEngine.decryptContent(new Blob([body as ArrayBuffer]).stream())
-        const plaintextBuffer: ArrayBuffer = yield* call(streamToArrayBuffer(plaintextStream))
-        const plaintext = new Uint8Array(plaintextBuffer)
-
-        if (!originalResponseType || originalResponseType === 'text') {
-          body = new TextDecoder().decode(plaintext)
-        } else if (originalResponseType === 'blob') {
-          body = new Blob([plaintext as BlobPart])
-        } else {
-          body = plaintext.buffer
-        }
-      }
-
-      serverContent.value = currentContent.value = body
+      serverContent.value = currentContent.value = fileContentsResponse.body
       currentETag.value = fileContentsResponse.headers['OC-ETag']
     }
 
     if (unref(hasProp('url'))) {
-      // Vault-aware preview/download URL: getUrlForResource would otherwise
-      // hand the app a URL that downloads the *encrypted* blob from the
-      // server — broken for preview, mediaviewer, pdf-viewer etc. For vault
-      // resources we fetch ciphertext ourselves, run it through the engine
-      // and expose the cleartext as an in-memory blob URL.
-      const urlVaultEngine = resolveFolderVault(
-        extensionRegistry,
-        unref(space),
-        unref(resource)?.path
-      )
-      if (urlVaultEngine) {
-        const baseCtx = unref(currentFileContext)
-        const fetchCtx = {
-          ...baseCtx,
-          item: yield* call(urlVaultEngine.encryptPath(unref(baseCtx.item)))
-        }
-        const cipherResponse = yield* call(
-          getFileContents(fetchCtx, {
-            ...fileContentOptions,
-            responseType: 'arraybuffer',
-            signal
-          })
-        )
-        // Collect the engine output straight into the Blob we hand to
-        // URL.createObjectURL — no intermediate Uint8Array in this path.
-        const blob: Blob = yield* call(
-          streamToBlob(
-            urlVaultEngine.decryptContent(new Blob([cipherResponse.body as ArrayBuffer]).stream()),
-            unref(resource)?.mimeType || 'application/octet-stream'
-          )
-        )
-        url.value = URL.createObjectURL(blob)
-      } else {
-        url.value = yield getUrlForResource(unref(space), unref(resource), {
-          ...urlForResourceOptions,
-          signal
-        })
-      }
+      url.value = yield getUrlForResource(unref(space), unref(resource), {
+        ...urlForResourceOptions,
+        signal
+      })
     }
   } catch (e) {
     console.error(e)
@@ -534,34 +438,10 @@ const autosavePopup = () => {
 const saveFileTask = useTask(function* () {
   const newContent = unref(currentContent)
   try {
-    // Vault-aware save: when the resource is inside a vault, the cleartext
-    // we have in memory has to be encrypted, the put has to target the
-    // encrypted server path, and the response describing the freshly stored
-    // blob has to be decrypted back to cleartext before it enters the store.
-    const vaultEngine = resolveFolderVault(extensionRegistry, unref(space), unref(resource)?.path)
-
-    let putCtx: FileContext | typeof currentFileContext = currentFileContext
-    let putContent: string | ArrayBuffer = newContent as string
-
-    if (vaultEngine) {
-      const baseCtx = unref(currentFileContext)
-      // Blob is the easiest "give me a stream over these bytes" primitive
-      // regardless of whether the editor handed us a string, ArrayBuffer or
-      // Uint8Array. The engine output goes back through Response#arrayBuffer
-      // to land in the shape webdav.putFileContents wants.
-      const plainBlob = newContent instanceof Blob ? newContent : new Blob([newContent as BlobPart])
-      putContent = yield* call(streamToArrayBuffer(vaultEngine.encryptContent(plainBlob.stream())))
-      putCtx = { ...baseCtx, item: yield* call(vaultEngine.encryptPath(unref(baseCtx.item))) }
-    }
-
-    const putFileContentsResponse = yield putFileContents(putCtx, {
-      content: putContent,
+    const putFileContentsResponse = yield putFileContents(currentFileContext, {
+      content: newContent as string | ArrayBuffer,
       previousEntityTag: unref(currentETag)
     })
-    if (vaultEngine) {
-      yield* call(decryptResourceInPlace(vaultEngine, putFileContentsResponse))
-    }
-    markVaultStatus(extensionRegistry, unref(space), [putFileContentsResponse])
     serverContent.value = newContent
     currentETag.value = putFileContentsResponse.etag
     resourcesStore.upsertResource(putFileContentsResponse)
diff --git a/packages/web-pkg/src/components/SearchBarFilter.vue b/packages/web-pkg/src/components/SearchBarFilter.vue
index 343010ade69..7096cbc3ef3 100644
--- a/packages/web-pkg/src/components/SearchBarFilter.vue
+++ b/packages/web-pkg/src/components/SearchBarFilter.vue
@@ -63,7 +63,7 @@ export default defineComponent({
     },
     // Search inside a vault is currently not supported on the server side
     // (it'd search ciphertext blobs), so the "Current folder" option makes
-    // no sense when the user is sitting inside a vault — force-route to
+    // no sense when the user is sitting inside a vault - force-route to
     // "All files" and disable the toggle.
     currentFolderIsInVault: {
       type: Boolean,
@@ -102,7 +102,7 @@ export default defineComponent({
           const useScope = unref(useScopeQueryValue).toString() === 'true'
           // The scope query may force "Current folder" via deeplink even
           // when `currentFolderAvailable` is false (existing behavior).
-          // The only override is being inside a vault — searching ciphertext
+          // The only override is being inside a vault - searching ciphertext
           // makes no sense.
           if (useScope && !props.currentFolderIsInVault) {
             currentSelection.value = unref(locationOptions).find(
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActions.ts b/packages/web-pkg/src/composables/actions/files/useFileActions.ts
index 07eec0ecbe9..d598f31b058 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActions.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActions.ts
@@ -125,8 +125,8 @@ export const useFileActions = () => {
               return false
             }
 
-            // External editor apps (Collabora, OnlyOffice, …) load the
-            // file server-side via the WOPI bridge — they'd see the
+            // External editor apps (Collabora, …) load the
+            // file server-side via the WOPI bridge - they'd see the
             // encrypted blob, not the cleartext the user expects.
             // Restrict vault resources to in-browser editors only.
             if (resources[0].isInVault && fileExtension.app?.startsWith('external-')) {
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsRestore.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsRestore.ts
index 9ab86c6590f..74e64904b5d 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActionsRestore.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsRestore.ts
@@ -20,8 +20,18 @@ import { useRouter } from '../../router'
 import { computed, unref } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import type { FileAction, FileActionOptions } from '../types'
-import { useMessages, useSpacesStore, useUserStore, useResourcesStore } from '../../piniaStores'
+import {
+  useMessages,
+  useSpacesStore,
+  useUserStore,
+  useResourcesStore,
+  useExtensionRegistry
+} from '../../piniaStores'
 import { useRestoreWorker } from '../../webWorkers/restoreWorker'
+import {
+  encryptFolderPathsForServer,
+  encryptResourcePathsForServer
+} from '../../../helpers/folderVault'
 
 export const useFileActionsRestore = ({
   showSuccessMessage = true,
@@ -37,6 +47,7 @@ export const useFileActionsRestore = ({
   const clientService = useClientService()
   const spacesStore = useSpacesStore()
   const resourcesStore = useResourcesStore()
+  const extensionRegistry = useExtensionRegistry()
   const { startWorker } = useRestoreWorker()
 
   // FIXME: use ConflictDialog class for this
@@ -212,7 +223,23 @@ export const useFileActionsRestore = ({
       resolvedResources.push(resource)
     }
 
-    return restoreResources(space, resolvedResources, missingFolderPaths)
+    // The restore worker runs a vanilla webdav client, so for an unlocked vault
+    // the decrypted (cleartext) paths above would restore the blob under a
+    // cleartext name and break the vault. Translate paths back to their on-server
+    // encrypted form before handing them off (no-op outside vaults / for locked
+    // vaults, where the path is already ciphertext).
+    const resourcesForServer = await encryptResourcePathsForServer(
+      extensionRegistry,
+      space,
+      resolvedResources
+    )
+    const foldersForServer = await encryptFolderPathsForServer(
+      extensionRegistry,
+      space,
+      missingFolderPaths
+    )
+
+    return restoreResources(space, resourcesForServer, foldersForServer)
   }
 
   const actions = computed((): FileAction[] => [
diff --git a/packages/web-pkg/src/composables/actions/files/useFileActionsUndoDelete.ts b/packages/web-pkg/src/composables/actions/files/useFileActionsUndoDelete.ts
index a711c16eb9a..80fe8bfd93b 100644
--- a/packages/web-pkg/src/composables/actions/files/useFileActionsUndoDelete.ts
+++ b/packages/web-pkg/src/composables/actions/files/useFileActionsUndoDelete.ts
@@ -1,18 +1,12 @@
 import { computed, unref } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import type { Action, FileActionOptions } from '../types'
-import { useExtensionRegistry, useMessages, useResourcesStore } from '../../piniaStores'
+import { useMessages, useResourcesStore } from '../../piniaStores'
 import { useFileActionsRestore } from './useFileActionsRestore'
 import { storeToRefs } from 'pinia'
 import { useCapabilityStore, useClientService } from '../../'
 import { isPersonalSpaceResource, isProjectSpaceResource } from '@opencloud-eu/web-client'
-import {
-  decryptResourceInPlace,
-  isItemInCurrentFolder,
-  isMacOs,
-  markVaultStatus,
-  resolveFolderVault
-} from '../../../helpers'
+import { isItemInCurrentFolder, isMacOs } from '../../../helpers'
 import { isLocationCommonActive } from '../../../router'
 import { useRouter } from 'vue-router'
 
@@ -25,7 +19,6 @@ export const useFileActionsUndoDelete = () => {
   const capabilityStore = useCapabilityStore()
   const resourcesStore = useResourcesStore()
   const { currentFolder } = storeToRefs(resourcesStore)
-  const extensionRegistry = useExtensionRegistry()
   const router = useRouter()
 
   const { actions: restoreActions } = useFileActionsRestore({
@@ -45,22 +38,11 @@ export const useFileActionsUndoDelete = () => {
       }
 
       if (isItemInCurrentFolder({ resourcesStore, parentFolderId: resources[0].parentFolderId })) {
-        // update local folder — vault-aware: when the current folder lives
-        // in a vault, the post-restore listing comes back with encrypted
-        // names and has to be decrypted before it can match the restored
-        // resource ids and enter the store.
-        const clearPath = unref(currentFolder).path
-        const vaultEngine = resolveFolderVault(extensionRegistry, space, clearPath)
-        const listPath = vaultEngine ? await vaultEngine.encryptPath(clearPath) : clearPath
-        const { children } = await webdav.listFiles(space, { path: listPath })
-        if (vaultEngine) {
-          await Promise.all(children.map((c) => decryptResourceInPlace(vaultEngine, c)))
-        }
-        const restored = children.filter(({ id }) =>
-          resources.some((s) => s.id === transformToTrashId(id))
+        // update local folder
+        const { children } = await webdav.listFiles(space, { path: unref(currentFolder).path })
+        resourcesStore.upsertResources(
+          children.filter(({ id }) => resources.some((s) => s.id === transformToTrashId(id)))
         )
-        markVaultStatus(extensionRegistry, space, restored)
-        resourcesStore.upsertResources(restored)
       }
     }
   })
diff --git a/packages/web-pkg/src/composables/actions/helpers/useFileActionsDeleteResources.ts b/packages/web-pkg/src/composables/actions/helpers/useFileActionsDeleteResources.ts
index a3aee854cd1..9b1baf3a41a 100644
--- a/packages/web-pkg/src/composables/actions/helpers/useFileActionsDeleteResources.ts
+++ b/packages/web-pkg/src/composables/actions/helpers/useFileActionsDeleteResources.ts
@@ -18,9 +18,10 @@ import {
   useSpacesStore,
   useConfigStore,
   useExtensionRegistry,
+  useFolderVaultStore,
   useResourcesStore
 } from '../../piniaStores'
-import { resolveFolderVault } from '../../../helpers/folderVault'
+import { encryptResourcePathsForServer } from '../../../helpers/folderVault'
 import { storeToRefs } from 'pinia'
 import { useDeleteWorker } from '../../webWorkers'
 import { useEventBus } from '../../eventBus'
@@ -48,26 +49,7 @@ export const useFileActionsDeleteResources = () => {
   const resourcesStore = useResourcesStore()
   const { currentFolder } = storeToRefs(resourcesStore)
   const extensionRegistry = useExtensionRegistry()
-
-  // Resources surface in the UI with their cleartext paths after vault-aware
-  // decryption, but the delete worker is a vanilla webdav client that knows
-  // nothing about vaults. Translate any path that sits inside a vault back
-  // to its encrypted form before handing the resource off — the original
-  // (cleartext) instance stays in the store untouched for UI state.
-  const translatePathsForDelete = async (
-    space: SpaceResource,
-    resources: Resource[]
-  ): Promise<Resource[]> => {
-    return Promise.all(
-      resources.map(async (r) => {
-        const engine = resolveFolderVault(extensionRegistry, space, r.path)
-        if (!engine) return r
-        const encryptedPath = await engine.encryptPath(r.path)
-        if (encryptedPath === r.path) return r
-        return { ...r, path: encryptedPath } as Resource
-      })
-    )
-  }
+  const folderVaultStore = useFolderVaultStore()
 
   const resourcesToDelete = ref<Resource[]>([])
 
@@ -252,7 +234,14 @@ export const useFileActionsDeleteResources = () => {
       spaceForDeletion: SpaceResource,
       resourcesForDeletion: Resource[]
     ) => {
-      const workerResources = await translatePathsForDelete(spaceForDeletion, resourcesForDeletion)
+      // The delete worker is a vanilla webdav client; translate any vault path
+      // back to its encrypted server form before handing the resources off
+      // (the cleartext originals stay in the store for UI state).
+      const workerResources = await encryptResourcePathsForServer(
+        extensionRegistry,
+        spaceForDeletion,
+        resourcesForDeletion
+      )
       startWorker(
         { topic: 'fileListDelete', space: spaceForDeletion, resources: workerResources },
         async ({ successful, failed }) => {
@@ -263,6 +252,17 @@ export const useFileActionsDeleteResources = () => {
               deletedFiles: successful
             })
             eventBus.publish('runtime.resource.deleted', successful)
+
+            // A deleted (sub)tree may be, or contain, a vault root whose
+            // passphrase is now cached for a path that no longer exists.
+            // Evict it so a different vault re-created at the same path later
+            // isn't silently auto-unlocked with the old key. successful holds
+            // the encrypted worker clones, so match back to the cleartext
+            // source resources by id - the store is keyed by cleartext path.
+            const deletedIds = new Set(successful.map(({ id }) => id))
+            resourcesForDeletion
+              .filter((r) => deletedIds.has(r.id))
+              .forEach((r) => folderVaultStore.clearEnginesUnder(spaceForDeletion.id, r.path))
           }
 
           resourcesStore.removeResourcesFromDeleteQueue(failed.map(({ resource }) => resource.id))
diff --git a/packages/web-pkg/src/composables/appDefaults/useAppFileHandling.ts b/packages/web-pkg/src/composables/appDefaults/useAppFileHandling.ts
index 2b2a9aa9303..1bab07361d8 100644
--- a/packages/web-pkg/src/composables/appDefaults/useAppFileHandling.ts
+++ b/packages/web-pkg/src/composables/appDefaults/useAppFileHandling.ts
@@ -8,9 +8,7 @@ import { FileResource, SpaceResource } from '@opencloud-eu/web-client'
 import { useClientService } from '../clientService'
 import { ListFilesOptions } from '@opencloud-eu/web-client/webdav'
 import { WebDAV } from '@opencloud-eu/web-client/webdav'
-import { useExtensionRegistry, useUserStore } from '../piniaStores'
-import { resolveFolderVault } from '../../helpers/folderVault'
-import { streamToBlob } from '../../helpers/streams'
+import { useUserStore } from '../piniaStores'
 
 interface AppFileHandlingOptions {
   clientService: ClientService
@@ -42,32 +40,25 @@ export function useAppFileHandling({
 }: AppFileHandlingOptions): AppFileHandlingResult {
   clientService = clientService || useClientService()
   const userStore = useUserStore()
-  const extensionRegistry = useExtensionRegistry()
 
   const getUrlForResource = async (
     space: SpaceResource,
     resource: Resource,
     options?: UrlForResourceOptions
   ): Promise<string> => {
-    // For vault resources, the server-side blob is ciphertext — neither a
-    // direct download URL nor a thumbnail can render the actual image. Fetch
-    // the encrypted blob, run it through the engine, and expose the cleartext
-    // bytes as an in-memory blob URL the embedded app can consume directly.
-    const vaultEngine = resolveFolderVault(extensionRegistry, space, resource?.path)
-    if (vaultEngine) {
-      const encryptedPath = await vaultEngine.encryptPath(resource.path)
+    // A vault resource's server blob is ciphertext, so a plain download URL (or
+    // thumbnail) would render garbage. Fetch the bytes through the vault-aware
+    // webdav client (which decrypts them) and expose the cleartext as an
+    // in-memory blob URL the embedded app can consume directly.
+    if (resource.isInVault) {
       const response = await clientService.webdav.getFileContents(
         space,
-        { path: encryptedPath },
+        { path: resource.path },
         { responseType: 'arraybuffer', signal: options?.signal }
       )
-      // Run the ciphertext through the engine as a real stream (Blob.stream)
-      // and collect the plaintext stream directly into the Blob the URL
-      // points at — no intermediate buffer.
-      const blob = await streamToBlob(
-        vaultEngine.decryptContent(new Blob([response.body as ArrayBuffer]).stream()),
-        resource.mimeType || 'application/octet-stream'
-      )
+      const blob = new Blob([response.body as ArrayBuffer], {
+        type: resource.mimeType || 'application/octet-stream'
+      })
       return URL.createObjectURL(blob)
     }
     return clientService.webdav.getFileUrl(space, resource, {
diff --git a/packages/web-pkg/src/composables/appDefaults/useAppFolderHandling.ts b/packages/web-pkg/src/composables/appDefaults/useAppFolderHandling.ts
index 296a6501ede..2a2bfd0a884 100644
--- a/packages/web-pkg/src/composables/appDefaults/useAppFolderHandling.ts
+++ b/packages/web-pkg/src/composables/appDefaults/useAppFolderHandling.ts
@@ -9,15 +9,10 @@ import { useFileRouteReplace } from '../router/useFileRouteReplace'
 import { DavProperty } from '@opencloud-eu/web-client/webdav'
 import { useAuthService } from '../authContext/useAuthService'
 import { isMountPointSpaceResource } from '@opencloud-eu/web-client'
-import { useExtensionRegistry, useResourcesStore, useSpacesStore } from '../piniaStores'
+import { useResourcesStore, useSpacesStore } from '../piniaStores'
 import { storeToRefs } from 'pinia'
 import { useRouteQuery } from '../router'
 import { useSearch } from '../search'
-import {
-  decryptResourceInPlace,
-  markVaultStatus,
-  resolveFolderVault
-} from '../../helpers/folderVault'
 
 interface AppFolderHandlingOptions {
   currentRoute: Ref<RouteLocationNormalizedLoaded>
@@ -45,7 +40,6 @@ export function useAppFolderHandling({
   const currentRouteQuery = useRouteQuery('contextRouteQuery')
 
   const resourcesStore = useResourcesStore()
-  const extensionRegistry = useExtensionRegistry()
   const { activeResources } = storeToRefs(resourcesStore)
 
   const loadFolderForFileContext = async (context: MaybeRef<FileContext>) => {
@@ -85,20 +79,9 @@ export function useAppFolderHandling({
 
       resourcesStore.clearResourceList()
       const space = unref(context.space)
-      // FIXME(poc-vault): this app-open path duplicates a chunk of the
-      // loaderSpace flow. The vault-decrypt steps below should move into a
-      // shared layer once we lift vault-awareness out of every caller.
-      const vaultEngine = resolveFolderVault(extensionRegistry, space, unref(context.item))
-      const baseCtx = unref(context)
-      const fetchCtx = vaultEngine
-        ? { ...baseCtx, item: await vaultEngine.encryptPath(unref(baseCtx.item)) }
-        : context
-      const pathResource = await getFileInfo(fetchCtx, {
+      const pathResource = await getFileInfo(context, {
         davProperties: [DavProperty.FileId]
       })
-      if (vaultEngine) {
-        await decryptResourceInPlace(vaultEngine, pathResource)
-      }
       replaceInvalidFileRoute({
         space,
         resource: pathResource,
@@ -112,32 +95,14 @@ export function useAppFolderHandling({
 
       if (isSpaceRoot) {
         const resource = await getFileInfo(context)
-        if (vaultEngine) {
-          await decryptResourceInPlace(vaultEngine, resource)
-        }
-        markVaultStatus(extensionRegistry, space, [resource])
         resourcesStore.initResourceList({ currentFolder: resource, resources: [resource] })
         isFolderLoading.value = false
         return
       }
 
-      const cleartextParentPath = dirname(pathResource.path)
-      const listPath = vaultEngine
-        ? await vaultEngine.encryptPath(cleartextParentPath)
-        : cleartextParentPath
       const { resource, children } = await webdav.listFiles(space, {
-        path: listPath
+        path: dirname(pathResource.path)
       })
-      if (vaultEngine) {
-        // Parent + children decrypt in parallel — calls only touch their own
-        // resource, so listings of N items finish in ~one round-trip
-        // instead of N.
-        await Promise.all([
-          decryptResourceInPlace(vaultEngine, resource),
-          ...children.map((c) => decryptResourceInPlace(vaultEngine, c))
-        ])
-      }
-      markVaultStatus(extensionRegistry, space, [resource, ...children])
 
       if (isShareSpaceResource(space)) {
         children.forEach((r) => (r.remoteItemId = space.id))
diff --git a/packages/web-pkg/src/composables/download/useDownloadFile.ts b/packages/web-pkg/src/composables/download/useDownloadFile.ts
index 539750fc6fc..5d417bdbad2 100644
--- a/packages/web-pkg/src/composables/download/useDownloadFile.ts
+++ b/packages/web-pkg/src/composables/download/useDownloadFile.ts
@@ -1,8 +1,8 @@
 import { useClientService } from '../clientService'
-import { triggerDownloadWithFilename } from '../../../src/helpers'
+import { resolveFolderVault, streamToBlob, triggerDownloadWithFilename } from '../../../src/helpers'
 import { useGettext } from 'vue3-gettext'
 import { ClientService } from '../../services'
-import { useMessages, useUserStore } from '../piniaStores'
+import { useExtensionRegistry, useMessages, useUserStore } from '../piniaStores'
 import { Resource, SpaceResource } from '@opencloud-eu/web-client'
 import { useGetMatchingSpace } from '../spaces'
 
@@ -16,6 +16,7 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
   const clientService = options?.clientService || useClientService()
   const { $gettext } = useGettext()
   const userStore = useUserStore()
+  const extensionRegistry = useExtensionRegistry()
 
   const downloadFile = async (
     space: SpaceResource = null,
@@ -26,6 +27,50 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
       if (!space) {
         space = getMatchingSpace(file)
       }
+
+      // Vault files are stored as ciphertext blobs; the plain download URL
+      // would hand the user an unreadable encrypted file. Get the cleartext
+      // bytes and download those as an in-memory blob instead. Gate on the
+      // cheap `isInVault` flag (set by markVaultStatus on every listing, and
+      // carried by a file's versions too) so non-vault downloads skip the
+      // async engine resolution entirely.
+      const vaultEngine = file.isInVault
+        ? await resolveFolderVault(extensionRegistry, space, file.path)
+        : null
+      if (vaultEngine) {
+        let blob: Blob
+        if (version) {
+          // A version lives at a signed meta URL (getFileUrl), which serves the
+          // ciphertext blob. getFileUrl returns a URL, not bytes, so the
+          // vault-aware client can't help - fetch and decrypt it ourselves.
+          const versionUrl = await clientService.webdav.getFileUrl(space, file, {
+            version,
+            username: userStore.user?.onPremisesSamAccountName
+          })
+          const encryptedBytes = await (await fetch(versionUrl)).arrayBuffer()
+          blob = await streamToBlob(
+            vaultEngine.decryptContent(new Blob([encryptedBytes]).stream()),
+            file.mimeType || 'application/octet-stream'
+          )
+        } else {
+          // The current file goes through the vault-aware webdav client, which
+          // returns the decrypted bytes.
+          const response = await clientService.webdav.getFileContents(
+            space,
+            { path: file.path },
+            { responseType: 'arraybuffer' }
+          )
+          blob = new Blob([response.body as ArrayBuffer], {
+            type: file.mimeType || 'application/octet-stream'
+          })
+        }
+        const blobUrl = URL.createObjectURL(blob)
+        triggerDownloadWithFilename(blobUrl, file.name)
+        // hold the object URL long enough for the browser to read it, then free it
+        setTimeout(() => URL.revokeObjectURL(blobUrl), 30000)
+        return
+      }
+
       const url = await clientService.webdav.getFileUrl(space, file, {
         version,
         username: userStore.user?.onPremisesSamAccountName
diff --git a/packages/web-pkg/src/composables/piniaStores/extensionRegistry/types.ts b/packages/web-pkg/src/composables/piniaStores/extensionRegistry/types.ts
index bb83caf7745..72e109a1527 100644
--- a/packages/web-pkg/src/composables/piniaStores/extensionRegistry/types.ts
+++ b/packages/web-pkg/src/composables/piniaStores/extensionRegistry/types.ts
@@ -99,22 +99,36 @@ export interface AppMenuItemExtension extends Extension {
 }
 
 /**
- * Folder vault engine. Implementations decrypt resource names that come back
- * from the server and encrypt clear-text paths that are sent to the server.
+ * Folder vault engine - the scheme-specific crypto a plugin implements.
+ *
+ * Its `encryptPath`/`decryptPath` operate on paths RELATIVE to the vault root
+ * (e.g. `"sub/x"`); the engine never deals with the vault root in a path. The
+ * vault root lives only on the `vaultRoot` field (identity), and the full-path
+ * conversion is done once, generically, by `encryptVaultPath`/`decryptVaultPath`
+ * (web-pkg helpers) - so callers with FULL clear-text paths use those, not the
+ * engine's relative methods directly.
+ *
+ * A single resource name is just a one-segment relative path, so callers that
+ * have a bare name (the activity feed, the upload pipeline) also go through
+ * `encryptPath`/`decryptPath`. That only works because names must encrypt
+ * **independently of their position** in the tree (a name's ciphertext can't
+ * depend on its parent path) - the activity feed hands us a name with no path,
+ * so position-dependent name encryption could never be decrypted there. The
+ * engine still decides *how* it encrypts a multi-segment path internally
+ * (rclone-crypt does it per segment), it just can't make a name's ciphertext
+ * depend on where the name sits.
  */
 export interface FolderVaultEngine {
-  /** Translate a clear-text path into its server-side encrypted form. */
-  encryptPath: (clearPath: string) => Promise<string>
-  /** Translate a server-side encrypted path back into its clear-text form. */
-  decryptPath: (encryptedPath: string) => Promise<string>
-  /** Decrypt a single path segment (e.g. a Resource.name). */
-  decryptName: (encryptedSegment: string, parentClearPath: string) => Promise<string>
-  /** Encrypt a single cleartext segment to its on-server form. */
-  encryptName: (clearSegment: string, parentClearPath: string) => Promise<string>
+  /** Where this vault is rooted, for identity only (e.g. `/myvault.vault`, or `/` for a share-rooted vault). */
+  vaultRoot: string
+  /** Encrypt a vault-root-RELATIVE clear-text path, e.g. `"sub/x"` or a bare name `"q1.txt"`. Full paths: use `encryptVaultPath`. */
+  encryptPath: (relativePath: string) => Promise<string>
+  /** Decrypt a vault-root-RELATIVE encrypted path (or a bare encrypted name). Full paths: use `decryptVaultPath`. */
+  decryptPath: (relativePath: string) => Promise<string>
   /**
    * Pipe a stream of encrypted bytes through the engine and get back a
    * stream of cleartext bytes. The engine is free to process the input
-   * chunk-by-chunk or to buffer everything internally — callers must not
+   * chunk-by-chunk or to buffer everything internally - callers must not
    * rely on either behaviour.
    */
   decryptContent: (encrypted: ReadableStream<Uint8Array>) => ReadableStream<Uint8Array>
@@ -124,15 +138,11 @@ export interface FolderVaultEngine {
    * server.
    */
   encryptContent: (plaintext: ReadableStream<Uint8Array>) => ReadableStream<Uint8Array>
-  /** Clear-text path of the vault root, e.g. `/myvault.vault`. */
-  vaultRoot: string
-  /** Whether the vault is currently locked. PoC: always false. */
-  isLocked: () => boolean
   /**
    * Try to decrypt a sample encrypted segment to verify the key actually
    * matches the data on the server. Returns true if the decryption looks
    * like cleartext, false if it errored out or produced garbage.
-   * Empty vaults can't be verified — callers should treat that case as
+   * Empty vaults can't be verified - callers should treat that case as
    * "trust the key" since there's nothing to disagree with yet.
    */
   verifyKey: (sampleEncryptedSegment: string) => Promise<boolean>
@@ -141,6 +151,16 @@ export interface FolderVaultEngine {
 export interface FolderVaultClaim {
   /** Clear-text root of the claimed vault (e.g. `/myvault.vault`). */
   vaultRoot: string
+  /**
+   * Whether this scheme encrypts resource *names* on the server (both file and
+   * folder names - schemes that encrypt one but not the other don't exist in
+   * practice, so this stays a single flag), not just their content.
+   * rclone-crypt does; a content-only scheme would not. Lets sync, engine-free
+   * callers decide things like "a search hit below the root is ciphertext
+   * gibberish, drop it" without unlocking the vault. When false, names below
+   * the root are clear text and behave like any other resource.
+   */
+  encryptsNames: boolean
   /**
    * Optional route the UI should navigate to in order to unlock the vault
    * (passphrase prompt, hardware-token flow, …). The route handler is
@@ -157,8 +177,14 @@ export interface FolderVaultExtension extends Extension {
    * Resolve a vault engine for (space, path). Return null if this extension is
    * not responsible for the given location, or if it is but no usable
    * unlock state is available (the UI will surface this via claimsPath).
+   *
+   * Async on purpose: an engine may need to load and cache per-vault metadata
+   * (e.g. an index/manifest file) before it can translate paths. rclone-crypt
+   * resolves synchronously (passphrase-derived key) and just returns a
+   * resolved promise. The cheap "is this a vault?" question stays synchronous
+   * via `claimsPath`.
    */
-  resolve: (space: SpaceResource, path: string) => FolderVaultEngine | null
+  resolve: (space: SpaceResource, path: string) => Promise<FolderVaultEngine | null>
   /**
    * Indicate whether this extension manages the given (space, path) at all,
    * regardless of unlock state. Lets the UI redirect a locked vault to the
diff --git a/packages/web-pkg/src/composables/piniaStores/folderVault.ts b/packages/web-pkg/src/composables/piniaStores/folderVault.ts
index c42fde57c20..b157f6765ee 100644
--- a/packages/web-pkg/src/composables/piniaStores/folderVault.ts
+++ b/packages/web-pkg/src/composables/piniaStores/folderVault.ts
@@ -1,78 +1,99 @@
 import { defineStore } from 'pinia'
-import { ref, unref } from 'vue'
+import { shallowRef, unref } from 'vue'
+import type { FolderVaultEngine } from './extensionRegistry'
 
 /**
- * Holds the unlock secrets for vaults across the running session. Lives in
- * memory only on purpose — page reload requires re-unlocking, which matches
- * what most users expect from a passphrase-protected vault. Plugins (e.g.
- * `web-app-rclone-crypt`) write into this store from their unlock UI, and
- * `resolveVault()` inside the same plugin reads from it again to construct
- * an engine.
+ * Holds the unlocked engines for vaults across the running session. Lives in
+ * memory only on purpose - a page reload requires re-unlocking, which matches
+ * what most users expect from a protected vault. A plugin (e.g.
+ * `web-app-rclone-crypt`) builds an engine in its unlock UI and stashes it
+ * here; `resolveVault()` inside the same plugin then reads it back. A vault
+ * counts as unlocked exactly when an engine is stored for it.
  *
- * The "secret" payload is opaque to web-pkg — each extension decides what to
- * stash there (a passphrase, a derived key, an OAuth token, …).
+ * The store is mechanism-agnostic: it only knows about `FolderVaultEngine`, the
+ * common encrypt/decrypt interface. How an extension obtains one - a passphrase,
+ * a derived key, a hardware token, an OAuth flow - is entirely the extension's
+ * business and never reaches this store.
  *
  * Keys are `(spaceId, vaultRootPath)` rather than `(spaceId, vaultId)` by
- * design: in the rclone-crypt PoC the vault root path is the immutable
- * identity (the encryption salt is derived from the path, vault roots
- * can't be moved or renamed, and the route guard naturally has only the
- * path on cold reload). Path-based keying keeps every resolver callsite
- * free of an additional path→id lookup. If vault-root rename ever lands,
- * the rename handler will re-key the store on the rename event — the
- * stored payload outlives the key it's filed under.
+ * design: the vault root path is the handle every callsite already has (the
+ * route guard only has the path on cold reload), so path-based keying keeps
+ * resolvers free of an extra path→id lookup. An engine does not depend on the
+ * path it's filed under, so a vault root can be renamed without rebuilding it -
+ * only this store has to be re-keyed, which `moveEngine` does from the rename
+ * handler.
  */
 export const useFolderVaultStore = defineStore('folder-vault', () => {
-  const secrets = ref<Map<string, unknown>>(new Map())
+  // shallowRef, not ref: only the Map *reference* is reactive (every mutator
+  // re-assigns it so isUnlocked re-evaluates). The engines themselves stay raw
+  // - a deep-reactive proxy would change their identity and needlessly wrap a
+  // cipher/closure that has no business being reactive.
+  const engines = shallowRef<Map<string, FolderVaultEngine>>(new Map())
 
   const buildKey = (spaceId: string, vaultRoot: string) => `${spaceId}::${vaultRoot}`
 
-  const getSecret = <T = unknown>(spaceId: string, vaultRoot: string): T | undefined => {
-    return unref(secrets).get(buildKey(spaceId, vaultRoot)) as T | undefined
+  const getEngine = (spaceId: string, vaultRoot: string): FolderVaultEngine | undefined => {
+    return unref(engines).get(buildKey(spaceId, vaultRoot))
   }
 
-  const setSecret = (spaceId: string, vaultRoot: string, secret: unknown) => {
-    unref(secrets).set(buildKey(spaceId, vaultRoot), secret)
+  const setEngine = (spaceId: string, vaultRoot: string, engine: FolderVaultEngine) => {
+    unref(engines).set(buildKey(spaceId, vaultRoot), engine)
     // re-assign so Vue tracks the change
-    secrets.value = new Map(unref(secrets))
+    engines.value = new Map(unref(engines))
   }
 
-  const clearSecret = (spaceId: string, vaultRoot: string) => {
-    unref(secrets).delete(buildKey(spaceId, vaultRoot))
-    secrets.value = new Map(unref(secrets))
+  const clearEngine = (spaceId: string, vaultRoot: string) => {
+    unref(engines).delete(buildKey(spaceId, vaultRoot))
+    engines.value = new Map(unref(engines))
   }
 
   /**
-   * Drop every cached secret whose vault root sits at — or below — `pathPrefix`
-   * inside the given space. Called when a resource gets deleted: if the vault
-   * itself or any of its ancestors is gone, the cached passphrase is now
-   * stale and would unlock content that no longer exists (or, worse, content
-   * a different user re-created at the same name later).
+   * Re-file the engine of a vault whose root was renamed/moved from
+   * `fromVaultRoot` to `toVaultRoot`. No-op when nothing is stored under the
+   * old key, so it is safe to call for every rename. The engine stays valid
+   * under its new key (it doesn't depend on the path it's filed under).
    */
-  const clearSecretsUnder = (spaceId: string, pathPrefix: string) => {
+  const moveEngine = (spaceId: string, fromVaultRoot: string, toVaultRoot: string) => {
+    const fromKey = buildKey(spaceId, fromVaultRoot)
+    if (!unref(engines).has(fromKey)) return
+    const engine = unref(engines).get(fromKey)
+    unref(engines).delete(fromKey)
+    unref(engines).set(buildKey(spaceId, toVaultRoot), engine)
+    engines.value = new Map(unref(engines))
+  }
+
+  /**
+   * Drop every unlocked engine whose vault root sits at - or below -
+   * `pathPrefix` inside the given space. Called when a resource gets deleted:
+   * if the vault itself or any of its ancestors is gone, the cached engine is
+   * now stale and would unlock content that no longer exists (or, worse,
+   * content a different user re-created at the same name later).
+   */
+  const clearEnginesUnder = (spaceId: string, pathPrefix: string) => {
     if (!pathPrefix) return
     // Normalise: treat "/foo" as covering "/foo" and "/foo/anything", but not
     // "/foobar".
     const prefix = pathPrefix.replace(/\/+$/, '')
     const ownedKeyPrefix = `${spaceId}::`
     let changed = false
-    for (const key of Array.from(unref(secrets).keys())) {
+    for (const key of Array.from(unref(engines).keys())) {
       if (!key.startsWith(ownedKeyPrefix)) continue
       const vaultRoot = key.slice(ownedKeyPrefix.length)
       if (vaultRoot === prefix || vaultRoot.startsWith(`${prefix}/`)) {
-        unref(secrets).delete(key)
+        unref(engines).delete(key)
         changed = true
       }
     }
     if (changed) {
-      secrets.value = new Map(unref(secrets))
+      engines.value = new Map(unref(engines))
     }
   }
 
   const isUnlocked = (spaceId: string, vaultRoot: string) => {
-    return unref(secrets).has(buildKey(spaceId, vaultRoot))
+    return unref(engines).has(buildKey(spaceId, vaultRoot))
   }
 
-  return { getSecret, setSecret, clearSecret, clearSecretsUnder, isUnlocked }
+  return { getEngine, setEngine, clearEngine, moveEngine, clearEnginesUnder, isUnlocked }
 })
 
 export type FolderVaultStore = ReturnType<typeof useFolderVaultStore>
diff --git a/packages/web-pkg/src/composables/resources/useLoadPreview.ts b/packages/web-pkg/src/composables/resources/useLoadPreview.ts
index 59f16735911..23ad1fc8397 100644
--- a/packages/web-pkg/src/composables/resources/useLoadPreview.ts
+++ b/packages/web-pkg/src/composables/resources/useLoadPreview.ts
@@ -95,6 +95,13 @@ export const useLoadPreview = (viewMode?: Ref<string>) => {
       cancelTasks()
     }
 
+    // Vault files are ciphertext blobs server-side, so there is no thumbnail
+    // to fetch - skip the request (it would only 404) and fall back to the
+    // file-type icon.
+    if (resource?.isInVault) {
+      return
+    }
+
     if (isProjectSpaceResource(resource) && (!resource.spaceImageData || resource.disabled)) {
       if (unref(defaultSpaceImageBlobURL)) {
         spacesStore.updateSpaceField({
diff --git a/packages/web-pkg/src/composables/search/useSearch.ts b/packages/web-pkg/src/composables/search/useSearch.ts
index 2a30891af9b..2d52bda5e6b 100644
--- a/packages/web-pkg/src/composables/search/useSearch.ts
+++ b/packages/web-pkg/src/composables/search/useSearch.ts
@@ -4,15 +4,29 @@ import { DavProperties } from '@opencloud-eu/web-client/webdav'
 import { call } from '@opencloud-eu/web-client'
 import { useClientService } from '../clientService'
 import { isProjectSpaceResource } from '@opencloud-eu/web-client'
-import { useCapabilityStore, useResourcesStore, useSpacesStore } from '../piniaStores'
+import {
+  useCapabilityStore,
+  useExtensionRegistry,
+  useResourcesStore,
+  useSpacesStore
+} from '../piniaStores'
 import { SearchResource } from '@opencloud-eu/web-client'
 import { useTask } from 'vue-concurrency'
+import { getVaultClaim, markVaultStatus } from '../../helpers/folderVault'
 
 export const useSearch = () => {
   const clientService = useClientService()
   const spacesStore = useSpacesStore()
   const resourcesStore = useResourcesStore()
   const capabilityStore = useCapabilityStore()
+  const extensionRegistry = useExtensionRegistry()
+  // Light, throw-free space lookup by storage id straight from the spaces
+  // store. Best-effort on purpose: if the space isn't loaded (e.g. a share
+  // space that getMatchingSpace would synthesize on the fly), this returns
+  // undefined, the claim below stays null and the hit is simply kept rather
+  // than dropped - an acceptable filter miss that avoids running the heavier
+  // getMatchingSpace on every single search result.
+  const findSpaceById = (storageId: string) => spacesStore.spaces.find((s) => s.id === storageId)
 
   const fullTextSearchEnabled = computed(() => capabilityStore.searchContent?.enabled)
   const areHiddenFilesShown = computed(() => resourcesStore.areHiddenFilesShown)
@@ -40,10 +54,28 @@ export const useSearch = () => {
     return {
       totalResults,
       values: resources
+        .filter((resource) => {
+          // Drop encrypted vault *content*: when the scheme encrypts names, a hit
+          // below the vault root has a ciphertext server name - it's gibberish to
+          // show and a clear-text query can't match it anyway. The clear-text
+          // vault root itself is KEPT (and flagged below) so users can still find
+          // their vaults by name. Content-only schemes keep all hits. Sync and
+          // engine-free via the claim.
+          const space = findSpaceById(resource.storageId)
+          const claim = space ? getVaultClaim(extensionRegistry, space, resource.path) : null
+          return !claim?.encryptsNames || claim.vaultRoot === resource.path
+        })
         .map((resource) => {
           const matchingSpace = getProjectSpace(resource.parentFolderId)
           const data = (matchingSpace ? matchingSpace : resource) as SearchResource
 
+          // A surfaced vault root is a normal clear-text folder; flag it so the
+          // share/copy/move guards engage and it can't be exfiltrated from here.
+          const space = findSpaceById(resource.storageId)
+          if (space) {
+            markVaultStatus(extensionRegistry, space, [data])
+          }
+
           return { id: data.id, data }
         })
         .filter(({ data }) => {
diff --git a/packages/web-pkg/src/helpers/folderVault.ts b/packages/web-pkg/src/helpers/folderVault.ts
index 87d62aa9a2d..e93cf0428d2 100644
--- a/packages/web-pkg/src/helpers/folderVault.ts
+++ b/packages/web-pkg/src/helpers/folderVault.ts
@@ -1,6 +1,8 @@
 import { unref } from 'vue'
 import { extractExtensionFromFile, Resource, SpaceResource } from '@opencloud-eu/web-client'
 import { DavPermission } from '@opencloud-eu/web-client/webdav'
+import { mimeTypeForExtension } from './vaultMimeType'
+import { decryptVaultPath, encryptVaultPath } from './vaultEngine'
 import {
   ExtensionRegistry,
   FolderVaultClaim,
@@ -10,28 +12,32 @@ import {
 
 /**
  * Walks the registered folder-vault extensions and returns the first engine
- * that can decrypt the given (space, path) — i.e. a vault that is currently
- * **unlocked** in this session. Returns `null` in two distinct situations
- * that callers should usually treat the same:
+ * that can decrypt the given (space, path), or `null` if there is none. There
+ * is no separate locked/unlocked vault state: an engine exists for a path
+ * exactly when one was resolved and stashed in the store this session, and its
+ * absence is all "locked" means. `null` therefore covers two cases that
+ * callers usually treat the same:
  *
- *   - no extension owns the path (it isn't inside a vault at all), or
- *   - an extension owns the path but the vault is still locked (no secret
- *     in the store yet).
+ *   - no extension claims the path (it isn't inside a vault at all), or
+ *   - an extension claims it but no engine has been resolved for it yet.
  *
- * Use `getVaultClaim` to disambiguate when the difference matters — e.g.
- * the route guard needs the unlock route, while everyone else can safely
- * treat both cases as "operate in cleartext".
+ * Use `getVaultClaim` to disambiguate when the difference matters - e.g.
+ * the route guard needs the claim's unlock route, while everyone else can
+ * safely treat both cases as "operate in cleartext".
  *
- * FIXME(poc-vault): this lookup currently lives next to the loaders and the
- * AppWrapper. Once we lift vault-aware translation onto a higher layer (e.g.
- * a webdav/client decorator or a folderService decorator), callers stop
- * needing to resolve the engine themselves.
+ * Since the vault-aware webdav decorator (`createVaultWebDav`), most callers
+ * no longer resolve the engine themselves - the decorator does it for every
+ * path-carrying webdav method. The remaining direct callers are exactly the
+ * paths that can't route through that webdav client: the uppy/tus upload
+ * pipeline, the delete worker, the version-download `getFileUrl` branch and
+ * the activity feed. The route guard also calls in, but for unlock state to
+ * drive a redirect, not for translation.
  */
-export function resolveFolderVault(
+export async function resolveFolderVault(
   extensionRegistry: ExtensionRegistry,
   space: SpaceResource,
   path: string | undefined
-): FolderVaultEngine | null {
+): Promise<FolderVaultEngine | null> {
   if (!space || !path) {
     return null
   }
@@ -39,7 +45,7 @@ export function resolveFolderVault(
     .flatMap((ref) => unref(ref))
     .filter((e): e is FolderVaultExtension => e.type === 'folderVault')
   for (const ext of extensions) {
-    const engine = ext.resolve(space, path)
+    const engine = await ext.resolve(space, path)
     if (engine) {
       return engine
     }
@@ -47,14 +53,55 @@ export function resolveFolderVault(
   return null
 }
 
+/**
+ * Translate each resource's (possibly decrypted) path back to its on-server
+ * encrypted form. For callers that bypass the vault-aware webdav client - the
+ * web workers, which run their own vanilla webdav instance and would otherwise
+ * write a cleartext name to the server for an unlocked vault. Resources outside
+ * a vault (or in a locked one, where the path is already ciphertext) are
+ * returned unchanged; the original instances stay untouched for UI state.
+ */
+export async function encryptResourcePathsForServer(
+  extensionRegistry: ExtensionRegistry,
+  space: SpaceResource,
+  resources: Resource[]
+): Promise<Resource[]> {
+  return Promise.all(
+    resources.map(async (r) => {
+      const engine = await resolveFolderVault(extensionRegistry, space, r.path)
+      if (!engine) return r
+      const encryptedPath = await encryptVaultPath(engine, r.path)
+      if (encryptedPath === r.path) return r
+      return { ...r, path: encryptedPath } as Resource
+    })
+  )
+}
+
+/**
+ * Same as `encryptResourcePathsForServer` but for bare folder paths (e.g. the
+ * parent folders a restore has to recreate before moving the item back).
+ */
+export async function encryptFolderPathsForServer(
+  extensionRegistry: ExtensionRegistry,
+  space: SpaceResource,
+  paths: string[]
+): Promise<string[]> {
+  return Promise.all(
+    paths.map(async (p) => {
+      const engine = await resolveFolderVault(extensionRegistry, space, p)
+      return engine ? encryptVaultPath(engine, p) : p
+    })
+  )
+}
+
 /**
  * Walks the registered folder-vault extensions and returns the first one
- * that claims the given (space, path) — independent of unlock state. Callers
+ * that claims the given (space, path) - independent of unlock state. Callers
  * use this to decide whether to render an "unlock first" redirect for a
  * vault whose `resolve()` returned null (i.e. the extension owns the path
  * but currently can't produce an engine).
  *
- * Also the canonical "is this path inside any vault?" check — used by
+ * Also the canonical "is this path inside any vault?" check - used by
  * `markVaultStatus` to populate `Resource.isInVault`.
  */
 export function getVaultClaim(
@@ -77,45 +124,6 @@ export function getVaultClaim(
   return null
 }
 
-// Tiny extension → mime-type lookup so vault resources show up with the
-// right mime once we've recovered their cleartext extension. Mirrors the
-// shapes the preview / mediaviewer / file-icon code checks against.
-const MIME_BY_EXTENSION: Record<string, string> = {
-  txt: 'text/plain',
-  md: 'text/markdown',
-  markdown: 'text/markdown',
-  html: 'text/html',
-  htm: 'text/html',
-  css: 'text/css',
-  csv: 'text/csv',
-  json: 'application/json',
-  xml: 'application/xml',
-  yml: 'text/yaml',
-  yaml: 'text/yaml',
-  pdf: 'application/pdf',
-  png: 'image/png',
-  jpg: 'image/jpeg',
-  jpeg: 'image/jpeg',
-  gif: 'image/gif',
-  webp: 'image/webp',
-  svg: 'image/svg+xml',
-  bmp: 'image/bmp',
-  mp3: 'audio/mpeg',
-  ogg: 'audio/ogg',
-  wav: 'audio/wav',
-  flac: 'audio/flac',
-  mp4: 'video/mp4',
-  webm: 'video/webm',
-  mov: 'video/quicktime',
-  zip: 'application/zip',
-  epub: 'application/epub+zip'
-}
-
-function guessMimeType(extension: string | undefined): string | undefined {
-  if (!extension) return undefined
-  return MIME_BY_EXTENSION[extension.toLowerCase()]
-}
-
 /**
  * Rewrite a Resource so its name / path / webDavPath / extension reflect the
  * cleartext form. The server only knows the encrypted blob name, so anything
@@ -129,7 +137,19 @@ export async function decryptResourceInPlace(
   if (!r?.path) {
     return r
   }
-  const decryptedPath = await engine.decryptPath(r.path)
+  let decryptedPath: string
+  try {
+    decryptedPath = await decryptVaultPath(engine, r.path)
+  } catch (e) {
+    // A single foreign or corrupt blob (a file put there by another tool, a
+    // truncated name, …) must not blow up the whole listing via the caller's
+    // Promise.all. Keep its encrypted name but still flag it as in-vault so the
+    // folder still loads. Share-gating (stripping Shareable) is applied by the
+    // `markVaultStatus` pass that always follows this decrypt.
+    console.error('[folder-vault] failed to decrypt resource path', r.path, e)
+    r.isInVault = true
+    return r
+  }
   if (decryptedPath === r.path) {
     return r
   }
@@ -153,28 +173,15 @@ export async function decryptResourceInPlace(
     // gate on mimeType in addition to extension, so override it with a
     // guess derived from the cleartext extension. Keeps preview, audio
     // and image apps happy.
-    const guessed = guessMimeType(r.extension)
+    const guessed = mimeTypeForExtension(r.extension)
     if (guessed) {
       r.mimeType = guessed
     }
   }
-  // Sharing a vault entry would expose ciphertext blobs to other users with
-  // no way to read them. Strip the Shareable permission so canShare()
-  // returns false everywhere in the UI (action buttons, sidebar, etc.).
-  //
-  // This is the **only** share-gating mechanism for vault resources — every
-  // share entry point (FileLinks, FileShares, useFileActionsShowShares,
-  // useFileActionsCreateLink) already routes through canShare(), which
-  // reads these permissions. Do not add a redundant `isInVault` guard on
-  // top of that; the two would drift over time.
-  if (r.permissions) {
-    r.permissions = r.permissions.replace(DavPermission.Shareable, '')
-  }
-  // The engine resolved → resource is by definition inside (or *is*) a
-  // vault. Setting the flag here covers in-vault listings; vault-root
-  // resources surfaced in a *parent* listing (where the engine isn't
-  // resolved against the parent path) get the same flag via
-  // `markVaultStatus` below.
+  // The engine resolved → resource is by definition inside (or *is*) a vault.
+  // Flagging covers in-vault listings; share-gating (Shareable strip) and
+  // vault-root resources surfaced in a *parent* listing are handled by the
+  // `markVaultStatus` pass that always follows this decrypt.
   r.isInVault = true
   return r
 }
@@ -182,7 +189,7 @@ export async function decryptResourceInPlace(
 /**
  * Mark resources whose path sits inside (or *is*) a registered vault by
  * setting `Resource.isInVault = true`. Cheap path-based lookup via
- * `getVaultClaim` — no unlock state required.
+ * `getVaultClaim` - no unlock state required.
  *
  * Call this on any listing the UI will render so action guards (move,
  * copy, paste, favorite, share-from-vault, …) can short-circuit on the
@@ -197,8 +204,24 @@ export function markVaultStatus(
   if (!space || !resources?.length) return
   for (const r of resources) {
     if (!r?.path) continue
-    if (getVaultClaim(extensionRegistry, space, r.path)) {
-      r.isInVault = true
+    const claim = getVaultClaim(extensionRegistry, space, r.path)
+    if (!claim) continue
+    // Guard the `.vault`-suffix detection band-aid: a *file* literally named
+    // `something.vault` would otherwise be mistaken for a vault root. A real
+    // vault root is always a folder, so a non-folder sitting exactly at the
+    // claimed root is a false positive - leave it as a normal resource.
+    if (claim.vaultRoot === r.path && r.type !== 'folder' && !r.isFolder) continue
+    r.isInVault = true
+
+    // All vault share-gating lives here. Vault *content* (anything below the
+    // root) is never shareable: its ciphertext name can't be claimed once a
+    // share or public link rebases the path, so strip Shareable and canShare()
+    // returns false at every share entry point. The vault *root* keeps Shareable
+    // on purpose - it stays collaborator-shareable (the recipient unlocks it out
+    // of band, where the cleartext `.vault` name still anchors detection); only
+    // public links are blocked, gated on `isInVault` in the link UI.
+    if (claim.vaultRoot !== r.path && r.permissions) {
+      r.permissions = r.permissions.replace(DavPermission.Shareable, '')
     }
   }
 }
diff --git a/packages/web-pkg/src/helpers/index.ts b/packages/web-pkg/src/helpers/index.ts
index 96600de50b1..feb3ef79ede 100644
--- a/packages/web-pkg/src/helpers/index.ts
+++ b/packages/web-pkg/src/helpers/index.ts
@@ -10,6 +10,7 @@ export * from './clipboardActions'
 export * from './datetime'
 export * from './download'
 export * from './folderVault'
+export * from './vaultEngine'
 export * from './filesize'
 export * from './fuse'
 export * from './locale'
diff --git a/packages/web-pkg/src/helpers/vaultEngine.ts b/packages/web-pkg/src/helpers/vaultEngine.ts
new file mode 100644
index 00000000000..5ef249b2a26
--- /dev/null
+++ b/packages/web-pkg/src/helpers/vaultEngine.ts
@@ -0,0 +1,51 @@
+import { urlJoin } from '@opencloud-eu/web-client'
+import { FolderVaultEngine } from '../composables/piniaStores/extensionRegistry'
+
+// A vault path comes in two forms:
+//   full      `/my.vault/notes/q1.txt`  - what callers pass around
+//   relative  `notes/q1.txt`            - the part inside the vault; all the engine sees
+//
+// full -> relative: drop the vault root and the leading slash. Slicing
+// `vaultRoot.length` covers both a folder root and the share root `/` - for `/`
+// the single character it drops IS the leading slash:
+//   `/my.vault` + `/my.vault/notes/q1.txt` -> `notes/q1.txt`
+//   `/`         + `/notes/q1.txt`          -> `notes/q1.txt`
+function stripVaultRoot(vaultRoot: string, fullPath: string): string {
+  return fullPath.slice(vaultRoot.length).replace(/^\/+/, '').replace(/\/+$/, '')
+}
+
+// relative -> full is just `urlJoin(vaultRoot, relative)` - it joins
+// `/my.vault` + `enc` -> `/my.vault/enc` and `/` + `enc` -> `/enc` (no `//`).
+
+/**
+ * Encrypt a full clear-text path: drop the vault root, encrypt the relative
+ * remainder (the only part the engine handles), then join the root back on -
+ *   `/my.vault/notes/q1.txt` -> `/my.vault/<enc notes>/<enc q1.txt>`.
+ * The vault root itself is clear text on the server, so it is returned unchanged
+ * (the engine isn't called).
+ */
+export async function encryptVaultPath(
+  engine: FolderVaultEngine,
+  fullPath: string
+): Promise<string> {
+  const relative = stripVaultRoot(engine.vaultRoot, fullPath)
+  if (!relative) {
+    return engine.vaultRoot
+  }
+  return urlJoin(engine.vaultRoot, await engine.encryptPath(relative), { leadingSlash: true })
+}
+
+/**
+ * The exact inverse of encryptVaultPath -
+ *   `/my.vault/<enc notes>/<enc q1.txt>` -> `/my.vault/notes/q1.txt`.
+ */
+export async function decryptVaultPath(
+  engine: FolderVaultEngine,
+  fullPath: string
+): Promise<string> {
+  const relative = stripVaultRoot(engine.vaultRoot, fullPath)
+  if (!relative) {
+    return engine.vaultRoot
+  }
+  return urlJoin(engine.vaultRoot, await engine.decryptPath(relative), { leadingSlash: true })
+}
diff --git a/packages/web-pkg/src/helpers/vaultMimeType.ts b/packages/web-pkg/src/helpers/vaultMimeType.ts
new file mode 100644
index 00000000000..8684f7e44e4
--- /dev/null
+++ b/packages/web-pkg/src/helpers/vaultMimeType.ts
@@ -0,0 +1,40 @@
+// Extension -> mime-type lookup for vault resources. The server only knows the
+// encrypted blob (mime typically application/octet-stream, no extension), so
+// once a vault name is decrypted we re-derive a mime from its cleartext
+// extension. Preview / mediaviewer / file-icon code gate on mimeType, so this
+// keeps those apps working for vault content. Mirrors the shapes they check.
+const MIME_BY_EXTENSION: Record<string, string> = {
+  txt: 'text/plain',
+  md: 'text/markdown',
+  markdown: 'text/markdown',
+  html: 'text/html',
+  htm: 'text/html',
+  css: 'text/css',
+  csv: 'text/csv',
+  json: 'application/json',
+  xml: 'application/xml',
+  yml: 'text/yaml',
+  yaml: 'text/yaml',
+  pdf: 'application/pdf',
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  svg: 'image/svg+xml',
+  bmp: 'image/bmp',
+  mp3: 'audio/mpeg',
+  ogg: 'audio/ogg',
+  wav: 'audio/wav',
+  flac: 'audio/flac',
+  mp4: 'video/mp4',
+  webm: 'video/webm',
+  mov: 'video/quicktime',
+  zip: 'application/zip',
+  epub: 'application/epub+zip'
+}
+
+export function mimeTypeForExtension(extension: string | undefined): string | undefined {
+  if (!extension) return undefined
+  return MIME_BY_EXTENSION[extension.toLowerCase()]
+}
diff --git a/packages/web-pkg/src/services/client/client.ts b/packages/web-pkg/src/services/client/client.ts
index 261bed7fdd9..f79796cdbbf 100644
--- a/packages/web-pkg/src/services/client/client.ts
+++ b/packages/web-pkg/src/services/client/client.ts
@@ -11,6 +11,7 @@ import { Language } from 'vue3-gettext'
 import { FetchEventSourceInit } from '@microsoft/fetch-event-source'
 import { sse } from '@opencloud-eu/web-client/sse'
 import { AuthStore, CapabilityStore, ConfigStore } from '../../composables'
+import { createVaultWebDav } from './vaultWebDav'
 
 const createFetchOptions = (authParams: AuthParameters, language: string): FetchEventSourceInit => {
   return {
@@ -148,7 +149,7 @@ export class ClientService {
   }
 
   private initWebDavClient() {
-    this.webDavClient = webdav(this.configStore.serverUrl, () => {
+    const client = webdav(this.configStore.serverUrl, () => {
       const headers = { ...this.staticHeaders, ...this.getDynamicHeaders() }
 
       if (this.authStore.publicLinkToken) {
@@ -163,6 +164,10 @@ export class ClientService {
 
       return headers
     })
+    // Wrap the raw client so folder-vault path/name translation happens
+    // transparently for every caller (clear-text in, clear-text out). It's a
+    // strict pass-through for any path that isn't inside a vault.
+    this.webDavClient = createVaultWebDav(client)
   }
 
   /**
diff --git a/packages/web-pkg/src/services/client/vaultWebDav.ts b/packages/web-pkg/src/services/client/vaultWebDav.ts
new file mode 100644
index 00000000000..fc51b64f303
--- /dev/null
+++ b/packages/web-pkg/src/services/client/vaultWebDav.ts
@@ -0,0 +1,269 @@
+import { Resource, SpaceResource } from '@opencloud-eu/web-client'
+import { WebDAV } from '@opencloud-eu/web-client/webdav'
+// Import from the specific store / helper modules rather than the big
+// `composables` and `piniaStores` barrels: this file is pulled in from the
+// services layer, and re-entering those barrels (which the root index exports
+// before `services`) creates an evaluation cycle that leaves unrelated
+// composable exports temporarily undefined.
+import { useExtensionRegistry } from '../../composables/piniaStores/extensionRegistry'
+import {
+  decryptResourceInPlace,
+  getVaultClaim,
+  markVaultStatus,
+  resolveFolderVault
+} from '../../helpers/folderVault'
+import { encryptVaultPath } from '../../helpers/vaultEngine'
+import { streamToArrayBuffer } from '../../helpers/streams'
+
+/**
+ * Wrap a WebDAV client so folder-vault translation happens transparently on
+ * every call: clear-text paths are encrypted on the way to the server, and the
+ * encrypted names that come back are decrypted (and flagged) before any caller
+ * sees them. Callers keep using `clientService.webdav` with clear-text paths and
+ * never have to resolve a vault engine themselves.
+ *
+ * The wrapper is a strict pass-through whenever a path isn't inside a vault: the
+ * sync `getVaultClaim` pre-check short-circuits before any async work, so the
+ * 99% non-vault calls are byte-identical to the undecorated client. Only when a
+ * path actually belongs to a vault do we resolve the engine and translate.
+ *
+ * Scope: every webdav method that carries a path or content - listFiles,
+ * getFileInfo, createFolder, deleteFile, moveFiles, copyFiles,
+ * restoreFileVersion, and the content methods getFileContents / putFileContents
+ * (which add a body transform, decryptContent / encryptContent, on top of the
+ * path one).
+ *
+ * What the decorator genuinely cannot reach is anything that doesn't ride the
+ * webdav client at all: signed-URL downloads (getFileUrl returns a URL, not
+ * bytes), the uppy/tus upload queue, and the delete/paste/restore web workers
+ * (their own client instance). Those keep their own vault handling.
+ *
+ * Also out of scope: getPathForFileId / listFileVersions take only a fileId
+ * (no space), so the wrapper can't resolve the vault engine to decrypt the
+ * returned server path. A fileId deep-link into a vault therefore resolves to
+ * the encrypted path (correctness only, no leak). The proper fix is the
+ * per-user vault registry that will replace `.vault`-suffix detection; until
+ * then this is a known limitation.
+ */
+export function createVaultWebDav(inner: WebDAV): WebDAV {
+  /**
+   * Encrypt a clear-text path into its server-side form. No-op (sync fast path)
+   * when the path isn't claimed by any vault. For a *locked* vault we have no
+   * key, so we leave the path untouched - mutations on a locked vault aren't
+   * reachable through the UI (the unlock gate stops them first).
+   */
+  async function toServerPath(
+    space: SpaceResource,
+    path: string | undefined
+  ): Promise<string | undefined> {
+    if (!space || !path) {
+      return path
+    }
+    const registry = useExtensionRegistry()
+    if (!getVaultClaim(registry, space, path)) {
+      return path
+    }
+    const engine = await resolveFolderVault(registry, space, path)
+    return engine ? await encryptVaultPath(engine, path) : path
+  }
+
+  /**
+   * Like `toServerPath`, but for *writes*: refuse to operate when the path
+   * belongs to a vault that is locked. Reads can fall through and just show
+   * ciphertext, but a write (create / put / move / copy / delete) with the
+   * untranslated clear-text path would put a clear-text name on the server and
+   * corrupt the vault. The UI never reaches a locked vault, so this only ever
+   * fires as a fail-closed backstop - never silently send clear text.
+   */
+  async function toServerPathForWrite(
+    space: SpaceResource,
+    path: string | undefined
+  ): Promise<string | undefined> {
+    if (!space || !path) {
+      return path
+    }
+    const registry = useExtensionRegistry()
+    const claim = getVaultClaim(registry, space, path)
+    if (!claim) {
+      return path
+    }
+    // The vault *root* itself is a clear-text folder name - creating, renaming
+    // or deleting the vault needs no key, so let it through untouched even when
+    // no engine exists (e.g. while creating the vault, or for a locked one).
+    // Only *content* below the root carries an encryptable name.
+    if (claim.vaultRoot === path) {
+      return path
+    }
+    const engine = await resolveFolderVault(registry, space, path)
+    if (!engine) {
+      throw new Error(
+        `Refusing to write a clear-text path into the locked vault "${claim.vaultRoot}"`
+      )
+    }
+    return encryptVaultPath(engine, path)
+  }
+
+  /**
+   * Decrypt the names of resources coming back from the server and flag their
+   * vault status. Resources are grouped by vault root so a mixed listing (e.g.
+   * the trash bin, where each item's original location may sit in a different
+   * vault) resolves each engine exactly once. `markVaultStatus` is claim-based
+   * and runs even while a vault is locked; the actual name decrypt only happens
+   * when the vault is unlocked (the engine resolves).
+   */
+  async function fromServer(
+    space: SpaceResource,
+    resources: Array<Resource | undefined | null>
+  ): Promise<void> {
+    const list = resources.filter((r): r is Resource => !!r?.path)
+    if (!space || !list.length) {
+      return
+    }
+    const registry = useExtensionRegistry()
+
+    const byRoot = new Map<string, Resource[]>()
+    for (const r of list) {
+      const claim = getVaultClaim(registry, space, r.path)
+      if (!claim) {
+        continue
+      }
+      const group = byRoot.get(claim.vaultRoot) ?? []
+      group.push(r)
+      byRoot.set(claim.vaultRoot, group)
+    }
+
+    for (const [vaultRoot, group] of byRoot) {
+      const engine = await resolveFolderVault(registry, space, vaultRoot)
+      if (engine) {
+        await Promise.all(group.map((r) => decryptResourceInPlace(engine, r)))
+      }
+    }
+
+    // Always (re-)flag vault status. Idempotent after decryptResourceInPlace,
+    // and the only thing that fires for a locked vault or for a vault root
+    // surfaced in a parent listing (where no engine resolves against it).
+    markVaultStatus(registry, space, list)
+  }
+
+  return {
+    ...inner,
+
+    async listFiles(space, fileInfo = {}, options) {
+      const path = await toServerPath(space, fileInfo?.path)
+      const result = await inner.listFiles(space, { ...fileInfo, path }, options)
+      await fromServer(space, [result?.resource, ...(result?.children ?? [])])
+      return result
+    },
+
+    async getFileInfo(space, resource = {}, options) {
+      const path = await toServerPath(space, resource?.path)
+      const result = await inner.getFileInfo(space, { ...resource, path }, options)
+      await fromServer(space, [result])
+      return result
+    },
+
+    async createFolder(space, options) {
+      // Only the path-based form carries a clear-text path to translate; the
+      // (unused) name-based form passes through. fetchFolder may resolve no
+      // resource, which fromServer simply skips.
+      const path = await toServerPathForWrite(space, options?.path)
+      const result = await inner.createFolder(space, { ...options, path })
+      await fromServer(space, [result])
+      return result
+    },
+
+    async deleteFile(space, { path, ...opts }) {
+      return inner.deleteFile(space, { path: await toServerPathForWrite(space, path), ...opts })
+    },
+
+    async moveFiles(sourceSpace, source, targetSpace, target, options) {
+      return inner.moveFiles(
+        sourceSpace,
+        { ...source, path: await toServerPathForWrite(sourceSpace, source?.path) },
+        targetSpace,
+        { ...target, path: await toServerPathForWrite(targetSpace, target?.path) },
+        options
+      )
+    },
+
+    async copyFiles(sourceSpace, source, targetSpace, target, options) {
+      return inner.copyFiles(
+        sourceSpace,
+        { ...source, path: await toServerPathForWrite(sourceSpace, source?.path) },
+        targetSpace,
+        { ...target, path: await toServerPathForWrite(targetSpace, target?.path) },
+        options
+      )
+    },
+
+    async restoreFileVersion(space, resource, versionId, opts) {
+      return inner.restoreFileVersion(
+        space,
+        { ...resource, path: await toServerPathForWrite(space, resource?.path) },
+        versionId,
+        opts
+      )
+    },
+
+    async getFileContents(space, resource, options = {}) {
+      const path = resource?.path
+      if (!path || !getVaultClaim(useExtensionRegistry(), space, path)) {
+        return inner.getFileContents(space, resource, options)
+      }
+      const engine = await resolveFolderVault(useExtensionRegistry(), space, path)
+      if (!engine) {
+        return inner.getFileContents(space, resource, options)
+      }
+      // Fetch the ciphertext blob as raw bytes, run it through the engine, then
+      // hand the caller back the response type it actually asked for (text by
+      // default) - exactly as if it had read a plain file.
+      const result = await inner.getFileContents(
+        space,
+        { ...resource, path: await encryptVaultPath(engine, path) },
+        { ...options, responseType: 'arraybuffer' }
+      )
+      const plaintext = new Uint8Array(
+        await streamToArrayBuffer(engine.decryptContent(new Blob([result.body]).stream()))
+      )
+      const responseType = options.responseType
+      let body: unknown
+      if (!responseType || responseType === 'text') {
+        body = new TextDecoder().decode(plaintext)
+      } else if (responseType === 'json') {
+        body = JSON.parse(new TextDecoder().decode(plaintext))
+      } else if (responseType === 'blob') {
+        body = new Blob([plaintext])
+      } else {
+        body = plaintext.buffer
+      }
+      return { ...result, body }
+    },
+
+    async putFileContents(space, options) {
+      const path = options?.path
+      const claim = path && getVaultClaim(useExtensionRegistry(), space, path)
+      if (!claim) {
+        return inner.putFileContents(space, options)
+      }
+      const engine = await resolveFolderVault(useExtensionRegistry(), space, path)
+      if (!engine) {
+        // Fail closed: writing clear-text content/name into a locked vault would
+        // corrupt it. Unreachable through the UI (the unlock gate runs first).
+        throw new Error(`Refusing to write into the locked vault "${claim.vaultRoot}"`)
+      }
+      // Encrypt the content (always - even empty content has to become a valid
+      // rclone-crypt blob with header bytes, or it won't decrypt later) and the
+      // path before the PUT, then decrypt the resource that comes back.
+      const content = await streamToArrayBuffer(
+        engine.encryptContent(new Blob([options.content ?? '']).stream())
+      )
+      const result = await inner.putFileContents(space, {
+        ...options,
+        path: await encryptVaultPath(engine, path),
+        content
+      })
+      await fromServer(space, [result])
+      return result
+    }
+  }
+}
diff --git a/packages/web-pkg/src/services/folder/folderService.ts b/packages/web-pkg/src/services/folder/folderService.ts
index 7c86283cf9f..5c04bec2575 100644
--- a/packages/web-pkg/src/services/folder/folderService.ts
+++ b/packages/web-pkg/src/services/folder/folderService.ts
@@ -17,8 +17,8 @@ import {
   useSharesStore,
   useAuthService,
   AuthServiceInterface,
-  useExtensionRegistry,
-  ExtensionRegistry
+  ExtensionRegistry,
+  useExtensionRegistry
 } from '../../composables'
 import { unref } from 'vue'
 import { ClientService } from '../../services'
diff --git a/packages/web-pkg/src/services/folder/loaders/loaderFavorites.ts b/packages/web-pkg/src/services/folder/loaders/loaderFavorites.ts
index 5d169837d3f..696440bce5c 100644
--- a/packages/web-pkg/src/services/folder/loaders/loaderFavorites.ts
+++ b/packages/web-pkg/src/services/folder/loaders/loaderFavorites.ts
@@ -3,6 +3,8 @@ import { Router } from 'vue-router'
 import { useTask } from 'vue-concurrency'
 import { isLocationCommonActive } from '../../../router'
 import { unref } from 'vue'
+import { Resource } from '@opencloud-eu/web-client'
+import { getVaultClaim, markVaultStatus } from '../../../helpers/folderVault'
 
 export class FolderLoaderFavorites implements FolderLoader {
   public isEnabled(): boolean {
@@ -18,7 +20,9 @@ export class FolderLoaderFavorites implements FolderLoader {
   }
 
   public getTask(context: TaskContext): FolderLoaderTask {
-    const { resourcesStore, clientService } = context
+    const { resourcesStore, clientService, spacesStore, extensionRegistry } = context
+
+    const findSpaceById = (storageId: string) => spacesStore.spaces.find((s) => s.id === storageId)
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     return useTask(function* (signal1, signal2) {
@@ -30,7 +34,28 @@ export class FolderLoaderFavorites implements FolderLoader {
         signal: signal1
       })
 
-      resourcesStore.initResourceList({ currentFolder: null, resources })
+      // Favorites lists results from webdav.search, and the vault-aware webdav
+      // client does NOT wrap search - so these resources arrive raw, without the
+      // decrypt + isInVault flag a normal folder listing gets. Same policy as
+      // useSearch:
+      //   - drop encrypted vault *content* (ciphertext name, useless to show and
+      //     unmatchable), but
+      //   - KEEP the vault *root* (clear-text name, so users can find/favorite
+      //     their vault) and flag it so the share/copy/move guards engage and it
+      //     can't be public-linked or copied out from here.
+      const visible = (resources as Resource[]).filter((resource) => {
+        const space = findSpaceById(resource.storageId)
+        const claim = space ? getVaultClaim(extensionRegistry, space, resource.path) : null
+        return !claim?.encryptsNames || claim.vaultRoot === resource.path
+      })
+      for (const resource of visible) {
+        const space = findSpaceById(resource.storageId)
+        if (space) {
+          markVaultStatus(extensionRegistry, space, [resource])
+        }
+      }
+
+      resourcesStore.initResourceList({ currentFolder: null, resources: visible })
     })
   }
 }
diff --git a/packages/web-pkg/src/services/folder/loaders/loaderSpace.ts b/packages/web-pkg/src/services/folder/loaders/loaderSpace.ts
index 39f00fe0231..1c14bfc5b21 100644
--- a/packages/web-pkg/src/services/folder/loaders/loaderSpace.ts
+++ b/packages/web-pkg/src/services/folder/loaders/loaderSpace.ts
@@ -16,11 +16,6 @@ import { DriveItem } from '@opencloud-eu/web-client/graph/generated'
 import { isLocationSpacesActive, isLocationPublicActive } from '../../../router'
 import { getSharedDriveItem, setCurrentUserShareSpacePermissions } from '../../../helpers'
 import { useFileRouteReplace } from '../../../composables'
-import {
-  decryptResourceInPlace,
-  markVaultStatus,
-  resolveFolderVault
-} from '../../../helpers/folderVault'
 import { DavProperties, DavProperty } from '@opencloud-eu/web-client/webdav'
 
 export class FolderLoaderSpace implements FolderLoader {
@@ -47,8 +42,7 @@ export class FolderLoaderSpace implements FolderLoader {
       authService,
       spacesStore,
       sharesStore,
-      configStore,
-      extensionRegistry
+      configStore
     } = context
     const { webdav, graphAuthenticated: graphClient } = clientService
     const { replaceInvalidFileRoute } = useFileRouteReplace({ router })
@@ -70,40 +64,11 @@ export class FolderLoaderSpace implements FolderLoader {
           davProperties.push(DavProperty.DownloadURL)
         }
 
-        // FIXME(poc-vault): vault-aware path encryption belongs on a higher
-        // layer (folderService / a FolderLoader decorator). Keeping it inline
-        // here for the rclone-crypt PoC.
-        const vaultEngine = resolveFolderVault(extensionRegistry, space, path)
-        const effectivePath = vaultEngine ? yield* call(vaultEngine.encryptPath(path)) : path
-
         // eslint-disable-next-line prefer-const
         let { resource: currentFolder, children: resources } = yield* call(
-          webdav.listFiles(
-            space,
-            { path: effectivePath, fileId },
-            { signal: signal1, davProperties }
-          )
+          webdav.listFiles(space, { path, fileId }, { signal: signal1, davProperties })
         )
 
-        // FIXME(poc-vault): decrypt server-side names before anything else
-        // touches the resources, so the rest of the loader sees clear text.
-        // Run parent + children in parallel — decryptResourceInPlace mutates
-        // only the resource it's given and has no shared state, so listings
-        // of N items finish in ~one decrypt round-trip instead of N.
-        if (vaultEngine) {
-          yield* call(
-            Promise.all([
-              decryptResourceInPlace(vaultEngine, currentFolder),
-              ...resources.map((r) => decryptResourceInPlace(vaultEngine, r))
-            ])
-          )
-        }
-        // Mark vault-root resources surfaced in a parent listing too (no
-        // engine resolves against the parent path, so decryptResourceInPlace
-        // wouldn't fire on them). isInVault stays the canonical guard for
-        // action visibility downstream.
-        markVaultStatus(extensionRegistry, space, [currentFolder, ...resources])
-
         // if current folder has no id (= singe file public link) we must not correct the route
         if (currentFolder.id) {
           replaceInvalidFileRoute({ space, resource: currentFolder, path, fileId })
diff --git a/packages/web-pkg/src/services/uppy/uppyService.ts b/packages/web-pkg/src/services/uppy/uppyService.ts
index b4785369f9f..5ce1fc91699 100644
--- a/packages/web-pkg/src/services/uppy/uppyService.ts
+++ b/packages/web-pkg/src/services/uppy/uppyService.ts
@@ -68,6 +68,30 @@ export type OcUppyMeta = {
   isFolder: boolean
 }
 export type OcUppyBody = Body
+
+// Meta fields safe to put in the tus `Upload-Metadata` header. Deliberately
+// EXCLUDES the path-revealing fields (currentFolder, relativeFolder,
+// relativePath, routeDriveAliasAndItem) so a folder-vault upload never leaks the
+// cleartext directory structure to the server. Keep this in sync with OcUppyMeta:
+// a new field stays out of the header (fail-closed) until added here on purpose.
+export const TUS_ALLOWED_META_FIELDS: (keyof OcUppyMeta)[] = [
+  'name',
+  'mtime',
+  'spaceId',
+  'spaceName',
+  'driveAlias',
+  'driveType',
+  'currentFolderId',
+  'fileId',
+  'uppyId',
+  'tusEndpoint',
+  'uploadId',
+  'topLevelFolderId',
+  'routeName',
+  'routeShareId',
+  'isFolder'
+]
+
 export type OcUppyFile = UppyFile<OcUppyMeta, OcUppyBody>
 type OcUppyPlugin = typeof BasePlugin<any, OcUppyMeta, OcUppyBody>
 export type OcMinimalUppyFile = MinimalRequiredUppyFile<OcUppyMeta, OcUppyBody>
@@ -165,6 +189,16 @@ export class UppyService {
       uploadDataDuringCreation,
       limit: 5,
       headers,
+      // Allowlist which meta fields go into the `Upload-Metadata` header.
+      // Without this, @uppy/tus defaults to sending *all* of file.meta, which
+      // for a folder-vault upload would leak the cleartext directory structure
+      // (currentFolder / relativeFolder / relativePath / routeDriveAliasAndItem)
+      // to the server even though the endpoint path itself is ciphertext. The
+      // server gets everything it needs from the endpoint (path) and headers
+      // (mtime / auth), so metadata is client bookkeeping; we send only the
+      // non-path-revealing fields. Allowlisting (not denylisting) keeps this
+      // fail-closed: a new meta field is not leaked until it is explicitly added.
+      allowedMetaFields: TUS_ALLOWED_META_FIELDS,
       onBeforeRequest,
       onShouldRetry: (err, retryAttempt, options, next) => {
         // status code 5xx means the upload is gone on the server side
diff --git a/packages/web-pkg/tests/unit/components/sidebar/FileSideBar.spec.ts b/packages/web-pkg/tests/unit/components/sidebar/FileSideBar.spec.ts
index 08e94cf4c74..4071bc0dd9d 100644
--- a/packages/web-pkg/tests/unit/components/sidebar/FileSideBar.spec.ts
+++ b/packages/web-pkg/tests/unit/components/sidebar/FileSideBar.spec.ts
@@ -239,7 +239,11 @@ describe('FileSideBar', () => {
       })
 
       it('is called when resource is selected and sidebar is opened', () => {
-        const resource = mock<Resource>({ id: 'some-image', path: '/someImage.jpg' })
+        const resource = mock<Resource>({
+          id: 'some-image',
+          path: '/someImage.jpg',
+          isInVault: false
+        })
         const { mocks } = createWrapper({
           item: resource
         })
@@ -250,7 +254,11 @@ describe('FileSideBar', () => {
       })
 
       it('is not called if resource is selected and sidebar is not opened', () => {
-        const resource = mock<Resource>({ id: 'some-image', path: '/someImage.jpg' })
+        const resource = mock<Resource>({
+          id: 'some-image',
+          path: '/someImage.jpg',
+          isInVault: false
+        })
         const { mocks } = createWrapper({
           item: resource,
           isOpen: false
diff --git a/packages/web-pkg/tests/unit/composables/piniaStores/folderVault.spec.ts b/packages/web-pkg/tests/unit/composables/piniaStores/folderVault.spec.ts
new file mode 100644
index 00000000000..73c9b1b497a
--- /dev/null
+++ b/packages/web-pkg/tests/unit/composables/piniaStores/folderVault.spec.ts
@@ -0,0 +1,79 @@
+import { createPinia, setActivePinia } from 'pinia'
+import { mock } from 'vitest-mock-extended'
+import { useFolderVaultStore } from '../../../../src/composables/piniaStores/folderVault'
+import { FolderVaultEngine } from '../../../../src/composables/piniaStores/extensionRegistry'
+
+describe('useFolderVaultStore', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia())
+  })
+
+  it('stores, reads and clears an engine per (space, vault root)', () => {
+    const store = useFolderVaultStore()
+    const engine = mock<FolderVaultEngine>()
+    store.setEngine('space-1', '/my.vault', engine)
+
+    expect(store.isUnlocked('space-1', '/my.vault')).toBe(true)
+    expect(store.getEngine('space-1', '/my.vault')).toBe(engine)
+    // different space / path must not collide
+    expect(store.isUnlocked('space-2', '/my.vault')).toBe(false)
+
+    store.clearEngine('space-1', '/my.vault')
+    expect(store.isUnlocked('space-1', '/my.vault')).toBe(false)
+  })
+
+  it('keys strictly by the vault root, not by paths inside the vault', () => {
+    // The store has no notion of vault boundaries - only the extension knows
+    // where a vault starts (findVaultRoot). Callers therefore always resolve
+    // the root *before* hitting the store, so an inner path is never a key:
+    // looking one up returns "not unlocked" rather than walking up to the root.
+    const store = useFolderVaultStore()
+    const engine = mock<FolderVaultEngine>()
+    store.setEngine('space-1', '/my.vault', engine)
+
+    expect(store.isUnlocked('space-1', '/my.vault/sub/file.txt')).toBe(false)
+    expect(store.getEngine('space-1', '/my.vault/sub/file.txt')).toBeUndefined()
+    // ...the root itself, which the caller resolves to, is the actual key
+    expect(store.isUnlocked('space-1', '/my.vault')).toBe(true)
+    expect(store.getEngine('space-1', '/my.vault')).toBe(engine)
+  })
+
+  describe('method "moveEngine"', () => {
+    it('re-files an engine from the old vault root to the new one', () => {
+      const store = useFolderVaultStore()
+      const engine = mock<FolderVaultEngine>()
+      store.setEngine('space-1', '/my.vault', engine)
+
+      store.moveEngine('space-1', '/my.vault', '/archive.vault')
+
+      expect(store.isUnlocked('space-1', '/my.vault')).toBe(false)
+      expect(store.isUnlocked('space-1', '/archive.vault')).toBe(true)
+      expect(store.getEngine('space-1', '/archive.vault')).toBe(engine)
+    })
+
+    it('is a no-op when nothing is stored under the old root', () => {
+      const store = useFolderVaultStore()
+      store.moveEngine('space-1', '/my.vault', '/archive.vault')
+      expect(store.isUnlocked('space-1', '/archive.vault')).toBe(false)
+    })
+  })
+
+  describe('method "clearEnginesUnder"', () => {
+    it('evicts engines at or below the prefix but spares siblings', () => {
+      const store = useFolderVaultStore()
+      store.setEngine('space-1', '/docs.vault', mock<FolderVaultEngine>())
+      store.setEngine('space-1', '/docs.vault/nested.vault', mock<FolderVaultEngine>())
+      store.setEngine('space-1', '/docs.vault-notes', mock<FolderVaultEngine>())
+      store.setEngine('space-2', '/docs.vault', mock<FolderVaultEngine>())
+
+      store.clearEnginesUnder('space-1', '/docs.vault')
+
+      expect(store.isUnlocked('space-1', '/docs.vault')).toBe(false)
+      expect(store.isUnlocked('space-1', '/docs.vault/nested.vault')).toBe(false)
+      // sibling whose name merely starts with the prefix must survive
+      expect(store.isUnlocked('space-1', '/docs.vault-notes')).toBe(true)
+      // other space must survive
+      expect(store.isUnlocked('space-2', '/docs.vault')).toBe(true)
+    })
+  })
+})
diff --git a/packages/web-pkg/tests/unit/composables/resources/useLoadPreview.spec.ts b/packages/web-pkg/tests/unit/composables/resources/useLoadPreview.spec.ts
index 84c30d10d29..5fd0bb9bb54 100644
--- a/packages/web-pkg/tests/unit/composables/resources/useLoadPreview.spec.ts
+++ b/packages/web-pkg/tests/unit/composables/resources/useLoadPreview.spec.ts
@@ -21,7 +21,7 @@ describe('useLoadPreview', () => {
       getWrapper({
         setup: async ({ loadPreview }) => {
           const space = mock<SpaceResource>()
-          const resource = mock<Resource>()
+          const resource = mock<Resource>({ isInVault: false })
           const preview = await loadPreview({ space, resource })
           expect(preview).toEqual(loadedPreview)
         },
@@ -32,7 +32,11 @@ describe('useLoadPreview', () => {
       it('does not return a preview for a project space without spaceImageData', () => {
         getWrapper({
           setup: async ({ loadPreview }) => {
-            const space = mock<SpaceResource>({ driveType: 'project', spaceImageData: undefined })
+            const space = mock<SpaceResource>({
+              driveType: 'project',
+              isInVault: false,
+              spaceImageData: undefined
+            })
             const resource = space
             const preview = await loadPreview({ space, resource })
             expect(preview).toBe(null)
@@ -42,7 +46,11 @@ describe('useLoadPreview', () => {
       it('does not return a preview for a disabled project space', () => {
         getWrapper({
           setup: async ({ loadPreview }) => {
-            const space = mock<SpaceResource>({ driveType: 'project', disabled: true })
+            const space = mock<SpaceResource>({
+              driveType: 'project',
+              isInVault: false,
+              disabled: true
+            })
             const resource = space
             const preview = await loadPreview({ space, resource })
             expect(preview).toBe(null)
@@ -53,7 +61,11 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }) => {
             const buildSpaceImageResourceMock = vi.mocked(buildSpaceImageResource)
-            const space = mock<SpaceResource>({ driveType: 'project', disabled: false })
+            const space = mock<SpaceResource>({
+              driveType: 'project',
+              isInVault: false,
+              disabled: false
+            })
             const resource = space
             const preview = await loadPreview({ space, resource })
             expect(preview).toBeDefined()
@@ -66,6 +78,7 @@ describe('useLoadPreview', () => {
           setup: async ({ loadPreview }) => {
             const space = mock<SpaceResource>({
               driveType: 'project',
+              isInVault: false,
               disabled: false,
               spaceImageData: { id: '1' }
             })
@@ -83,7 +96,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ dimensions: ImageDimension.Thumbnail }),
@@ -98,7 +111,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ dimensions: ImageDimension.Tile }),
@@ -114,7 +127,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource, dimensions: ImageDimension.Preview })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ dimensions: ImageDimension.Preview }),
@@ -131,7 +144,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ processor: ProcessorType.enum.thumbnail }),
@@ -146,7 +159,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ processor: ProcessorType.enum.fit }),
@@ -162,7 +175,7 @@ describe('useLoadPreview', () => {
         getWrapper({
           setup: async ({ loadPreview }, { previewService }) => {
             const space = mock<SpaceResource>()
-            const resource = mock<Resource>()
+            const resource = mock<Resource>({ isInVault: false })
             await loadPreview({ space, resource, processor: ProcessorType.enum.resize })
             expect(previewService.loadPreview).toHaveBeenCalledWith(
               expect.objectContaining({ processor: ProcessorType.enum.resize }),
diff --git a/packages/web-pkg/tests/unit/helpers/folderVault.spec.ts b/packages/web-pkg/tests/unit/helpers/folderVault.spec.ts
new file mode 100644
index 00000000000..e0620e1956a
--- /dev/null
+++ b/packages/web-pkg/tests/unit/helpers/folderVault.spec.ts
@@ -0,0 +1,211 @@
+import { Resource, SpaceResource } from '@opencloud-eu/web-client'
+import { DavPermission } from '@opencloud-eu/web-client/webdav'
+import { mock } from 'vitest-mock-extended'
+import {
+  decryptResourceInPlace,
+  encryptResourcePathsForServer,
+  markVaultStatus
+} from '../../../src/helpers/folderVault'
+import {
+  ExtensionRegistry,
+  FolderVaultEngine
+} from '../../../src/composables/piniaStores/extensionRegistry'
+
+function mockExtensionRegistry(
+  claimsPath: (space: SpaceResource, path: string) => unknown
+): ExtensionRegistry {
+  return {
+    extensions: [{ type: 'folderVault', claimsPath, resolve: (): unknown => null }]
+  } as unknown as ExtensionRegistry
+}
+
+describe('markVaultStatus', () => {
+  const space = { id: 'space-1' } as SpaceResource
+
+  it('flags a vault root as in-vault but keeps its Shareable permission', () => {
+    const registry = mockExtensionRegistry((_space, path) =>
+      path.startsWith('/my.vault') ? { vaultRoot: '/my.vault', unlockRoute: {} } : null
+    )
+    const root = { path: '/my.vault', isFolder: true, permissions: 'RDNVWZP' } as Resource
+
+    markVaultStatus(registry, space, [root])
+
+    expect(root.isInVault).toBe(true)
+    // A vault root stays collaborator-shareable (Shareable kept); only public
+    // links are blocked, and that is gated on `isInVault` in the link UI, not
+    // by stripping the permission here.
+    expect(root.permissions).toContain(DavPermission.Shareable)
+    expect(root.permissions).toBe('RDNVWZP')
+  })
+
+  it('strips Shareable from vault content (anything below the root)', () => {
+    const registry = mockExtensionRegistry((_space, path) =>
+      path.startsWith('/my.vault') ? { vaultRoot: '/my.vault', encryptsNames: true } : null
+    )
+    const content = { path: '/my.vault/secret.txt', permissions: 'RDNVWZP' } as Resource
+
+    markVaultStatus(registry, space, [content])
+
+    expect(content.isInVault).toBe(true)
+    // content can't be claimed once a share rebases the path -> never shareable
+    expect(content.permissions).not.toContain(DavPermission.Shareable)
+    expect(content.permissions).toBe('DNVWZP')
+  })
+
+  it('leaves resources outside any vault untouched', () => {
+    const registry = mockExtensionRegistry(() => null)
+    const resource = { path: '/regular-folder', permissions: 'RDNVWZP' } as Resource
+
+    markVaultStatus(registry, space, [resource])
+
+    expect(resource.isInVault).toBeFalsy()
+    expect(resource.permissions).toBe('RDNVWZP')
+  })
+
+  it('handles a root vault "/" (directly-shared vault): keeps the root, strips content', () => {
+    // A directly-shared vault claims vaultRoot "/"; the whole share space is the
+    // vault. The root "/" keeps Shareable, content below it is stripped.
+    const registry = mockExtensionRegistry(() => ({ vaultRoot: '/', encryptsNames: true }))
+    const root = { path: '/', isFolder: true, permissions: 'RDNVWZP' } as Resource
+    const content = { path: '/sub/file.txt', permissions: 'RDNVWZP' } as Resource
+
+    markVaultStatus(registry, space, [root, content])
+
+    expect(root.isInVault).toBe(true)
+    expect(root.permissions).toBe('RDNVWZP')
+    expect(content.isInVault).toBe(true)
+    expect(content.permissions).toBe('DNVWZP')
+  })
+
+  it('ignores resources without a path', () => {
+    const registry = mockExtensionRegistry(() => ({ unlockRoute: {} }))
+    const resource = { permissions: 'RDNVWZP' } as Resource
+
+    markVaultStatus(registry, space, [resource])
+
+    expect(resource.isInVault).toBeFalsy()
+    expect(resource.permissions).toBe('RDNVWZP')
+  })
+
+  it('does not treat a *file* whose name ends in .vault as a vault root', () => {
+    // `.vault`-suffix detection would otherwise mis-flag a plain file.
+    const registry = mockExtensionRegistry((_space, path) =>
+      path === '/report.vault' ? { vaultRoot: '/report.vault', encryptsNames: true } : null
+    )
+    const file = {
+      path: '/report.vault',
+      type: 'file',
+      isFolder: false,
+      permissions: 'RDNVWZP'
+    } as Resource
+
+    markVaultStatus(registry, space, [file])
+
+    expect(file.isInVault).toBeFalsy()
+  })
+
+  it('still flags a folder vault root detected by name suffix', () => {
+    const registry = mockExtensionRegistry((_space, path) =>
+      path === '/docs.vault' ? { vaultRoot: '/docs.vault', encryptsNames: true } : null
+    )
+    const folder = {
+      path: '/docs.vault',
+      type: 'folder',
+      isFolder: true,
+      permissions: 'RDNVWZP'
+    } as Resource
+
+    markVaultStatus(registry, space, [folder])
+
+    expect(folder.isInVault).toBe(true)
+  })
+})
+
+describe('encryptResourcePathsForServer', () => {
+  const space = { id: 'space-1' } as SpaceResource
+
+  function registryResolving(engine: FolderVaultEngine | null): ExtensionRegistry {
+    return {
+      extensions: [
+        {
+          type: 'folderVault',
+          claimsPath: (): unknown => null,
+          resolve: (_s: SpaceResource, path: string): Promise<FolderVaultEngine | null> =>
+            Promise.resolve(path.startsWith('/v.vault') ? engine : null)
+        }
+      ]
+    } as unknown as ExtensionRegistry
+  }
+
+  it('encrypts in-vault resource paths and leaves the originals + non-vault paths untouched', async () => {
+    const engine = mock<FolderVaultEngine>({ vaultRoot: '/v.vault' })
+    // the engine sees the vault-RELATIVE path; encryptVaultPath re-roots it
+    engine.encryptPath.mockImplementation((rel: string) => Promise.resolve(`ENC(${rel})`))
+    const registry = registryResolving(engine)
+
+    const inVault = { id: '1', path: '/v.vault/secret.txt' } as Resource
+    const outside = { id: '2', path: '/normal.txt' } as Resource
+
+    const [a, b] = await encryptResourcePathsForServer(registry, space, [inVault, outside])
+
+    expect(a.path).toBe('/v.vault/ENC(secret.txt)')
+    expect(b.path).toBe('/normal.txt')
+    // the store-held originals must not be mutated (UI keeps the clear-text path)
+    expect(inVault.path).toBe('/v.vault/secret.txt')
+  })
+
+  it('returns resources unchanged when the vault is locked (no engine)', async () => {
+    const registry = registryResolving(null)
+    const inVault = { id: '1', path: '/v.vault/secret.txt' } as Resource
+
+    const [a] = await encryptResourcePathsForServer(registry, space, [inVault])
+
+    expect(a.path).toBe('/v.vault/secret.txt')
+  })
+})
+
+describe('decryptResourceInPlace', () => {
+  it('isolates a decryption failure so one bad blob does not break the listing', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    const engine = mock<FolderVaultEngine>({ vaultRoot: '/my.vault' })
+    engine.decryptPath.mockRejectedValue(new Error('not a valid rclone-crypt name'))
+    const resource = {
+      path: '/my.vault/CIPHERTEXTBLOB',
+      name: 'CIPHERTEXTBLOB',
+      permissions: 'RDNVWZP'
+    } as Resource
+
+    // must resolve (not reject) so the caller's Promise.all survives
+    const result = await decryptResourceInPlace(engine, resource)
+
+    expect(result).toBe(resource)
+    // still flagged even though decryption failed (share-gating is applied by
+    // the markVaultStatus pass that always follows, not here)
+    expect(resource.isInVault).toBe(true)
+    // keeps the ciphertext name rather than crashing the load
+    expect(resource.name).toBe('CIPHERTEXTBLOB')
+  })
+
+  it('rewrites path / name / extension to the cleartext form on success', async () => {
+    const engine = mock<FolderVaultEngine>({ vaultRoot: '/my.vault' })
+    // the engine returns the vault-RELATIVE clear path; decryptVaultPath re-roots it
+    engine.decryptPath.mockResolvedValue('secret.txt')
+    const resource = {
+      path: '/my.vault/CIPHERTEXTBLOB',
+      name: 'CIPHERTEXTBLOB',
+      type: 'file',
+      mimeType: 'application/octet-stream',
+      permissions: 'RDNVWZP'
+    } as Resource
+
+    await decryptResourceInPlace(engine, resource)
+
+    expect(resource.path).toBe('/my.vault/secret.txt')
+    expect(resource.name).toBe('secret.txt')
+    expect(resource.isInVault).toBe(true)
+    // mime re-derived from the recovered cleartext extension
+    expect(resource.mimeType).toBe('text/plain')
+    // share-gating is markVaultStatus' job now, not decryptResourceInPlace's
+    expect(resource.permissions).toBe('RDNVWZP')
+  })
+})
diff --git a/packages/web-pkg/tests/unit/helpers/vaultEngine.spec.ts b/packages/web-pkg/tests/unit/helpers/vaultEngine.spec.ts
new file mode 100644
index 00000000000..efcc2aba1ce
--- /dev/null
+++ b/packages/web-pkg/tests/unit/helpers/vaultEngine.spec.ts
@@ -0,0 +1,48 @@
+import { FolderVaultEngine } from '../../../src/composables/piniaStores/extensionRegistry'
+import { decryptVaultPath, encryptVaultPath } from '../../../src/helpers/vaultEngine'
+
+// A fake engine that just wraps the relative path it receives, so the tests
+// assert the generic vault-root <-> full-path conversion, not any real crypto.
+function fakeEngine(vaultRoot: string): FolderVaultEngine {
+  return {
+    vaultRoot,
+    encryptPath: (relative) => Promise.resolve(`E(${relative})`),
+    decryptPath: (relative) => Promise.resolve(`D(${relative})`),
+    encryptContent: (s) => s,
+    decryptContent: (s) => s,
+    verifyKey: () => Promise.resolve(true)
+  }
+}
+
+describe('encryptVaultPath / decryptVaultPath', () => {
+  it('strips the vault root, hands the WHOLE relative path to the engine, re-roots the result', async () => {
+    const engine = fakeEngine('/my.vault')
+
+    // the engine sees "sub/x" (the whole relative path, not split into segments)
+    expect(await encryptVaultPath(engine, '/my.vault/sub/x')).toBe('/my.vault/E(sub/x)')
+    expect(await decryptVaultPath(engine, '/my.vault/sub/x')).toBe('/my.vault/D(sub/x)')
+  })
+
+  it('handles the root vault "/" (whole space is the vault) without a double slash', async () => {
+    const engine = fakeEngine('/')
+
+    const encrypted = await encryptVaultPath(engine, '/sub/x')
+    expect(encrypted).toBe('/E(sub/x)')
+    expect(encrypted).not.toContain('//')
+    expect(await decryptVaultPath(engine, '/enc/x')).toBe('/D(enc/x)')
+  })
+
+  it('hands the engine the identical relative path for an owner and a share-root vault', async () => {
+    // owner `/my.vault/sub/x` and receiver `/sub/x` both reduce to "sub/x", which
+    // is what makes the receiver decrypt the owner's blobs (same key + relative).
+    expect(await encryptVaultPath(fakeEngine('/my.vault'), '/my.vault/sub/x')).toBe(
+      '/my.vault/E(sub/x)'
+    )
+    expect(await encryptVaultPath(fakeEngine('/'), '/sub/x')).toBe('/E(sub/x)')
+  })
+
+  it('leaves the vault root itself untouched, without calling the engine', async () => {
+    expect(await encryptVaultPath(fakeEngine('/my.vault'), '/my.vault')).toBe('/my.vault')
+    expect(await encryptVaultPath(fakeEngine('/'), '/')).toBe('/')
+  })
+})
diff --git a/packages/web-pkg/tests/unit/services/client.spec.ts b/packages/web-pkg/tests/unit/services/client.spec.ts
index 7e9b2cbff76..24a40d33956 100644
--- a/packages/web-pkg/tests/unit/services/client.spec.ts
+++ b/packages/web-pkg/tests/unit/services/client.spec.ts
@@ -123,7 +123,10 @@ describe('ClientService', () => {
       const webDavSpy = vi.mocked(webdav).mockReturnValue(webDavMock)
       const clientService = getClientServiceMock()
       expect(webDavSpy).toHaveBeenCalledWith(serverUrl, expect.anything())
-      expect(clientService.webdav).toEqual(webDavMock)
+      // the raw client is wrapped by the vault-aware decorator before it's
+      // exposed, so it's no longer identical to the bare factory result
+      expect(clientService.webdav).toBeDefined()
+      expect(clientService.webdav.listFiles).toBeInstanceOf(Function)
     })
   })
 })
diff --git a/packages/web-pkg/tests/unit/services/client/vaultWebDav.spec.ts b/packages/web-pkg/tests/unit/services/client/vaultWebDav.spec.ts
new file mode 100644
index 00000000000..18a6b889e89
--- /dev/null
+++ b/packages/web-pkg/tests/unit/services/client/vaultWebDav.spec.ts
@@ -0,0 +1,293 @@
+import { SpaceResource } from '@opencloud-eu/web-client'
+import { WebDAV } from '@opencloud-eu/web-client/webdav'
+import { createVaultWebDav } from '../../../../src/services/client/vaultWebDav'
+import {
+  decryptResourceInPlace,
+  getVaultClaim,
+  markVaultStatus,
+  resolveFolderVault
+} from '../../../../src/helpers/folderVault'
+
+vi.mock('../../../../src/composables/piniaStores/extensionRegistry', () => ({
+  useExtensionRegistry: vi.fn(() => ({}))
+}))
+vi.mock('../../../../src/helpers/folderVault', () => ({
+  getVaultClaim: vi.fn(),
+  resolveFolderVault: vi.fn(),
+  decryptResourceInPlace: vi.fn((_engine, r) => Promise.resolve(r)),
+  markVaultStatus: vi.fn()
+}))
+
+const space = { id: 'space-1' } as SpaceResource
+
+// A claim exists for any path that sits inside a "*.vault" segment; the root is
+// the path up to and including that segment (mirrors the real findVaultRoot).
+function vaultRootOf(path: string): string | null {
+  const segments = path.split('/').filter(Boolean)
+  const idx = segments.findIndex((s) => s.endsWith('.vault'))
+  return idx === -1 ? null : '/' + segments.slice(0, idx + 1).join('/')
+}
+
+function fakeEngine(vaultRoot: string) {
+  return {
+    vaultRoot,
+    encryptPath: vi.fn((p: string) => Promise.resolve(`ENC(${p})`))
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.mocked(getVaultClaim).mockImplementation((_r, _s, path) => {
+    const root = vaultRootOf(path ?? '')
+    return root ? ({ vaultRoot: root, encryptsNames: true } as any) : null
+  })
+  vi.mocked(decryptResourceInPlace).mockImplementation((_engine, r) => Promise.resolve(r))
+})
+
+function makeInner(overrides: Partial<WebDAV> = {}): WebDAV {
+  return {
+    listFiles: vi.fn().mockResolvedValue({ resource: undefined, children: [] }),
+    getFileInfo: vi.fn().mockResolvedValue(undefined),
+    createFolder: vi.fn().mockResolvedValue(undefined),
+    deleteFile: vi.fn().mockResolvedValue(undefined),
+    moveFiles: vi.fn().mockResolvedValue(undefined),
+    copyFiles: vi.fn().mockResolvedValue(undefined),
+    restoreFileVersion: vi.fn().mockResolvedValue(undefined),
+    getFileContents: vi.fn(),
+    search: vi.fn(),
+    registerExtraProp: vi.fn(),
+    ...overrides
+  } as unknown as WebDAV
+}
+
+describe('createVaultWebDav', () => {
+  describe('non-vault paths (pass-through)', () => {
+    it('does not encrypt the path or resolve an engine for listFiles', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner({
+        listFiles: vi
+          .fn()
+          .mockResolvedValue({ resource: { path: '/regular' }, children: [{ path: '/regular/a' }] })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.listFiles(space, { path: '/regular' })
+
+      expect(inner.listFiles).toHaveBeenCalledWith(space, { path: '/regular' }, undefined)
+      expect(resolveFolderVault).not.toHaveBeenCalled()
+      expect(decryptResourceInPlace).not.toHaveBeenCalled()
+    })
+
+    it('leaves non-wrapped methods as the inner implementation', () => {
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+      // search / registerExtraProp are not wrapped
+      expect(dav.search).toBe(inner.search)
+      expect(dav.registerExtraProp).toBe(inner.registerExtraProp)
+    })
+  })
+
+  describe('vault paths (unlocked)', () => {
+    it('encrypts the listFiles path and decrypts the returned resources', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner({
+        listFiles: vi.fn().mockResolvedValue({
+          resource: { path: '/my.vault' },
+          children: [{ path: '/my.vault/enc1' }, { path: '/my.vault/enc2' }]
+        })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.listFiles(space, { path: '/my.vault' })
+
+      // the vault root maps to an empty relative path, so it stays clear text
+      expect(inner.listFiles).toHaveBeenCalledWith(space, { path: '/my.vault' }, undefined)
+      // resource + both children decrypted on the way back
+      expect(decryptResourceInPlace).toHaveBeenCalledTimes(3)
+      expect(markVaultStatus).toHaveBeenCalledTimes(1)
+    })
+
+    it('encrypts the getFileInfo path and decrypts the single result', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner({
+        getFileInfo: vi.fn().mockResolvedValue({ path: '/my.vault/enc1' })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.getFileInfo(space, { path: '/my.vault/hello.txt' })
+
+      expect(inner.getFileInfo).toHaveBeenCalledWith(
+        space,
+        { path: '/my.vault/ENC(hello.txt)' },
+        undefined
+      )
+      expect(decryptResourceInPlace).toHaveBeenCalledTimes(1)
+    })
+
+    it('encrypts the createFolder path and decrypts the result', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner({
+        createFolder: vi.fn().mockResolvedValue({ path: '/my.vault/enc1' })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.createFolder(space, { path: '/my.vault/new folder' })
+
+      expect(inner.createFolder).toHaveBeenCalledWith(space, { path: '/my.vault/ENC(new folder)' })
+      expect(decryptResourceInPlace).toHaveBeenCalledTimes(1)
+    })
+
+    it('encrypts both source and target paths for moveFiles', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await dav.moveFiles(space, { path: '/my.vault/a' }, space, { path: '/my.vault/b' })
+
+      expect(inner.moveFiles).toHaveBeenCalledWith(
+        space,
+        { path: '/my.vault/ENC(a)' },
+        space,
+        { path: '/my.vault/ENC(b)' },
+        undefined
+      )
+    })
+
+    it('encrypts the deleteFile path', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await dav.deleteFile(space, { path: '/my.vault/gone.txt' })
+
+      expect(inner.deleteFile).toHaveBeenCalledWith(space, { path: '/my.vault/ENC(gone.txt)' })
+    })
+
+    it('encrypts the restoreFileVersion target path', async () => {
+      const engine = fakeEngine('/my.vault')
+      vi.mocked(resolveFolderVault).mockResolvedValue(engine as any)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await dav.restoreFileVersion(space, { path: '/my.vault/f.txt', parentFolderId: 'p' }, 'v1')
+
+      expect(inner.restoreFileVersion).toHaveBeenCalledWith(
+        space,
+        { path: '/my.vault/ENC(f.txt)', parentFolderId: 'p' },
+        'v1',
+        undefined
+      )
+    })
+
+    it('resolves each vault engine once for a listing spanning multiple vaults', async () => {
+      vi.mocked(resolveFolderVault).mockImplementation((_r, _s, path) =>
+        Promise.resolve(fakeEngine(path as string) as any)
+      )
+      const inner = makeInner({
+        listFiles: vi.fn().mockResolvedValue({
+          resource: { path: '/trash' },
+          children: [
+            { path: '/a.vault/x' },
+            { path: '/a.vault/y' },
+            { path: '/b.vault/z' },
+            { path: '/plain/file' }
+          ]
+        })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.listFiles(space, {})
+
+      // two distinct vault roots -> two resolves, each by its clear-text root
+      expect(resolveFolderVault).toHaveBeenCalledTimes(2)
+      expect(resolveFolderVault).toHaveBeenCalledWith(expect.anything(), space, '/a.vault')
+      expect(resolveFolderVault).toHaveBeenCalledWith(expect.anything(), space, '/b.vault')
+      // the three in-vault resources get decrypted, the plain one does not
+      expect(decryptResourceInPlace).toHaveBeenCalledTimes(3)
+    })
+  })
+
+  describe('vault paths (locked)', () => {
+    it('leaves the path unencrypted and only flags vault status when no engine resolves', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner({
+        listFiles: vi.fn().mockResolvedValue({
+          resource: { path: '/my.vault' },
+          children: [{ path: '/my.vault/enc1' }]
+        })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.listFiles(space, { path: '/my.vault' })
+
+      // locked: can't encrypt, path goes out untouched
+      expect(inner.listFiles).toHaveBeenCalledWith(space, { path: '/my.vault' }, undefined)
+      // locked: nothing to decrypt with, but vault status is still flagged
+      expect(decryptResourceInPlace).not.toHaveBeenCalled()
+      expect(markVaultStatus).toHaveBeenCalledTimes(1)
+    })
+
+    it('still lets the vault root itself be created without an engine', async () => {
+      // Creating the vault folder is how a vault comes into existence - its
+      // clear-text root name needs no key, so this must NOT fail closed.
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner({
+        createFolder: vi.fn().mockResolvedValue({ path: '/my.vault' })
+      } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await dav.createFolder(space, { path: '/my.vault' })
+
+      expect(inner.createFolder).toHaveBeenCalledWith(space, { path: '/my.vault' })
+    })
+
+    it('refuses to create a folder in a locked vault (fail closed)', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await expect(dav.createFolder(space, { path: '/my.vault/new' })).rejects.toThrow(
+        /locked vault/
+      )
+      expect(inner.createFolder).not.toHaveBeenCalled()
+    })
+
+    it('refuses to move a path into/out of a locked vault (fail closed)', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await expect(
+        dav.moveFiles(space, { path: '/my.vault/a' }, space, { path: '/my.vault/b' })
+      ).rejects.toThrow(/locked vault/)
+      expect(inner.moveFiles).not.toHaveBeenCalled()
+    })
+
+    it('refuses to delete a path in a locked vault (fail closed)', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner()
+      const dav = createVaultWebDav(inner)
+
+      await expect(dav.deleteFile(space, { path: '/my.vault/gone.txt' })).rejects.toThrow(
+        /locked vault/
+      )
+      expect(inner.deleteFile).not.toHaveBeenCalled()
+    })
+
+    it('refuses to write content into a locked vault (fail closed)', async () => {
+      vi.mocked(resolveFolderVault).mockResolvedValue(null)
+      const inner = makeInner({ putFileContents: vi.fn() } as Partial<WebDAV>)
+      const dav = createVaultWebDav(inner)
+
+      await expect(
+        dav.putFileContents(space, { path: '/my.vault/f.txt', content: 'secret' })
+      ).rejects.toThrow(/locked vault/)
+      expect(inner.putFileContents).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/packages/web-runtime/src/container/bootstrap.ts b/packages/web-runtime/src/container/bootstrap.ts
index 9982c7557f7..541ac5264e8 100644
--- a/packages/web-runtime/src/container/bootstrap.ts
+++ b/packages/web-runtime/src/container/bootstrap.ts
@@ -861,7 +861,6 @@ export const registerSSEEventListeners = ({
   configStore,
   userStore,
   authStore,
-  extensionRegistry,
   router
 }: {
   language: Language
@@ -874,7 +873,6 @@ export const registerSSEEventListeners = ({
   configStore: ConfigStore
   userStore: UserStore
   authStore: AuthStore
-  extensionRegistry: ExtensionRegistry
   router: Router
 }): void => {
   const resourceQueue = new PQueue({
@@ -897,7 +895,6 @@ export const registerSSEEventListeners = ({
     configStore,
     clientService,
     previewService,
-    extensionRegistry,
     language,
     router,
     resourceQueue,
diff --git a/packages/web-runtime/src/container/sse/files.ts b/packages/web-runtime/src/container/sse/files.ts
index d161e03cb78..0f2386c557b 100644
--- a/packages/web-runtime/src/container/sse/files.ts
+++ b/packages/web-runtime/src/container/sse/files.ts
@@ -1,10 +1,7 @@
 import {
   createFileRouteOptions,
-  decryptResourceInPlace,
   ImageDimension,
-  isItemInCurrentFolder,
-  markVaultStatus,
-  resolveFolderVault
+  isItemInCurrentFolder
 } from '@opencloud-eu/web-pkg'
 import { SSEEventOptions } from './types'
 
@@ -79,7 +76,6 @@ export const onSSEProcessingFinishedEvent = async ({
   resourcesStore,
   spacesStore,
   clientService,
-  extensionRegistry,
   resourceQueue,
   previewService
 }: SSEEventOptions) => {
@@ -105,20 +101,14 @@ export const onSSEProcessingFinishedEvent = async ({
     }
 
     return resourceQueue.add(async () => {
-      const { resource: fetched } = await clientService.webdav.listFiles(space, {
+      const { resource } = await clientService.webdav.listFiles(space, {
         path: '',
         fileId: sseData.itemid
       })
 
       // check again for the current folder in case the user has navigated away in the meantime
       if (isItemInCurrentFolder({ resourcesStore, parentFolderId: sseData.parentitemid })) {
-        const currentFolderPath = resourcesStore.currentFolder?.path
-        const vaultEngine = resolveFolderVault(extensionRegistry, space, currentFolderPath)
-        if (vaultEngine) {
-          await decryptResourceInPlace(vaultEngine, fetched)
-        }
-        markVaultStatus(extensionRegistry, space, [fetched])
-        resourcesStore.upsertResource(fetched)
+        resourcesStore.upsertResource(resource)
       }
     })
   }
@@ -138,14 +128,6 @@ export const onSSEProcessingFinishedEvent = async ({
     path: '',
     fileId: sseData.itemid
   })
-  // The webdav response describes the encrypted server blob; if the existing
-  // resource is inside a vault, decrypt the incoming update before merging it
-  // back into the store so the editor / file list stay on cleartext data.
-  const vaultEngine = resolveFolderVault(extensionRegistry, space, resource.path)
-  if (vaultEngine) {
-    await decryptResourceInPlace(vaultEngine, updatedResource)
-  }
-  markVaultStatus(extensionRegistry, space, [updatedResource])
   resourcesStore.upsertResource(updatedResource)
 
   const preview = await previewService.loadPreview({
diff --git a/packages/web-runtime/src/container/sse/types.ts b/packages/web-runtime/src/container/sse/types.ts
index 72d20860b09..eb7e65a8336 100644
--- a/packages/web-runtime/src/container/sse/types.ts
+++ b/packages/web-runtime/src/container/sse/types.ts
@@ -3,7 +3,6 @@ import {
   AuthStore,
   ClientService,
   ConfigStore,
-  ExtensionRegistry,
   MessageStore,
   PreviewService,
   ResourcesStore,
@@ -37,7 +36,6 @@ export interface SSEEventOptions {
   authStore: AuthStore
   clientService: ClientService
   previewService: PreviewService
-  extensionRegistry: ExtensionRegistry
   router: Router
   language: Language
   resourceQueue: PQueue
diff --git a/packages/web-runtime/src/index.ts b/packages/web-runtime/src/index.ts
index 66716dc9741..0b366583256 100644
--- a/packages/web-runtime/src/index.ts
+++ b/packages/web-runtime/src/index.ts
@@ -212,7 +212,6 @@ export const bootstrapApp = async (configurationPath: string, appsReadyCallback:
           previewService,
           configStore,
           authStore,
-          extensionRegistry,
           router
         })
       }
diff --git a/packages/web-runtime/src/router/setupVaultUnlockGuard.ts b/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
index 78c20078ae3..f91b92ec279 100644
--- a/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
+++ b/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
@@ -15,7 +15,7 @@ import {
  *
  * Runs after `setupAuthGuard`, so by the time we get here the auth context
  * is ready and the spaces store is populated (or we're navigating to a
- * route that doesn't need user-context anyway — public links etc. resolve
+ * route that doesn't need user-context anyway - public links etc. resolve
  * their own context first, and the vault guard kicks in afterwards if the
  * target lives inside a vault).
  */
@@ -53,11 +53,18 @@ export const setupVaultUnlockGuard = (router: Router) => {
     if (!space) return true
     const path = '/' + driveAliasAndItem.slice(space.driveAlias.length).replace(/^\/+/, '')
 
-    const engine = resolveFolderVault(extensionRegistry, space, path)
-    if (engine) return true
+    // Cheap, sync gate first: is this path even inside a claimed vault that
+    // has an unlock route? Every non-vault navigation (the vast majority)
+    // returns here, without the async engine resolution or a second registry
+    // walk.
     const claim = getVaultClaim(extensionRegistry, space, path)
     if (!claim?.unlockRoute) return true
 
+    // It's a claimed vault with an unlock route - let it through only if it's
+    // already unlocked (an engine resolves), otherwise redirect to unlock.
+    const engine = await resolveFolderVault(extensionRegistry, space, path)
+    if (engine) return true
+
     return {
       ...claim.unlockRoute,
       query: { ...(claim.unlockRoute.query || {}), redirectUrl: to.fullPath }
diff --git a/packages/web-runtime/tests/unit/container/sse/files.spec.ts b/packages/web-runtime/tests/unit/container/sse/files.spec.ts
index 1fecf35ffb7..225964a7ecb 100644
--- a/packages/web-runtime/tests/unit/container/sse/files.spec.ts
+++ b/packages/web-runtime/tests/unit/container/sse/files.spec.ts
@@ -3,7 +3,6 @@ import {
   PreviewService,
   useAuthStore,
   useConfigStore,
-  useExtensionRegistry,
   useMessages,
   useResourcesStore,
   useSharesStore,
@@ -445,7 +444,6 @@ const getMocks = ({
   const sharesStore = useSharesStore()
   const configStore = useConfigStore()
   const authStore = useAuthStore()
-  const extensionRegistry = useExtensionRegistry()
   const clientService = mockDeep<ClientService>({ initiatorId: 'local1' })
   const previewService = mockDeep<PreviewService>()
   const router = mockDeep<Router>()
@@ -465,7 +463,6 @@ const getMocks = ({
     authStore,
     clientService,
     previewService,
-    extensionRegistry,
     resourceQueue,
     language
   }
diff --git a/packages/web-runtime/tests/unit/container/sse/helpers.spec.ts b/packages/web-runtime/tests/unit/container/sse/helpers.spec.ts
index 1388b977f57..c66e9ccd8a9 100644
--- a/packages/web-runtime/tests/unit/container/sse/helpers.spec.ts
+++ b/packages/web-runtime/tests/unit/container/sse/helpers.spec.ts
@@ -5,7 +5,6 @@ import {
   PreviewService,
   useAuthStore,
   useConfigStore,
-  useExtensionRegistry,
   useMessages,
   useResourcesStore,
   useSharesStore,
@@ -66,7 +65,6 @@ const getMocks = ({
   const configStore = useConfigStore()
   const sharesStore = useSharesStore()
   const authStore = useAuthStore()
-  const extensionRegistry = useExtensionRegistry()
   const clientService = mockDeep<ClientService>()
   const previewService = mockDeep<PreviewService>()
   const router = mockDeep<Router>()
@@ -84,7 +82,6 @@ const getMocks = ({
     authStore,
     clientService,
     previewService,
-    extensionRegistry,
     resourceQueue,
     language
   }
diff --git a/packages/web-runtime/tests/unit/container/sse/shares.spec.ts b/packages/web-runtime/tests/unit/container/sse/shares.spec.ts
index 877f4dbe84b..50a27aaa4c1 100644
--- a/packages/web-runtime/tests/unit/container/sse/shares.spec.ts
+++ b/packages/web-runtime/tests/unit/container/sse/shares.spec.ts
@@ -4,7 +4,6 @@ import {
   PreviewService,
   useAuthStore,
   useConfigStore,
-  useExtensionRegistry,
   useMessages,
   useResourcesStore,
   useSharesStore,
@@ -704,7 +703,6 @@ const getMocks = ({
   userStore.user = mockDeep<User>({ id: '1' })
   const authStore = useAuthStore()
   const sharesStore = useSharesStore()
-  const extensionRegistry = useExtensionRegistry()
   const clientService = mockDeep<ClientService>({ initiatorId: 'local1' })
   const previewService = mockDeep<PreviewService>()
 
@@ -744,7 +742,6 @@ const getMocks = ({
     authStore,
     clientService,
     previewService,
-    extensionRegistry,
     resourceQueue,
     language
   }
diff --git a/packages/web-runtime/tests/unit/container/sse/spaces.spec.ts b/packages/web-runtime/tests/unit/container/sse/spaces.spec.ts
index c0b22785edf..a2204324526 100644
--- a/packages/web-runtime/tests/unit/container/sse/spaces.spec.ts
+++ b/packages/web-runtime/tests/unit/container/sse/spaces.spec.ts
@@ -9,7 +9,6 @@ import {
   SpacesStore,
   useAuthStore,
   useConfigStore,
-  useExtensionRegistry,
   useMessages,
   useResourcesStore,
   useSharesStore,
@@ -195,7 +194,6 @@ function getMocks({
   const configStore = useConfigStore()
   const authStore = useAuthStore()
   const sharesStore = useSharesStore()
-  const extensionRegistry = useExtensionRegistry()
   const clientService = mockDeep<ClientService>({ initiatorId: 'local1' })
   const previewService = mockDeep<PreviewService>()
   const language = mockDeep<Language>({ $gettext: vi.fn((m) => m) })
@@ -217,7 +215,6 @@ function getMocks({
     authStore: authStore as AuthStore,
     clientService,
     previewService,
-    extensionRegistry,
     resourceQueue,
     language
   }
diff --git a/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts b/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts
new file mode 100644
index 00000000000..9e6588db6c5
--- /dev/null
+++ b/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts
@@ -0,0 +1,132 @@
+import { Router } from 'vue-router'
+import { setupVaultUnlockGuard } from '../../../src/router/setupVaultUnlockGuard'
+import { getVaultClaim, resolveFolderVault, useSpacesStore } from '@opencloud-eu/web-pkg'
+
+vi.mock('@opencloud-eu/web-pkg', () => ({
+  getVaultClaim: vi.fn(),
+  resolveFolderVault: vi.fn(),
+  useExtensionRegistry: vi.fn(() => ({})),
+  useSpacesStore: vi.fn()
+}))
+
+const space = { id: 'space-1', driveAlias: 'personal/admin' }
+const unlockRoute = {
+  name: 'rclone-crypt-unlock',
+  query: { spaceId: 'space-1', vaultRoot: '/my.vault' }
+}
+
+type Guard = (to: any) => Promise<unknown>
+
+function installGuard({
+  spaces = [] as any[],
+  claim = null as any,
+  engine = null as any
+} = {}): Guard {
+  vi.mocked(useSpacesStore).mockReturnValue({ spaces, spacesInitialized: true } as any)
+  vi.mocked(getVaultClaim).mockReturnValue(claim)
+  vi.mocked(resolveFolderVault).mockResolvedValue(engine)
+
+  let guard: Guard
+  const router = { beforeEach: (fn: Guard) => (guard = fn) } as unknown as Router
+  setupVaultUnlockGuard(router)
+  return guard
+}
+
+describe('setupVaultUnlockGuard', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('allows navigation without a drive target', async () => {
+    const guard = installGuard()
+    expect(await guard({ params: {} })).toBe(true)
+  })
+
+  it('lets the unlock route itself through', async () => {
+    const guard = installGuard({ spaces: [space] })
+    expect(
+      await guard({
+        params: { driveAliasAndItem: 'personal/admin/my.vault' },
+        name: 'rclone-crypt-unlock'
+      })
+    ).toBe(true)
+  })
+
+  it('allows a non-vault path', async () => {
+    const guard = installGuard({ spaces: [space], claim: null })
+    expect(
+      await guard({ params: { driveAliasAndItem: 'personal/admin/folder' }, fullPath: '/x' })
+    ).toBe(true)
+  })
+
+  it('allows an already-unlocked vault path (engine resolves)', async () => {
+    const guard = installGuard({
+      spaces: [space],
+      claim: { vaultRoot: '/my.vault', unlockRoute },
+      engine: {}
+    })
+    expect(
+      await guard({ params: { driveAliasAndItem: 'personal/admin/my.vault' }, fullPath: '/x' })
+    ).toBe(true)
+  })
+
+  it('redirects a locked vault path to the unlock route, carrying the intended URL', async () => {
+    const guard = installGuard({
+      spaces: [space],
+      claim: { vaultRoot: '/my.vault', unlockRoute },
+      engine: null
+    })
+
+    const result = await guard({
+      params: { driveAliasAndItem: 'personal/admin/my.vault' },
+      fullPath: '/files/personal/admin/my.vault'
+    })
+
+    expect(result).toEqual({
+      name: 'rclone-crypt-unlock',
+      query: {
+        spaceId: 'space-1',
+        vaultRoot: '/my.vault',
+        redirectUrl: '/files/personal/admin/my.vault'
+      }
+    })
+  })
+
+  it('does not match a sibling drive alias (prefix guard)', async () => {
+    // driveAlias is `personal/admin`; `personal/admin-other/...` must NOT match,
+    // otherwise we'd compute a wrong path and possibly mis-gate it.
+    const guard = installGuard({ spaces: [space], claim: null })
+
+    const result = await guard({
+      params: { driveAliasAndItem: 'personal/admin-other/x' },
+      fullPath: '/x'
+    })
+
+    expect(result).toBe(true)
+    expect(getVaultClaim).not.toHaveBeenCalled()
+  })
+
+  it('redirects a directly-shared vault root (path computed as "/") to unlock', async () => {
+    // The vault IS the share root: driveAliasAndItem === the share-space
+    // driveAlias, so the computed path is "/", and the claim roots the vault at
+    // "/". This is the share-receiver flow that previously got no unlock prompt.
+    const shareSpace = { id: 's1', driveAlias: 'share/myvault.vault' }
+    const guard = installGuard({
+      spaces: [shareSpace],
+      claim: {
+        vaultRoot: '/',
+        unlockRoute: { name: 'rclone-crypt-unlock', query: { spaceId: 's1', vaultRoot: '/' } }
+      },
+      engine: null
+    })
+
+    const result = await guard({
+      params: { driveAliasAndItem: 'share/myvault.vault' },
+      fullPath: '/files/spaces/share/myvault.vault'
+    })
+
+    expect(getVaultClaim).toHaveBeenCalledWith(expect.anything(), shareSpace, '/')
+    expect(result).toEqual({
+      name: 'rclone-crypt-unlock',
+      query: { spaceId: 's1', vaultRoot: '/', redirectUrl: '/files/spaces/share/myvault.vault' }
+    })
+  })
+})
diff --git a/packages/web-test-helpers/src/mocks/defaultComponentMocks.ts b/packages/web-test-helpers/src/mocks/defaultComponentMocks.ts
index 45d4153f016..054a5eb500a 100644
--- a/packages/web-test-helpers/src/mocks/defaultComponentMocks.ts
+++ b/packages/web-test-helpers/src/mocks/defaultComponentMocks.ts
@@ -30,7 +30,7 @@ export const defaultComponentMocks = ({ currentRoute = undefined }: ComponentMoc
   )
   // Default to "every route exists" so suites that don't care about routing
   // (most of them) don't have to wire this up. The few tests that *do* care
-  // override this with mockReturnValue(false) — see useFileActions.spec.
+  // override this with mockReturnValue(false) - see useFileActions.spec.
   $router.hasRoute.mockReturnValue(true)
   const $route = $router.currentRoute.value
   $route.path = $route.path || '/'
diff --git a/tests/e2e/cucumber/environment/index.ts b/tests/e2e/cucumber/environment/index.ts
index 49c4d26cf63..642cfc32013 100644
--- a/tests/e2e/cucumber/environment/index.ts
+++ b/tests/e2e/cucumber/environment/index.ts
@@ -12,6 +12,7 @@ import pino from 'pino'
 import { Browser, chromium, firefox, webkit } from '@playwright/test'
 import path from 'path'
 import fs from 'fs'
+import { spawnSync } from 'node:child_process'
 import { v4 as uuidv4 } from 'uuid'
 
 import { World } from './world'
@@ -35,7 +36,28 @@ const logger = pino({
 setDefaultTimeout(config.debug ? -1 : config.testTimeout * 1000)
 setWorldConstructor(World)
 
+// The @rclone-crypt vault scenarios shell out to the rclone CLI to build and
+// verify encrypted fixtures. Probe once whether rclone is on PATH so we can
+// skip those scenarios (instead of hard-failing) for developers who don't have
+// it installed. CI installs a pinned rclone, so they run there.
+let rcloneAvailable: boolean | undefined
+function isRcloneAvailable(): boolean {
+  if (rcloneAvailable === undefined) {
+    rcloneAvailable = spawnSync('rclone', ['version'], { stdio: 'ignore' }).status === 0
+  }
+  return rcloneAvailable
+}
+
 Before(async function (this: World, { pickle }: ITestCaseHookParameter) {
+  if (pickle.tags.some((tag) => tag.name === '@rclone-crypt') && !isRcloneAvailable()) {
+    // console (not the pino logger) so the skip reason is visible regardless of
+    // the configured log level.
+    console.warn(
+      'rclone not found on PATH - skipping @rclone-crypt scenario. Install rclone (https://rclone.org/install/) to run the vault e2e tests.'
+    )
+    return 'skipped'
+  }
+
   this.feature = pickle
   this.actorsEnvironment.on('console', (actorId, message): void => {
     const msg = {
diff --git a/tests/e2e/cucumber/features/rclone-crypt/vault.feature b/tests/e2e/cucumber/features/rclone-crypt/vault.feature
index e7e0459f81b..bc0a5be56f9 100644
--- a/tests/e2e/cucumber/features/rclone-crypt/vault.feature
+++ b/tests/e2e/cucumber/features/rclone-crypt/vault.feature
@@ -63,3 +63,69 @@ Feature: Work with an rclone-crypt encrypted vault
       | mybundle/deeper/nested.txt | deeper content |
     Then the rclone-crypt vault "myvault.vault" file "mybundle/inner.txt" should decrypt to "inner content"
     And the rclone-crypt vault "myvault.vault" file "mybundle/deeper/nested.txt" should decrypt to "deeper content"
+
+  @rclone-crypt
+  Scenario: Create a vault, set a passphrase and upload an encrypted file
+    Given "Admin" removes any folder "freshvault.vault" on the server
+    When "Admin" logs in
+    And "Admin" navigates to the personal space page
+    And "Admin" creates the following resources
+      | resource         | type   |
+      | freshvault.vault | folder |
+    And "Admin" enters the vault "freshvault.vault" with passphrase "foobar"
+    And "Admin" uploads a file named "secret.txt" with content "top secret content" via the upload button
+    Then following resources should be displayed in the files list for user "Admin"
+      | resource   |
+      | secret.txt |
+    And the rclone-crypt vault "freshvault.vault" file "secret.txt" should decrypt to "top secret content"
+
+  @rclone-crypt
+  Scenario: A wrong passphrase is rejected
+    Given "Admin" creates an rclone-crypt vault "myvault.vault" in personal space with the following content
+      | path      | content     |
+      | hello.txt | hello world |
+    When "Admin" logs in
+    And "Admin" navigates to the personal space page
+    And "Admin" fails to enter the vault "myvault.vault" with the wrong passphrase "definitely-wrong"
+
+  @rclone-crypt
+  Scenario: A vault root is collaborator-shareable but not public-linkable, its content stays private
+    Given "Admin" creates an rclone-crypt vault "myvault.vault" in personal space with the following content
+      | path      | content     |
+      | hello.txt | hello world |
+    When "Admin" logs in
+    And "Admin" navigates to the personal space page
+    Then "Admin" should be able to share "myvault.vault" but not create a public link
+    When "Admin" enters the vault "myvault.vault" with passphrase "foobar"
+    Then "Admin" should not be able to share "hello.txt"
+
+  @rclone-crypt
+  Scenario: Rename and download a vault file
+    Given "Admin" creates an rclone-crypt vault "myvault.vault" in personal space with the following content
+      | path      | content           |
+      | hello.txt | downloadable text |
+    When "Admin" logs in
+    And "Admin" navigates to the personal space page
+    And "Admin" enters the vault "myvault.vault" with passphrase "foobar"
+    And "Admin" renames the vault resource "hello.txt" to "renamed.txt"
+    Then following resources should be displayed in the files list for user "Admin"
+      | resource    |
+      | renamed.txt |
+    And the rclone-crypt vault "myvault.vault" file "renamed.txt" should decrypt to "downloadable text"
+    And "Admin" downloads the vault file "renamed.txt" which decrypts to "downloadable text"
+
+  @rclone-crypt
+  Scenario: A collaborator-shared vault root unlocks and decrypts for the receiver
+    Given "Admin" creates following users using API
+      | id    |
+      | Brian |
+    And "Admin" creates an rclone-crypt vault "myvault.vault" in personal space with the following content
+      | path      | content     |
+      | hello.txt | hello world |
+    And "Admin" shares the rclone-crypt vault "myvault.vault" with "Brian" via API
+    When "Brian" logs in
+    And "Brian" navigates to the shared with me page
+    And "Brian" enters the vault "myvault.vault" with passphrase "foobar"
+    Then following resources should be displayed in the files list for user "Brian"
+      | resource  |
+      | hello.txt |
diff --git a/tests/e2e/cucumber/steps/rcloneCrypt.ts b/tests/e2e/cucumber/steps/rcloneCrypt.ts
index c3f37996766..3955627ed28 100644
--- a/tests/e2e/cucumber/steps/rcloneCrypt.ts
+++ b/tests/e2e/cucumber/steps/rcloneCrypt.ts
@@ -1,18 +1,19 @@
 import { Given, DataTable, Then, When } from '@cucumber/cucumber'
 import { spawnSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { expect } from '@playwright/test'
 import { World } from '../environment'
 import { config } from '../../config'
 import { dragDropFiles } from '../../support/utils/dragDrop'
+import { api } from '../../support'
 
 // Builds an rclone-crypt encrypted vault directly on the OpenCloud backend
 // using the rclone CLI. The web-app-rclone-crypt plugin should then render
 // the cleartext names back in the UI.
 //
-// Password / encoding settings match the PoC defaults hardcoded in
+// Password / encoding settings match the rclone-crypt defaults hardcoded in
 // `packages/web-app-rclone-crypt/src/resolveVault.ts`: password "foobar",
 // no salt, base32 filename encoding.
 const VAULT_PASSWORD = 'foobar'
@@ -38,7 +39,7 @@ Given(
   ): Promise<void> {
     if (!vaultName.endsWith('.vault')) {
       throw new Error(
-        `vault name "${vaultName}" must end with .vault — the plugin uses that suffix to detect vaults`
+        `vault name "${vaultName}" must end with .vault - the plugin uses that suffix to detect vaults`
       )
     }
 
@@ -74,7 +75,7 @@ Given(
       const purge = spawnSync('rclone', [...baseFlags, 'purge', `oc:${vaultName}`], {
         encoding: 'utf8'
       })
-      // Ignore exit status — first run won't have anything to purge.
+      // Ignore exit status - first run won't have anything to purge.
       void purge
 
       runRclone([...baseFlags, 'mkdir', `oc-crypt:`])
@@ -90,6 +91,35 @@ Given(
   }
 )
 
+// The vault owner is a predefined user (Admin, whose rclone webdav creds the
+// vault-create step uses), so we can't reuse the generic share step, which
+// resolves the sharer via getCreatedUser. Share with the "Can view" role: it
+// maps to the same `viewer` role for files and folders, sidestepping the share
+// helper's `path.includes('.')` file/folder heuristic that a "*.vault" folder
+// name would otherwise trip.
+Given(
+  '{string} shares the rclone-crypt vault {string} with {string} via API',
+  async function (
+    this: World,
+    stepUser: string,
+    vaultName: string,
+    recipient: string
+  ): Promise<void> {
+    // createShare derives the owner's personal space from `user.displayName`.
+    // The predefined admin's store displayName is lowercase ("admin") but its
+    // server personal space is named after the actor ("Admin"), so pass the
+    // step user name as the display name to make the space lookup match.
+    const owner = this.usersEnvironment.getUser({ key: stepUser })
+    await api.share.createShare({
+      user: { ...owner, displayName: stepUser },
+      path: vaultName,
+      shareType: 'user',
+      shareWith: recipient,
+      role: 'Can view'
+    })
+  }
+)
+
 Then(
   'the rclone-crypt vault {string} file {string} should decrypt to {string}',
   async function (
@@ -145,7 +175,7 @@ When(
   ): Promise<void> {
     const { page } = this.actorsEnvironment.getActor({ key: stepUser })
     // Clicking the vault folder kicks the DriveResolver into a redirect to
-    // /rclone-crypt/unlock — we wait for the unlock URL instead of for a
+    // /rclone-crypt/unlock - we wait for the unlock URL instead of for a
     // PROPFIND like the generic "opens folder" step does.
     await Promise.all([
       page.waitForURL((url) => url.pathname.includes('/rclone-crypt/unlock'), {
@@ -153,7 +183,20 @@ When(
       }),
       page.locator(`[data-test-resource-name="${vaultName}"]`).first().click()
     ])
-    await page.locator('input[type="password"]').fill(passphrase)
+    await page.locator('#vault-passphrase').waitFor()
+    await page.locator('#vault-passphrase').fill(passphrase)
+    // Setting up a still-empty vault reveals a second "repeat passphrase" field,
+    // but only once the view has probed the server to learn the vault is empty.
+    // Give that field a brief window to appear and fill it too; an existing
+    // vault never shows it, so we just fall through after the timeout.
+    const confirm = page.locator('#vault-passphrase-confirm')
+    const needsConfirm = await confirm
+      .waitFor({ state: 'visible', timeout: 2000 })
+      .then(() => true)
+      .catch(() => false)
+    if (needsConfirm) {
+      await confirm.fill(passphrase)
+    }
     await Promise.all([
       page.waitForURL((url) => !url.pathname.includes('/rclone-crypt/unlock'), {
         timeout: 10_000
@@ -181,7 +224,7 @@ When(
     await editor.waitFor()
     // ProseMirror only flips the doc dirty on real input events. type()
     // raises keydown but no beforeinput/input, which is what tiptap listens
-    // for — insertText() simulates IME input which ProseMirror picks up.
+    // for - insertText() simulates IME input which ProseMirror picks up.
     await editor.click()
     await page.keyboard.press('ControlOrMeta+A')
     await page.keyboard.press('Delete')
@@ -266,7 +309,7 @@ When(
     const { page } = this.actorsEnvironment.getActor({ key: stepUser })
     // Ctrl+S in the editor area is consumed by tiptap before it can bubble
     // to the document-level keydown listener that drives saveFileTask. Open
-    // the top-bar action menu and click "Save" instead — same handler, just
+    // the top-bar action menu and click "Save" instead - same handler, just
     // routed through the UI.
     await page.locator('#oc-openfile-contextmenu-trigger').click()
     // The dropdown rendering duplicates the action button (light + chrome
@@ -283,3 +326,143 @@ When(
     }
   }
 )
+
+When(
+  '{string} fails to enter the vault {string} with the wrong passphrase {string}',
+  async function (
+    this: World,
+    stepUser: string,
+    vaultName: string,
+    passphrase: string
+  ): Promise<void> {
+    const { page } = this.actorsEnvironment.getActor({ key: stepUser })
+    await Promise.all([
+      page.waitForURL((url) => url.pathname.includes('/rclone-crypt/unlock'), {
+        timeout: 10_000
+      }),
+      page.locator(`[data-test-resource-name="${vaultName}"]`).first().click()
+    ])
+    await page.locator('input[type="password"]').fill(passphrase)
+    await page.locator('#vault-unlock-submit').click()
+    // A wrong passphrase keeps the user on the unlock page and surfaces the
+    // error instead of decrypting into the vault.
+    await expect(page.getByText('Incorrect passphrase.')).toBeVisible()
+    expect(page.url()).toContain('/rclone-crypt/unlock')
+  }
+)
+
+Then(
+  '{string} should not be able to share {string}',
+  async function (this: World, stepUser: string, resource: string): Promise<void> {
+    const { page } = this.actorsEnvironment.getActor({ key: stepUser })
+    await page.locator(`[data-test-resource-name="${resource}"]`).first().click({ button: 'right' })
+    const menu = page.locator('div[id^="context-menu-drop"]').first()
+    await menu.waitFor({ timeout: 5_000 })
+    // Vault content has a ciphertext name and can't be claimed once a share
+    // rebases the path, so canShare() is false: neither the "shares" nor the
+    // "create link" action renders in the context menu.
+    await expect(menu.locator('.oc-files-actions-show-shares-trigger')).toHaveCount(0)
+    await expect(menu.locator('.oc-files-actions-create-links')).toHaveCount(0)
+  }
+)
+
+Then(
+  '{string} should be able to share {string} but not create a public link',
+  async function (this: World, stepUser: string, resource: string): Promise<void> {
+    const { page } = this.actorsEnvironment.getActor({ key: stepUser })
+    await page.locator(`[data-test-resource-name="${resource}"]`).first().click({ button: 'right' })
+    const menu = page.locator('div[id^="context-menu-drop"]').first()
+    await menu.waitFor({ timeout: 5_000 })
+    // A vault root keeps its Shareable permission: collaborator sharing stays
+    // available (the recipient unlocks it out of band and the cleartext
+    // `.vault` name still anchors detection in their session).
+    await expect(menu.locator('.oc-files-actions-show-shares-trigger')).toHaveCount(1)
+    // Public links rebase the path past the `.vault` anchor, so they're blocked.
+    await expect(menu.locator('.oc-files-actions-create-links')).toHaveCount(0)
+  }
+)
+
+When(
+  '{string} downloads the vault file {string} which decrypts to {string}',
+  async function (
+    this: World,
+    stepUser: string,
+    resource: string,
+    expectedContent: string
+  ): Promise<void> {
+    const { page } = this.actorsEnvironment.getActor({ key: stepUser })
+    await page.locator(`[data-test-resource-name="${resource}"]`).first().click({ button: 'right' })
+    const [download] = await Promise.all([
+      page.waitForEvent('download'),
+      page
+        .locator('div[id^="context-menu-drop"] button.oc-files-actions-download-file-trigger')
+        .click()
+    ])
+    // The bytes that land on disk must be the cleartext, not the ciphertext
+    // blob the server stores - i.e. the download went through the engine.
+    const content = readFileSync(await download.path(), 'utf8')
+    expect(content).toBe(expectedContent)
+  }
+)
+
+When(
+  '{string} renames the vault resource {string} to {string}',
+  async function (this: World, stepUser: string, resource: string, newName: string): Promise<void> {
+    const { page } = this.actorsEnvironment.getActor({ key: stepUser })
+    await page.locator(`[data-test-resource-name="${resource}"]`).first().click({ button: 'right' })
+    await page
+      .locator('div[id^="context-menu-drop"] button.oc-files-actions-rename-trigger')
+      .click()
+    const input = page.locator('.oc-text-input')
+    await input.clear()
+    await input.fill(newName)
+    await Promise.all([
+      // The MOVE source path is the *encrypted* name, so (unlike the generic
+      // rename helper, which matches the cleartext name in the URL) we just
+      // wait for any successful MOVE.
+      page.waitForResponse((resp) => resp.request().method() === 'MOVE' && resp.status() === 201),
+      page
+        .locator('//button[contains(@class,"oc-modal-body-actions-confirm") and text()="Rename"]')
+        .click()
+    ])
+    await page
+      .locator(`[data-test-resource-name="${newName}"]`)
+      .first()
+      .waitFor({ timeout: 10_000 })
+  }
+)
+
+Given(
+  '{string} removes any folder {string} on the server',
+  async function (this: World, stepUser: string, name: string): Promise<void> {
+    const user = this.usersEnvironment.getUser({ key: stepUser })
+    const workdir = mkdtempSync(join(tmpdir(), 'rclone-purge-'))
+    const configFile = join(workdir, 'rclone.conf')
+    try {
+      const obscuredUserPassword = runRclone(['obscure', user.password]).trim()
+      writeFileSync(
+        configFile,
+        [
+          '[oc]',
+          'type = webdav',
+          `url = ${config.baseUrl}/dav/files/${user.username}`,
+          'vendor = other',
+          `user = ${user.username}`,
+          `pass = ${obscuredUserPassword}`,
+          ''
+        ].join('\n')
+      )
+      // Best effort: makes UI-create scenarios deterministic on reruns. The
+      // first run has nothing to purge, so a non-zero exit is fine.
+      spawnSync(
+        'rclone',
+        ['--config', configFile, '--no-check-certificate', 'purge', `oc:${name}`],
+        {
+          encoding: 'utf8'
+        }
+      )
+    } finally {
+      rmSync(workdir, { recursive: true, force: true })
+    }
+  }
+)
diff --git a/tests/e2e/support/utils/dragDrop.ts b/tests/e2e/support/utils/dragDrop.ts
index d2b12c4f359..41d40373499 100644
--- a/tests/e2e/support/utils/dragDrop.ts
+++ b/tests/e2e/support/utils/dragDrop.ts
@@ -1,7 +1,8 @@
 import { readFileSync, lstatSync, readdirSync } from 'fs'
 import { Page } from '@playwright/test'
 
-interface File {
+// Node-side upload descriptor; named distinctly so it doesn't shadow the DOM `File` used in page.evaluate.
+interface ResourceInput {
   name: string
   path: string
 }
@@ -12,7 +13,11 @@ interface FileBuffer {
   relativePath: string
 }
 
-const getFiles = (resources: File[], files: FileBuffer[] = [], parent = ''): FileBuffer[] => {
+const getFiles = (
+  resources: ResourceInput[],
+  files: FileBuffer[] = [],
+  parent = ''
+): FileBuffer[] => {
   for (const resource of resources) {
     const filePath = parent ? `${parent}/${resource.name}` : resource.name
     const stat = lstatSync(resource.path)
@@ -24,7 +29,7 @@ const getFiles = (resources: File[], files: FileBuffer[] = [], parent = ''): Fil
       })
     } else if (stat.isDirectory()) {
       const entries = readdirSync(resource.path)
-      const subResources: File[] = entries.map((entry) => ({
+      const subResources: ResourceInput[] = entries.map((entry) => ({
         path: `${resource.path}/${entry}`,
         name: entry
       }))
@@ -34,37 +39,103 @@ const getFiles = (resources: File[], files: FileBuffer[] = [], parent = ''): Fil
   return files
 }
 
-export const dragDropFiles = async (page: Page, resources: File[], targetSelector: string) => {
+export const dragDropFiles = async (
+  page: Page,
+  resources: ResourceInput[],
+  targetSelector: string
+) => {
   const files = getFiles(resources)
 
   await page.evaluate(
     ([files, selector]) => {
       const target = document.querySelector(selector as string)
       if (!target) throw new Error(`Target ${selector} not found`)
-      const input = document.createElement('input')
-      input.type = 'file'
-      input.multiple = true
-      input.style.display = 'none'
-      input.webkitdirectory = (files as FileBuffer[]).some((f) => f.relativePath.includes('/'))
-      document.body.appendChild(input)
+
+      const fileList = files as FileBuffer[]
+
+      const blobOf = (f: FileBuffer) => new Blob([new Uint8Array(JSON.parse(f.bufferString))])
+
+      // A real browser folder drop yields plain File objects through the
+      // entries API and only attaches the path via FileSystemEntry.fullPath
+      // (which getDroppedFiles copies to `relativePath`). So the files the
+      // entries hand out must NOT also carry a webkitRelativePath, otherwise
+      // the resource carries two slightly different path hints and the
+      // vault-upload path encryption picks the wrong one. The flat `.files`
+      // fallback list below keeps webkitRelativePath, since that fallback has
+      // no other way to convey the tree.
+      const cleanFile = (f: FileBuffer): File => new File([blobOf(f)], f.name)
 
       const dt = new DataTransfer()
-      ;(files as FileBuffer[]).forEach((file) => {
-        const buffer = new Uint8Array(JSON.parse(file.bufferString))
-        const fileObj = new File([new Blob([buffer])], file.name)
-        if (file.relativePath.includes('/')) {
-          Object.defineProperty(fileObj, 'webkitRelativePath', { value: file.relativePath })
+      fileList.forEach((f) => {
+        const fileObj = new File([blobOf(f)], f.name)
+        if (f.relativePath.includes('/')) {
+          Object.defineProperty(fileObj, 'webkitRelativePath', { value: f.relativePath })
         }
         dt.items.add(fileObj)
       })
-      input.files = dt.files
+
+      // A real folder drop does NOT expose its contents through `.files` - the
+      // browser hands them over lazily through the entries API
+      // (dataTransfer.items[].webkitGetAsEntry() -> a FileSystemEntry tree the
+      // app walks to recurse into directories). To faithfully simulate a
+      // folder drop we therefore build a synthetic entry tree and expose it on
+      // `.items`. Doing this with plain objects on a plain `new Event('drop')`
+      // keeps it working headless in every browser - a *real* DataTransfer
+      // dispatched synthetically is read-only/empty in Firefox and WebKit.
+      type Entry = Record<string, any>
+      const fileEntry = (f: FileBuffer, fullPath: string): Entry => ({
+        isFile: true,
+        isDirectory: false,
+        name: f.relativePath.split('/').filter(Boolean).pop(),
+        fullPath,
+        file: (resolve: (file: File) => void) => resolve(cleanFile(f))
+      })
+      const dirEntry = (name: string, fullPath: string, children: Entry[]): Entry => ({
+        isFile: false,
+        isDirectory: true,
+        name,
+        fullPath,
+        createReader: () => {
+          let drained = false
+          return {
+            // readEntries returns the batch once, then [] to signal the end.
+            readEntries: (resolve: (entries: Entry[]) => void) => {
+              resolve(drained ? [] : children)
+              drained = true
+            }
+          }
+        }
+      })
+
+      // Fold the flat list into a nested {name -> subtree | {__file}} tree.
+      const tree: Record<string, any> = {}
+      for (const f of fileList) {
+        const segments = f.relativePath.split('/').filter(Boolean)
+        let node = tree
+        for (let i = 0; i < segments.length - 1; i++) {
+          node[segments[i]] = node[segments[i]] || {}
+          node = node[segments[i]]
+        }
+        node[segments[segments.length - 1]] = { __file: f }
+      }
+      const buildEntries = (node: Record<string, any>, parentPath: string): Entry[] =>
+        Object.entries(node).map(([name, child]) =>
+          child.__file
+            ? fileEntry(child.__file, `${parentPath}/${name}`)
+            : dirEntry(name, `${parentPath}/${name}`, buildEntries(child, `${parentPath}/${name}`))
+        )
+      const items = buildEntries(tree, '').map((entry) => ({
+        kind: 'file',
+        type: '',
+        webkitGetAsEntry: () => entry,
+        getAsFile: (): File | null => null
+      }))
 
       const dropEvent = new Event('drop', { bubbles: true })
       Object.defineProperty(dropEvent, 'dataTransfer', {
-        value: { files: dt.files, types: ['Files'] }
+        value: { files: dt.files, items, types: ['Files'] }
       })
       target.dispatchEvent(dropEvent)
-      document.body.removeChild(input)
     },
     [files, targetSelector]
   )
diff --git a/tests/woodpecker/config-opencloud.json b/tests/woodpecker/config-opencloud.json
index 43f95e05d50..c5d4bdf8601 100644
--- a/tests/woodpecker/config-opencloud.json
+++ b/tests/woodpecker/config-opencloud.json
@@ -9,6 +9,7 @@
     "search",
     "admin-settings",
     "ocm",
-    "app-store"
+    "app-store",
+    "rclone-crypt"
   ]
 }