diff --git a/.claude/skills/angular-modernization/SKILL.md b/.claude/skills/angular-modernization/SKILL.md
new file mode 100644
index 00000000000..187f715bde2
--- /dev/null
+++ b/.claude/skills/angular-modernization/SKILL.md
@@ -0,0 +1,156 @@
+---
+name: angular-modernization
+description: Modernizes Angular code such as components and directives to follow best practices using both automatic CLI migrations and Bitwarden-specific patterns. YOU must use this skill when someone requests modernizing Angular code. DO NOT invoke for general Angular discussions unrelated to modernization.
+allowed-tools: Read, Write, Glob, Bash(npx ng generate:*)
+---
+
+# Angular Modernization
+
+Transforms legacy Angular components to modern architecture using a two-step approach:
+
+1. **Automated migrations** - Angular CLI schematics for standalone, control flow, and signals
+2. **Bitwarden patterns** - ADR compliance, OnPush change detection, proper visibility, thin components
+
+## Workflow
+
+### Step 1: Run Angular CLI Migrations
+
+**⚠️ CRITICAL: ALWAYS use Angular CLI migrations when available. DO NOT manually migrate features that have CLI schematics.**
+
+Angular provides automated schematics that handle edge cases, update tests, and ensure correctness. Manual migration should ONLY be used for patterns not covered by CLI tools.
+
+**IMPORTANT:**
+
+- Always run the commands using `npx ng`.
+- All the commands must be run on directories and NOT files. Use the `--path` option to target directories.
+- Run migrations in order (some depend on others)
+
+#### 1. Standalone Components
+
+```bash
+npx ng generate @angular/core:standalone --path=<directory> --mode=convert-to-standalone
+```
+
+NgModule-based → standalone architecture
+
+#### 2. Control Flow Syntax
+
+```bash
+npx ng generate @angular/core:control-flow
+```
+
+`*ngIf`, `*ngFor`, `*ngSwitch` → `@if`, `@for`, `@switch`
+
+#### 3. Signal Inputs
+
+```bash
+npx ng generate @angular/core:signal-input-migration
+```
+
+`@Input()` → signal inputs
+
+#### 4. Signal Outputs
+
+```bash
+npx ng generate @angular/core:output-migration
+```
+
+`@Output()` → signal outputs
+
+#### 5. Signal Queries
+
+```bash
+npx ng generate @angular/core:signal-queries-migration
+```
+
+`@ViewChild`, `@ContentChild`, etc. → signal queries
+
+#### 6. inject() Function
+
+```bash
+npx ng generate @angular/core:inject-migration
+```
+
+Constructor injection → `inject()` function
+
+#### 7. Self-Closing Tag
+
+```bash
+npx ng generate @angular/core:self-closing-tag
+```
+
+Updates templates to self-closing syntax
+
+#### 8. Unused Imports
+
+```bash
+npx ng generate @angular/core:unused-imports
+```
+
+Removes unused imports
+
+### Step 2: Apply Bitwarden Patterns
+
+See [migration-patterns.md](migration-patterns.md) for detailed examples.
+
+1. Add OnPush change detection
+2. Apply visibility modifiers (`protected` for template access, `private` for internal)
+3. Convert local component state to signals
+4. Keep service observables (don't convert to signals)
+5. Extract business logic to services
+6. Organize class members correctly
+7. Update tests for standalone
+
+### Step 3: Validate
+
+- Fix linting and formatting using `npm run lint:fix`
+- Run tests using `npm run test`
+
+If any errors occur, fix them accordingly.
+
+## Key Decisions
+
+### Signals vs Observables
+
+- **Signals** - Component-local state only (ADR-0027)
+- **Observables** - Service state and cross-component communication (ADR-0003)
+- Use `toSignal()` to bridge observables into signal-based components
+
+### Visibility
+
+- `protected` - Template-accessible members
+- `private` - Internal implementation
+
+### Other Rules
+
+- Always add OnPush change detection
+- No TypeScript enums (use const objects with type aliases per ADR-0025)
+- No code regions (refactor instead)
+- Thin components (business logic in services)
+
+## Validation Checklist
+
+Before completing migration:
+
+- [ ] OnPush change detection added
+- [ ] Visibility modifiers applied (`protected`/`private`)
+- [ ] Signals for component state, observables for service state
+- [ ] Class members organized (see [migration-patterns.md](migration-patterns.md#class-member-organization))
+- [ ] Tests updated and passing
+- [ ] No new TypeScript enums
+- [ ] No code regions
+
+## References
+
+### Bitwarden ADRs
+
+- [ADR-0003: Observable Data Services](https://contributing.bitwarden.com/architecture/adr/observable-data-services)
+- [ADR-0025: No TypeScript Enums](https://contributing.bitwarden.com/architecture/adr/no-enums)
+- [ADR-0027: Angular Signals](https://contributing.bitwarden.com/architecture/adr/angular-signals)
+- [Bitwarden Angular Style Guide](https://contributing.bitwarden.com/contributing/code-style/web/angular)
+
+### Angular Resources
+
+- [Angular Style Guide](https://angular.dev/style-guide)
+- [Angular Migrations](https://angular.dev/reference/migrations)
+- [Angular CLI Schematics](https://angular.dev/tools/cli/schematics)
diff --git a/.claude/skills/angular-modernization/migration-patterns.md b/.claude/skills/angular-modernization/migration-patterns.md
new file mode 100644
index 00000000000..284f90a410f
--- /dev/null
+++ b/.claude/skills/angular-modernization/migration-patterns.md
@@ -0,0 +1,253 @@
+# Angular Migration Patterns Reference
+
+## Table of Contents
+
+- [Component Architecture](#component-architecture)
+- [Dependency Injection](#dependency-injection)
+- [Reactivity Patterns](#reactivity-patterns)
+- [Template Syntax](#template-syntax)
+- [Type Safety](#type-safety)
+
+## Component Architecture
+
+### Standalone Components
+
+Angular defaults to standalone components. Components should omit `standalone: true`, and any component specifying `standalone: false` SHALL be migrated to standalone.
+
+```typescript
+@Component({
+  selector: "app-user-profile",
+  imports: [CommonModule, ReactiveFormsModule, AsyncPipe],
+  templateUrl: "./user-profile.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class UserProfileComponent {}
+```
+
+### Class Member Organization
+
+```typescript
+@Component({...})
+export class MyComponent {
+  // 1. Inputs (public)
+  @Input() data: string;
+
+  // 2. Outputs (public)
+  @Output() valueChange = new EventEmitter<string>();
+
+  // 3. ViewChild/ContentChild
+  @ViewChild('template') template: TemplateRef<any>;
+
+  // 4. Injected dependencies (private/protected)
+  private userService = inject(UserService);
+  protected dialogService = inject(DialogService);
+
+  // 5. Public properties
+  public formGroup: FormGroup;
+
+  // 6. Protected properties (template-accessible)
+  protected isLoading = signal(false);
+  protected items$ = this.itemService.items$;
+
+  // 7. Private properties
+  private cache = new Map();
+
+  // 8. Lifecycle hooks
+  ngOnInit() {}
+
+  // 9. Public methods
+  public save() {}
+
+  // 10. Protected methods (template-accessible)
+  protected handleClick() {}
+
+  // 11. Private methods
+  private processData() {}
+}
+```
+
+## Dependency Injection
+
+### Modern inject() Function
+
+**Before:**
+
+```typescript
+constructor(
+  private userService: UserService,
+  private route: ActivatedRoute
+) {}
+```
+
+**After:**
+
+```typescript
+private userService = inject(UserService);
+private route = inject(ActivatedRoute);
+```
+
+## Reactivity Patterns
+
+### Signals for Component State (ADR-0027)
+
+```typescript
+// Local state
+protected selectedFolder = signal<Folder | null>(null);
+protected isLoading = signal(false);
+
+// Derived state
+protected hasSelection = computed(() => this.selectedFolder() !== null);
+```
+
+### Prefer computed() Over effect()
+
+Use `computed()` for derived values. Use `effect()` only for side effects (logging, analytics, DOM sync).
+
+**❌ Bad:**
+
+```typescript
+constructor() {
+  effect(() => {
+    const id = this.selectedId();
+    this.selectedItem.set(this.items().find(i => i.id === id) ?? null);
+  });
+}
+```
+
+**✅ Good:**
+
+```typescript
+selectedItem = computed(() => this.items().find((i) => i.id === this.selectedId()) ?? null);
+```
+
+### Observables for Service Communication (ADR-0003)
+
+```typescript
+// In component
+protected folders$ = this.folderService.folders$;
+
+// Template
+// <div *ngFor="let folder of folders$ | async">
+
+// For explicit subscriptions
+constructor() {
+  this.userService.user$
+    .pipe(takeUntilDestroyed())
+    .subscribe(user => this.handleUser(user));
+}
+```
+
+### Bridging Observables to Signals
+
+Use `toSignal()` to convert service observables to signals in components. Keep service state as observables (ADR-0003).
+
+**Before:**
+
+```typescript
+private destroy$ = new Subject<void>();
+users: User[] = [];
+
+ngOnInit() {
+  this.userService.users$.pipe(takeUntil(this.destroy$))
+    .subscribe(users => this.users = users);
+}
+
+ngOnDestroy() {
+  this.destroy$.next();
+  this.destroy$.complete();
+}
+```
+
+**After:**
+
+```typescript
+protected users = toSignal(this.userService.users$, { initialValue: [] });
+```
+
+## Template Syntax
+
+### New Control Flow
+
+**Before:**
+
+```html
+<div *ngIf="user$ | async as user; else loading">
+  <p *ngFor="let item of user.items">{{ item.name }}</p>
+</div>
+<ng-template #loading>Loading...</ng-template>
+```
+
+**After:**
+
+```html
+@if (user$ | async; as user) { @for (item of user.items; track item.id) {
+<p>{{ item.name }}</p>
+} } @else {
+<p>Loading...</p>
+}
+```
+
+### Prefer Class/Style Bindings Over ngClass/ngStyle
+
+Use `[class.*]` and `[style.*]` bindings instead of `ngClass`/`ngStyle`.
+
+**❌ Bad:**
+
+```html
+<div [ngClass]="{ 'active': isActive(), 'disabled': isDisabled() }">
+  <div [ngStyle]="{ 'width.px': width(), 'height.px': height() }"></div>
+</div>
+```
+
+**✅ Good:**
+
+```html
+<div [class.active]="isActive()" [class.disabled]="isDisabled()">
+  <div [style.width.px]="width()" [style.height.px]="height()"></div>
+</div>
+```
+
+## Type Safety
+
+### No TypeScript Enums (ADR-0025)
+
+**Before:**
+
+```typescript
+enum CipherType {
+  Login = 1,
+  SecureNote = 2,
+}
+```
+
+**After:**
+
+```typescript
+export const CipherType = Object.freeze({
+  Login: 1,
+  SecureNote: 2,
+} as const);
+export type CipherType = (typeof CipherType)[keyof typeof CipherType];
+```
+
+### Reactive Forms
+
+```typescript
+protected formGroup = new FormGroup({
+  name: new FormControl('', { nonNullable: true }),
+  email: new FormControl<string>('', { validators: [Validators.email] }),
+});
+```
+
+## Anti-Patterns to Avoid
+
+- ❌ Manually refactoring when CLI migrations exist
+- ❌ Manual subscriptions without `takeUntilDestroyed()`
+- ❌ TypeScript enums (use const objects per ADR-0025)
+- ❌ Mixing constructor injection with `inject()`
+- ❌ Signals in services shared with non-Angular code (ADR-0003)
+- ❌ Business logic in components
+- ❌ Code regions
+- ❌ Converting service observables to signals (ADR-0003)
+- ❌ Using `effect()` for derived state (use `computed()`)
+- ❌ Using `ngClass`/`ngStyle` (use `[class.*]`/`[style.*]`)
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ed7fcac96e6..89fff27b217 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -8,7 +8,9 @@
 apps/desktop/desktop_native @bitwarden/team-platform-dev
 apps/desktop/desktop_native/objc/src/native/autofill @bitwarden/team-autofill-desktop-dev
 apps/desktop/desktop_native/core/src/autofill @bitwarden/team-autofill-desktop-dev
+apps/desktop/desktop_native/macos_provider @bitwarden/team-autofill-desktop-dev
 apps/desktop/desktop_native/core/src/secure_memory @bitwarden/team-key-management-dev
+
 ## No ownership for Cargo.lock and Cargo.toml to allow dependency updates
 apps/desktop/desktop_native/Cargo.lock
 apps/desktop/desktop_native/Cargo.toml
diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 997812735de..96e16776545 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -197,7 +197,6 @@
         "nx",
         "oo7",
         "oslog",
-        "parse5",
         "pin-project",
         "pkg",
         "postcss",
@@ -215,6 +214,8 @@
         "simplelog",
         "style-loader",
         "sysinfo",
+        "tokio",
+        "tokio-util",
         "tracing",
         "tracing-subscriber",
         "ts-node",
@@ -261,6 +262,11 @@
       groupName: "windows",
       matchPackageNames: ["windows", "windows-core", "windows-future", "windows-registry"],
     },
+    {
+      // We need to group all tokio-related packages together to avoid build errors caused by version incompatibilities.
+      groupName: "tokio",
+      matchPackageNames: ["bytes", "tokio", "tokio-util"],
+    },
     {
       // We group all webpack build-related minor and patch updates together to reduce PR noise.
       // We include patch updates here because we want PRs for webpack patch updates and it's in this group.
diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index 03a09ac8c48..6978edd8b3c 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -175,9 +175,23 @@ jobs:
       - name: Check out repo
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
+          fetch-depth: 1
           ref: ${{  github.event.pull_request.head.sha }}
           persist-credentials: false
 
+      - name: Free disk space for build
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/share/swift
+          sudo rm -rf /usr/local/.ghcup
+          sudo rm -rf /usr/share/miniconda
+          sudo rm -rf /usr/share/az_*
+          sudo rm -rf /usr/local/julia*
+          sudo rm -rf /usr/lib/mono
+          sudo rm -rf /usr/lib/heroku
+          sudo rm -rf /usr/local/aws-cli
+          sudo rm -rf /usr/local/aws-sam-cli
+
       - name: Set up Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
@@ -186,7 +200,7 @@ jobs:
           node-version: ${{ env._NODE_VERSION }}
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -195,7 +209,7 @@ jobs:
       - name: Set up environment
         run: |
           sudo apt-get update
-          sudo apt-get -y install pkg-config libxss-dev rpm musl-dev musl-tools flatpak flatpak-builder
+          sudo apt-get -y install pkg-config libxss-dev rpm flatpak flatpak-builder
 
       - name: Set up Snap
         run: sudo snap install snapcraft --classic
@@ -248,10 +262,10 @@ jobs:
         env:
           PKG_CONFIG_ALLOW_CROSS: true
           PKG_CONFIG_ALL_STATIC: true
-          TARGET: musl
+        # Note: It is important that we use the release build because some compute heavy
+        # operations such as key derivation for oo7 on linux are too slow in debug mode
         run: |
-          rustup target add x86_64-unknown-linux-musl
-          node build.js --target=x86_64-unknown-linux-musl
+          node build.js --release
 
       - name: Build application
         run: npm run dist:lin
@@ -342,7 +356,7 @@ jobs:
           node-version: ${{ env._NODE_VERSION }}
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -351,7 +365,7 @@ jobs:
       - name: Set up environment
         run: |
           sudo apt-get update
-          sudo apt-get -y install pkg-config libxss-dev rpm musl-dev musl-tools flatpak flatpak-builder squashfs-tools ruby ruby-dev rubygems build-essential
+          sudo apt-get -y install pkg-config libxss-dev rpm flatpak flatpak-builder squashfs-tools ruby ruby-dev rubygems build-essential
           sudo gem install --no-document fpm
 
       - name: Set up Snap
@@ -411,10 +425,10 @@ jobs:
         env:
           PKG_CONFIG_ALLOW_CROSS: true
           PKG_CONFIG_ALL_STATIC: true
-          TARGET: musl
+        # Note: It is important that we use the release build because some compute heavy
+        # operations such as key derivation for oo7 on linux are too slow in debug mode
         run: |
-          rustup target add aarch64-unknown-linux-musl
-          node build.js --target=aarch64-unknown-linux-musl
+          node build.js --release
 
       - name: Check index.d.ts generated
         if: github.event_name == 'pull_request' && steps.cache.outputs.cache-hit != 'true'
@@ -490,7 +504,7 @@ jobs:
           node-version: ${{ env._NODE_VERSION }}
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -756,7 +770,7 @@ jobs:
           node-version: ${{ env._NODE_VERSION }}
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -1001,13 +1015,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.14.2'
 
       - name: Set up Node-gyp
-        run: python3 -m pip install setuptools
+        run: python -m pip install setuptools
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -1020,6 +1034,7 @@ jobs:
           rustup show
           echo "GitHub ref: $GITHUB_REF"
           echo "GitHub event: $GITHUB_EVENT"
+          xcodebuild -showsdks
 
       - name: Cache Build
         id: build-cache
@@ -1238,13 +1253,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.14.2'
 
       - name: Set up Node-gyp
-        run: python3 -m pip install setuptools
+        run: python -m pip install setuptools
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -1257,6 +1272,7 @@ jobs:
           rustup show
           echo "GitHub ref: $GITHUB_REF"
           echo "GitHub event: $GITHUB_EVENT"
+          xcodebuild -showsdks
 
       - name: Get Build Cache
         id: build-cache
@@ -1510,13 +1526,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
-          python-version: '3.14'
+          python-version: '3.14.2'
 
       - name: Set up Node-gyp
-        run: python3 -m pip install setuptools
+        run: python -m pip install setuptools
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: |
             apps/desktop/desktop_native -> target
@@ -1529,6 +1545,7 @@ jobs:
           rustup show
           echo "GitHub ref: $GITHUB_REF"
           echo "GitHub event: $GITHUB_EVENT"
+          xcodebuild -showsdks
 
       - name: Get Build Cache
         id: build-cache
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 48d3eca2f4e..f2e6db96b30 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -52,6 +52,7 @@ jobs:
             ! -path "*/Cargo.lock" \
             ! -path "./apps/desktop/macos/*" \
             ! -path "*/CLAUDE.md" \
+            ! -path "*/SKILL.md" \
             > tmp.txt
           diff <(sort .github/whitelist-capital-letters.txt) <(sort tmp.txt)
 
diff --git a/.github/workflows/publish-web.yml b/.github/workflows/publish-web.yml
index 62d9342cf61..fb1de5a1bc5 100644
--- a/.github/workflows/publish-web.yml
+++ b/.github/workflows/publish-web.yml
@@ -187,6 +187,8 @@ jobs:
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
           private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: self-host
 
       - name: Trigger Bitwarden lite build
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
diff --git a/.github/workflows/repository-management.yml b/.github/workflows/repository-management.yml
index faf119cce2b..0a343be878c 100644
--- a/.github/workflows/repository-management.yml
+++ b/.github/workflows/repository-management.yml
@@ -29,7 +29,7 @@ on:
         default: false
       target_ref:
         default: "main"
-        description: "Branch/Tag to target for cut"
+        description: "Branch/Tag to target for cut (ignored if not cutting rc)"
         required: true
         type: string
       version_number_override:
@@ -102,11 +102,12 @@ jobs:
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
           private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          permission-contents: write # for committing and pushing to current branch
 
       - name: Check out branch
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
-          ref: main
+          ref: ${{ github.ref }}
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
@@ -467,6 +468,7 @@ jobs:
         with:
           app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
           private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          permission-contents: write # for creating and pushing new branch
 
       - name: Check out target ref
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml
index 246e0d48c5d..2a27a9b3101 100644
--- a/.github/workflows/stale-bot.yml
+++ b/.github/workflows/stale-bot.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
     steps:
       - name: 'Run stale action'
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           stale-issue-label: 'needs-reply'
           stale-pr-label: 'needs-changes'
diff --git a/.github/workflows/test-browser-interactions.yml b/.github/workflows/test-browser-interactions.yml
index dfc0f28b9c6..c8f4c959c52 100644
--- a/.github/workflows/test-browser-interactions.yml
+++ b/.github/workflows/test-browser-interactions.yml
@@ -75,7 +75,7 @@ jobs:
 
     - name: Trigger test-all workflow in browser-interactions-testing
       if: steps.changed-files.outputs.monitored == 'true'
-      uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
+      uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
       with:
         token: ${{ steps.app-token.outputs.token }}
         repository: "bitwarden/browser-interactions-testing"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f53bfc39d36..faee7220e7b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -148,7 +148,7 @@ jobs:
           components: llvm-tools
 
       - name: Cache cargo registry
-        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
         with:
           workspaces: "apps/desktop/desktop_native -> target"
 
diff --git a/.storybook/preview.tsx b/.storybook/preview.tsx
index 5a75a21dcd8..266cf79d8b1 100644
--- a/.storybook/preview.tsx
+++ b/.storybook/preview.tsx
@@ -28,7 +28,7 @@ const preview: Preview = {
   ],
   parameters: {
     a11y: {
-      element: "#storybook-root",
+      context: "#storybook-root",
     },
     controls: {
       matchers: {
diff --git a/apps/browser/src/_locales/ar/messages.json b/apps/browser/src/_locales/ar/messages.json
index 03d5eb0a9f6..452cbafe6d5 100644
--- a/apps/browser/src/_locales/ar/messages.json
+++ b/apps/browser/src/_locales/ar/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "معرفة المزيد"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "مفتاح المصادقة (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 جيغابايت وحدة تخزين مشفرة لمرفقات الملفات."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "الوصول الطارئ."
   },
diff --git a/apps/browser/src/_locales/az/messages.json b/apps/browser/src/_locales/az/messages.json
index 7dbd1ba3e7c..c4197f831d3 100644
--- a/apps/browser/src/_locales/az/messages.json
+++ b/apps/browser/src/_locales/az/messages.json
@@ -586,7 +586,7 @@
     "message": "Arxivlənmiş elementlər ümumi axtarış nəticələrindən və avto-doldurma təkliflərindən xaric ediləcək. Bu elementi arxivləmək istədiyinizə əminsiniz?"
   },
   "upgradeToUseArchive": {
-    "message": "A premium membership is required to use Archive."
+    "message": "Arxivi istifadə etmək üçün premium üzvlük tələb olunur."
   },
   "edit": {
     "message": "Düzəliş et"
@@ -598,7 +598,7 @@
     "message": "Hamısına bax"
   },
   "showAll": {
-    "message": "Show all"
+    "message": "Hamısını göstər"
   },
   "viewLess": {
     "message": "Daha azına bax"
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Daha ətraflı"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Kimlik doğrulayıcı açarı (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "Fayl qoşmaları üçün 1 GB şifrələnmiş anbar sahəsi"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Fövqəladə hal erişimi."
   },
@@ -1874,7 +1904,7 @@
     "message": "Son istifadə ili"
   },
   "monthly": {
-    "message": "month"
+    "message": "ay"
   },
   "expiration": {
     "message": "Bitmə vaxtı"
@@ -4912,7 +4942,7 @@
     "message": "Premium"
   },
   "unlockFeaturesWithPremium": {
-    "message": "Unlock reporting, emergency access, and more security features with Premium."
+    "message": "Premium ilə şikayət göndərmə, fövqəladə hal erişimi və daha çox təhlükəsizlik özəlliyinin kilidini açın."
   },
   "freeOrgsCannotUseAttachments": {
     "message": "Ödənişsiz təşkilatlar qoşmaları istifadə edə bilməz"
@@ -5825,10 +5855,10 @@
     "message": "\"Premium\"a yüksəlt"
   },
   "unlockAdvancedSecurity": {
-    "message": "Unlock advanced security features"
+    "message": "Qabaqcıl təhlükəsizlik özəlliklərinin kilidini aç"
   },
   "unlockAdvancedSecurityDesc": {
-    "message": "A Premium subscription gives you more tools to stay secure and in control"
+    "message": "Premium abunəlik, güvəndə qalmağınız və nəzarəti əlinizdə saxlamağınız üçün sizə daha çox alət verir"
   },
   "explorePremium": {
     "message": "Premium-u kəşf et"
diff --git a/apps/browser/src/_locales/be/messages.json b/apps/browser/src/_locales/be/messages.json
index 89651f0038e..806aedfab27 100644
--- a/apps/browser/src/_locales/be/messages.json
+++ b/apps/browser/src/_locales/be/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Даведацца больш"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Ключ аўтэнтыфікацыі (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 ГБ зашыфраванага сховішча для далучаных файлаў."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Экстранны доступ."
   },
diff --git a/apps/browser/src/_locales/bg/messages.json b/apps/browser/src/_locales/bg/messages.json
index b40f4b91cb4..76b20f8bd2e 100644
--- a/apps/browser/src/_locales/bg/messages.json
+++ b/apps/browser/src/_locales/bg/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Научете повече"
   },
+  "migrationsFailed": {
+    "message": "Възникна грешка при обновяването на настройките за шифроване."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновете настройките си за шифроване"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новите препоръчани настройки за шифроване ще подобрят сигурността на акаунта Ви. Въведете главната си парола, за да ги обновите сега."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Потвърдете самоличността си, за да продължите"
+  },
+  "enterYourMasterPassword": {
+    "message": "Въведете главната си парола"
+  },
+  "updateSettings": {
+    "message": "Обновяване на настройките"
+  },
+  "later": {
+    "message": "По-късно"
+  },
   "authenticatorKeyTotp": {
     "message": "Удостоверителен ключ (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB пространство за файлове, които се шифрират."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ пространство за файлове, които се шифрират.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Авариен достъп"
   },
diff --git a/apps/browser/src/_locales/bn/messages.json b/apps/browser/src/_locales/bn/messages.json
index 4f8e7054305..4845282e825 100644
--- a/apps/browser/src/_locales/bn/messages.json
+++ b/apps/browser/src/_locales/bn/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "আরও জানুন"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "প্রমাণীকরণকারী কী (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "ফাইল সংযুক্তির জন্য ১ জিবি এনক্রিপ্টেড স্থান।"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/bs/messages.json b/apps/browser/src/_locales/bs/messages.json
index 9d5631c47e2..cff1dd150cb 100644
--- a/apps/browser/src/_locales/bs/messages.json
+++ b/apps/browser/src/_locales/bs/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/ca/messages.json b/apps/browser/src/_locales/ca/messages.json
index 255263a6da7..ff0e2de51af 100644
--- a/apps/browser/src/_locales/ca/messages.json
+++ b/apps/browser/src/_locales/ca/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Més informació"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Clau d'autenticació (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB d'emmagatzematge xifrat per als fitxers adjunts."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Accés d’emergència."
   },
diff --git a/apps/browser/src/_locales/cs/messages.json b/apps/browser/src/_locales/cs/messages.json
index eff2c6c0ea7..fa8dc426c05 100644
--- a/apps/browser/src/_locales/cs/messages.json
+++ b/apps/browser/src/_locales/cs/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Dozvědět se více"
   },
+  "migrationsFailed": {
+    "message": "Došlo k chybě při aktualizaci nastavení šifrování."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aktualizovat nastavení šifrování"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Nové doporučené nastavení šifrování zlepší bezpečnost Vašeho účtu. Pokud chcete aktualizovat nyní, zadejte hlavní heslo."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Pro pokračování potvrďte svou identitu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Zadejte své hlavní heslo"
+  },
+  "updateSettings": {
+    "message": "Aktualizovat nastavení"
+  },
+  "later": {
+    "message": "Později"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentizační klíč (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB šifrovaného úložiště pro přílohy."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrovaného úložiště pro přílohy.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Nouzový přístup"
   },
diff --git a/apps/browser/src/_locales/cy/messages.json b/apps/browser/src/_locales/cy/messages.json
index 99fcdffcc97..45f91f5ccc7 100644
--- a/apps/browser/src/_locales/cy/messages.json
+++ b/apps/browser/src/_locales/cy/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Dysgu mwy"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "Storfa 1GB wedi'i hamgryptio ar gyfer atodiadau ffeiliau."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/da/messages.json b/apps/browser/src/_locales/da/messages.json
index 865e6ff7dda..50d79ff1f9d 100644
--- a/apps/browser/src/_locales/da/messages.json
+++ b/apps/browser/src/_locales/da/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Lær mere"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentificeringsnøgle (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB krypteret lager til vedhæftede filer."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Nødadgang"
   },
diff --git a/apps/browser/src/_locales/de/messages.json b/apps/browser/src/_locales/de/messages.json
index c013e4516ed..969f8c63de3 100644
--- a/apps/browser/src/_locales/de/messages.json
+++ b/apps/browser/src/_locales/de/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Erfahre mehr"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authentifizierungsschlüssel (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB verschlüsselter Speicherplatz für Dateianhänge."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ verschlüsselter Speicher für Dateianhänge.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Notfallzugriff."
   },
@@ -2446,7 +2476,7 @@
     }
   },
   "topLayerHijackWarning": {
-    "message": "Diese Seite stört die Bitwarden-Nutzung. Das Bitwarden Inline-Menü wurde aus Sicherheitsgründen vorübergehend deaktiviert."
+    "message": "Diese Seite beeinträchtigt die Nutzung von Bitwarden. Das Bitwarden Inline-Menü wurde aus Sicherheitsgründen vorübergehend deaktiviert."
   },
   "setMasterPassword": {
     "message": "Master-Passwort festlegen"
@@ -5813,7 +5843,7 @@
     "message": "Notfallzugriff"
   },
   "breachMonitoring": {
-    "message": "Datenleck-Überwachung"
+    "message": "Datendiebstahl-Überwachung"
   },
   "andMoreFeatures": {
     "message": "Und mehr!"
diff --git a/apps/browser/src/_locales/el/messages.json b/apps/browser/src/_locales/el/messages.json
index 476a6165a8e..2be53da65ec 100644
--- a/apps/browser/src/_locales/el/messages.json
+++ b/apps/browser/src/_locales/el/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Μάθετε περισσότερα"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Κλειδί επαλήθευσης (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB κρυπτογραφημένο αποθηκευτικό χώρο για συνημμένα αρχεία."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Πρόσβαση έκτακτης ανάγκης."
   },
diff --git a/apps/browser/src/_locales/en/messages.json b/apps/browser/src/_locales/en/messages.json
index 21149499485..09ea964823c 100644
--- a/apps/browser/src/_locales/en/messages.json
+++ b/apps/browser/src/_locales/en/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1436,6 +1457,15 @@
   "attachmentSaved": {
     "message": "Attachment saved"
   },
+  "fixEncryption": {
+    "message": "Fix encryption"
+  },
+  "fixEncryptionTooltip": {
+    "message": "This file is using an outdated encryption method."
+  },
+  "attachmentUpdated": {
+    "message": "Attachment updated"
+  },
   "file": {
     "message": "File"
   },
@@ -1445,6 +1475,9 @@
   "selectFile": {
     "message": "Select a file"
   },
+  "itemsTransferred": {
+    "message": "Items transferred"
+  },
   "maxFileSize": {
     "message": "Maximum file size is 500 MB."
   },
@@ -1475,6 +1508,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
@@ -3210,9 +3252,6 @@
   "copyCustomFieldNameNotUnique": {
     "message": "No unique identifier found."
   },
-  "removeMasterPasswordForOrganizationUserKeyConnector": {
-    "message": "A master password is no longer required for members of the following organization. Please confirm the domain below with your organization administrator."
-  },
   "organizationName": {
     "message": "Organization name"
   },
@@ -5818,8 +5857,8 @@
   "andMoreFeatures": {
     "message": "And more!"
   },
-  "planDescPremium": {
-    "message": "Complete online security"
+  "advancedOnlineSecurity": {
+    "message": "Advanced online security"
   },
   "upgradeToPremium": {
     "message": "Upgrade to Premium"
@@ -5849,7 +5888,141 @@
   "cardNumberLabel": {
     "message": "Card number"
   },
+  "removeMasterPasswordForOrgUserKeyConnector":{
+    "message": "Your organization is no longer using master passwords to log into Bitwarden. To continue, verify the organization and domain."
+  },
+  "continueWithLogIn": {
+    "message": "Continue with log in"
+  },
+  "doNotContinue": {
+    "message": "Do not continue"
+  },
+  "domain": {
+    "message": "Domain"
+  },
+  "keyConnectorDomainTooltip": {
+    "message": "This domain will store your account encryption keys, so make sure you trust it. If you're not sure, check with your admin."
+  },
+  "verifyYourOrganization": {
+    "message": "Verify your organization to log in"
+  },
+  "organizationVerified":{
+    "message": "Organization verified"
+  },
+  "domainVerified":{
+    "message": "Domain verified"
+  },
+  "leaveOrganizationContent": {
+    "message": "If you don't verify your organization, your access to the organization will be revoked."
+  },
+  "leaveNow": {
+    "message": "Leave now"
+  },
+  "verifyYourDomainToLogin": {
+    "message": "Verify your domain to log in"
+  },
+  "verifyYourDomainDescription": {
+    "message": "To continue with log in, verify this domain."
+  },
+  "confirmKeyConnectorOrganizationUserDescription": {
+    "message": "To continue with log in, verify the organization and domain."
+  },
   "sessionTimeoutSettingsAction": {
     "message": "Timeout action"
+  },
+  "sessionTimeoutSettingsManagedByOrganization": {
+    "message": "This setting is managed by your organization."
+  },
+  "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes": {
+    "message": "Your organization has set the maximum session timeout to $HOURS$ hour(s) and $MINUTES$ minute(s).",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "8"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "2"
+      }
+    }
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToImmediately": {
+    "message": "Your organization has set the default session timeout to Immediately."
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToOnLocked": {
+    "message": "Your organization has set the default session timeout to On system lock."
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart": {
+    "message": "Your organization has set the default session timeout to On browser restart."
+  },
+  "sessionTimeoutSettingsPolicyMaximumError": {
+    "message": "Maximum timeout cannot exceed $HOURS$ hour(s) and $MINUTES$ minute(s)",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "5"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "5"
+      }
+    }
+  },
+  "sessionTimeoutOnRestart": {
+    "message": "On browser restart"
+  },
+  "sessionTimeoutSettingsSetUnlockMethodToChangeTimeoutAction": {
+    "message": "Set an unlock method to change your timeout action"
+  },
+  "upgrade": {
+    "message": "Upgrade"
+  },
+  "leaveConfirmationDialogTitle": {
+    "message": "Are you sure you want to leave?"
+  },
+  "leaveConfirmationDialogContentOne": {
+    "message": "By declining, your personal items will stay in your account, but you'll lose access to shared items and organization features."
+  },
+  "leaveConfirmationDialogContentTwo": {
+    "message": "Contact your admin to regain access."
+  },
+  "leaveConfirmationDialogConfirmButton": {
+    "message": "Leave $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"
+      }
+    }
+  },
+  "howToManageMyVault": {
+    "message": "How do I manage my vault?"
+  },
+  "transferItemsToOrganizationTitle": {
+    "message": "Transfer items to $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "transferItemsToOrganizationContent": {
+    "message": "$ORGANIZATION$ is requiring all items to be owned by the organization for security and compliance. Click accept to transfer ownership of your items.",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "acceptTransfer": {
+    "message": "Accept transfer"
+  },
+  "declineAndLeave": {
+    "message": "Decline and leave"
+  },
+  "whyAmISeeingThis": {
+    "message": "Why am I seeing this?"
   }
 }
diff --git a/apps/browser/src/_locales/en_GB/messages.json b/apps/browser/src/_locales/en_GB/messages.json
index 103d45f0685..63d9214632a 100644
--- a/apps/browser/src/_locales/en_GB/messages.json
+++ b/apps/browser/src/_locales/en_GB/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access"
   },
diff --git a/apps/browser/src/_locales/en_IN/messages.json b/apps/browser/src/_locales/en_IN/messages.json
index 2713381986c..9ef5cb2a061 100644
--- a/apps/browser/src/_locales/en_IN/messages.json
+++ b/apps/browser/src/_locales/en_IN/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access"
   },
diff --git a/apps/browser/src/_locales/es/messages.json b/apps/browser/src/_locales/es/messages.json
index e19bd11ba28..92f6226a3de 100644
--- a/apps/browser/src/_locales/es/messages.json
+++ b/apps/browser/src/_locales/es/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Más información"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Clave de autenticación (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB de espacio cifrado en disco para adjuntos."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Acceso de emergencia."
   },
diff --git a/apps/browser/src/_locales/et/messages.json b/apps/browser/src/_locales/et/messages.json
index 7a9737f71ff..bade6b0dff9 100644
--- a/apps/browser/src/_locales/et/messages.json
+++ b/apps/browser/src/_locales/et/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Loe edasi"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentimise võti (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB ulatuses krüpteeritud salvestusruum."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/eu/messages.json b/apps/browser/src/_locales/eu/messages.json
index b61213da989..90cfc13f6ef 100644
--- a/apps/browser/src/_locales/eu/messages.json
+++ b/apps/browser/src/_locales/eu/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Gehiago ikasi"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentifikazio-gakoa (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "Eranskinentzako 1GB-eko zifratutako biltegia."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/fa/messages.json b/apps/browser/src/_locales/fa/messages.json
index 550de006cf6..7a4c8744429 100644
--- a/apps/browser/src/_locales/fa/messages.json
+++ b/apps/browser/src/_locales/fa/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "بیشتر بدانید"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "کلید احراز هویت (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "۱ گیگابایت فضای ذخیره‌سازی رمزگذاری شده برای پیوست‌های پرونده."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "دسترسی اضطراری."
   },
diff --git a/apps/browser/src/_locales/fi/messages.json b/apps/browser/src/_locales/fi/messages.json
index bdf2ebd641c..d7f0f600b9e 100644
--- a/apps/browser/src/_locales/fi/messages.json
+++ b/apps/browser/src/_locales/fi/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Lue lisää"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Todennusavain (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 Gt salattua tallennustilaa tiedostoliitteille."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Varmuuskäyttö"
   },
diff --git a/apps/browser/src/_locales/fil/messages.json b/apps/browser/src/_locales/fil/messages.json
index 31284265b2e..50964716ad0 100644
--- a/apps/browser/src/_locales/fil/messages.json
+++ b/apps/browser/src/_locales/fil/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Matuto nang higit pa"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Susi ng Authenticator (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage para sa mga file attachment."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/fr/messages.json b/apps/browser/src/_locales/fr/messages.json
index dadcd0c041e..6ddf7ea5873 100644
--- a/apps/browser/src/_locales/fr/messages.json
+++ b/apps/browser/src/_locales/fr/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "En savoir plus"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Clé Authenticator (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 Go de stockage chiffré pour les fichiers joints."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Accès d'urgence."
   },
diff --git a/apps/browser/src/_locales/gl/messages.json b/apps/browser/src/_locales/gl/messages.json
index bd657b9d4b7..5695ae16035 100644
--- a/apps/browser/src/_locales/gl/messages.json
+++ b/apps/browser/src/_locales/gl/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Máis información"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Clave de autenticación (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB de almacenamento cifrado para arquivos anexos."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Acceso de emerxencia."
   },
diff --git a/apps/browser/src/_locales/he/messages.json b/apps/browser/src/_locales/he/messages.json
index 2e9243206b9..67ca71338b2 100644
--- a/apps/browser/src/_locales/he/messages.json
+++ b/apps/browser/src/_locales/he/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "למידע נוסף"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "מפתח מאמת (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 ג'יגה של מקום אחסון עבור קבצים מצורפים."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "גישת חירום."
   },
diff --git a/apps/browser/src/_locales/hi/messages.json b/apps/browser/src/_locales/hi/messages.json
index 58db7ac8ad6..b839e31cd96 100644
--- a/apps/browser/src/_locales/hi/messages.json
+++ b/apps/browser/src/_locales/hi/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "अधिक जानें"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator Key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB of encrypted file storage."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/hr/messages.json b/apps/browser/src/_locales/hr/messages.json
index 8a5a09aec9c..da78924b1eb 100644
--- a/apps/browser/src/_locales/hr/messages.json
+++ b/apps/browser/src/_locales/hr/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Saznaj više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Ključ autentifikatora (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB šifriranog prostora za pohranu podataka."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Pristup u nuždi."
   },
diff --git a/apps/browser/src/_locales/hu/messages.json b/apps/browser/src/_locales/hu/messages.json
index bacda584ba1..388a069e05a 100644
--- a/apps/browser/src/_locales/hu/messages.json
+++ b/apps/browser/src/_locales/hu/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Tudjon meg többet"
   },
+  "migrationsFailed": {
+    "message": "Hiba történt a titkosítási beállítások frissítésekor."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "A titkosítási beállítások frissítése"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Az új ajánlott titkosítási beállítások javítják a fiók biztonságát. Adjuk meg a mesterjelszót a frissítéshez most."
+  },
+  "confirmIdentityToContinue": {
+    "message": "A folytatáshoz meg kell erősíteni a személyazonosságot."
+  },
+  "enterYourMasterPassword": {
+    "message": "Mesterjelszó megadása"
+  },
+  "updateSettings": {
+    "message": "Beállítások frissítése"
+  },
+  "later": {
+    "message": "Később"
+  },
   "authenticatorKeyTotp": {
     "message": "Hitelesítő kulcs (egyszeri időalapú)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB titkosított tárhely a fájlmellékleteknek."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ titkosított tárhely a fájlmellékletekhez.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Sürgősségi hozzáférés"
   },
diff --git a/apps/browser/src/_locales/id/messages.json b/apps/browser/src/_locales/id/messages.json
index 88147f804d1..d18b25c51ed 100644
--- a/apps/browser/src/_locales/id/messages.json
+++ b/apps/browser/src/_locales/id/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Pelajari lebih lanjut"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Kunci Otentikasi (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB penyimpanan berkas yang dienkripsi."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Akses darurat."
   },
diff --git a/apps/browser/src/_locales/it/messages.json b/apps/browser/src/_locales/it/messages.json
index d4d032737b8..9bb75d7f449 100644
--- a/apps/browser/src/_locales/it/messages.json
+++ b/apps/browser/src/_locales/it/messages.json
@@ -35,7 +35,7 @@
     "message": "La tua organizzazione richiede un accesso Single Sign-On (SSO)."
   },
   "welcomeBack": {
-    "message": "Bentornato/a"
+    "message": "Bentornato"
   },
   "setAStrongPassword": {
     "message": "Imposta una password robusta"
@@ -586,7 +586,7 @@
     "message": "Gli elementi archiviati sono esclusi dai risultati di ricerca e suggerimenti di autoriempimento. Vuoi davvero archiviare questo elemento?"
   },
   "upgradeToUseArchive": {
-    "message": "A premium membership is required to use Archive."
+    "message": "Per utilizzare Archivio è necessario un abbonamento premium."
   },
   "edit": {
     "message": "Modifica"
@@ -598,7 +598,7 @@
     "message": "Mostra tutto"
   },
   "showAll": {
-    "message": "Show all"
+    "message": "Mostra tutto"
   },
   "viewLess": {
     "message": "Vedi meno"
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Ulteriori informazioni"
   },
+  "migrationsFailed": {
+    "message": "Si è verificato un errore durante l'aggiornamento delle impostazioni di cifratura."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aggiorna le impostazioni di crittografia"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Le nuove impostazioni di crittografia consigliate miglioreranno la sicurezza del tuo account. Inserisci la tua password principale per aggiornare."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Conferma la tua identità per continuare"
+  },
+  "enterYourMasterPassword": {
+    "message": "Inserisci la tua password principale"
+  },
+  "updateSettings": {
+    "message": "Aggiorna impostazioni"
+  },
+  "later": {
+    "message": "Più tardi"
+  },
   "authenticatorKeyTotp": {
     "message": "Chiave di autenticazione (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB di spazio di archiviazione crittografato per gli allegati."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Archivio crittografato di $SIZE$ per allegati.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Accesso di emergenza."
   },
@@ -1874,7 +1904,7 @@
     "message": "Anno di scadenza"
   },
   "monthly": {
-    "message": "month"
+    "message": "mese"
   },
   "expiration": {
     "message": "Scadenza"
@@ -5825,10 +5855,10 @@
     "message": "Aggiorna a Premium"
   },
   "unlockAdvancedSecurity": {
-    "message": "Unlock advanced security features"
+    "message": "Sblocca funzionalità di sicurezza avanzate"
   },
   "unlockAdvancedSecurityDesc": {
-    "message": "A Premium subscription gives you more tools to stay secure and in control"
+    "message": "Un abbonamento Premium ti offre più strumenti per rimanere sicuro e in controllo"
   },
   "explorePremium": {
     "message": "Scopri Premium"
diff --git a/apps/browser/src/_locales/ja/messages.json b/apps/browser/src/_locales/ja/messages.json
index c13b139e13a..0b0883beaf3 100644
--- a/apps/browser/src/_locales/ja/messages.json
+++ b/apps/browser/src/_locales/ja/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "さらに詳しく"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "認証キー (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1GB の暗号化されたファイルストレージ"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "緊急アクセス"
   },
diff --git a/apps/browser/src/_locales/ka/messages.json b/apps/browser/src/_locales/ka/messages.json
index a54a0f2c657..ebb01f095f3 100644
--- a/apps/browser/src/_locales/ka/messages.json
+++ b/apps/browser/src/_locales/ka/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "გაიგეთ მეტი"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/km/messages.json b/apps/browser/src/_locales/km/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/km/messages.json
+++ b/apps/browser/src/_locales/km/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/kn/messages.json b/apps/browser/src/_locales/kn/messages.json
index bd2be23828c..05ea413b522 100644
--- a/apps/browser/src/_locales/kn/messages.json
+++ b/apps/browser/src/_locales/kn/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "ಇನ್ನಷ್ಟು ತಿಳಿಯಿರಿ"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "ದೃಢೀಕರಣ ಕೀ (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "ಫೈಲ್ ಲಗತ್ತುಗಳಿಗಾಗಿ 1 ಜಿಬಿ ಎನ್‌ಕ್ರಿಪ್ಟ್ ಮಾಡಿದ ಸಂಗ್ರಹ."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/ko/messages.json b/apps/browser/src/_locales/ko/messages.json
index 1ad08accfc9..b35fe8283f7 100644
--- a/apps/browser/src/_locales/ko/messages.json
+++ b/apps/browser/src/_locales/ko/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "더 알아보기"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "인증 키 (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1GB의 암호화된 파일 저장소."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "비상 접근"
   },
diff --git a/apps/browser/src/_locales/lt/messages.json b/apps/browser/src/_locales/lt/messages.json
index 46ffb24e3df..7fcc2df0330 100644
--- a/apps/browser/src/_locales/lt/messages.json
+++ b/apps/browser/src/_locales/lt/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Sužinoti daugiau"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Vienkartinio autentifikavimo raktas (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB užšifruotos vietos diske bylų prisegimams."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/lv/messages.json b/apps/browser/src/_locales/lv/messages.json
index 754781dc4f7..a719320fc8c 100644
--- a/apps/browser/src/_locales/lv/messages.json
+++ b/apps/browser/src/_locales/lv/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Uzzināt vairāk"
   },
+  "migrationsFailed": {
+    "message": "Atgadījās kļūda šifrēšanas iestatījumu atjaunināšanā."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atjaunini savus šifrēšanas iestatījumus"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Jaunie ieteicamie šifrēšanas iestatījumi uzlabos Tava konta drošību. Jāievada sava galvenā parole, lai atjauninātu tagad."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Jāapliecina sava identitāte, lai turpinātu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Jāievada sava galvenā parole"
+  },
+  "updateSettings": {
+    "message": "Atjaunināt Iestatījumus"
+  },
+  "later": {
+    "message": "Vēlāk"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentificētāja atslēga (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB šifrētas krātuves datņu pielikumiem."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrētas krātuves datņu pielikumiem.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Ārkārtas piekļuve"
   },
diff --git a/apps/browser/src/_locales/ml/messages.json b/apps/browser/src/_locales/ml/messages.json
index 2f7f8d30e74..b72d82cd93f 100644
--- a/apps/browser/src/_locales/ml/messages.json
+++ b/apps/browser/src/_locales/ml/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "കൂടുതലറിവ് നേടുക"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "ഓതന്റിക്കേറ്റർ കീ  (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "ഫയൽ അറ്റാച്ചുമെന്റുകൾക്കായി 1 ജിബി എൻക്രിപ്റ്റുചെയ്‌ത സംഭരണം."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/mr/messages.json b/apps/browser/src/_locales/mr/messages.json
index 70f8fe5393c..03c3b4a70ae 100644
--- a/apps/browser/src/_locales/mr/messages.json
+++ b/apps/browser/src/_locales/mr/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/my/messages.json b/apps/browser/src/_locales/my/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/my/messages.json
+++ b/apps/browser/src/_locales/my/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/nb/messages.json b/apps/browser/src/_locales/nb/messages.json
index 0eba9c953a3..6226d26312f 100644
--- a/apps/browser/src/_locales/nb/messages.json
+++ b/apps/browser/src/_locales/nb/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Lær mer"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentiseringsnøkkel (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB med kryptert fillagring for filvedlegg."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Nødtilgang."
   },
diff --git a/apps/browser/src/_locales/ne/messages.json b/apps/browser/src/_locales/ne/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/ne/messages.json
+++ b/apps/browser/src/_locales/ne/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/nl/messages.json b/apps/browser/src/_locales/nl/messages.json
index 601aac16f94..04e6e1bb7f3 100644
--- a/apps/browser/src/_locales/nl/messages.json
+++ b/apps/browser/src/_locales/nl/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Meer informatie"
   },
+  "migrationsFailed": {
+    "message": "Er is een fout opgetreden bij het bijwerken van de versleutelingsinstellingen."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Je versleutelingsinstellingen bijwerken"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nieuwe aanbevolen versleutelingsinstellingen verbeteren de beveiliging van je account. Voer je hoofdwachtwoord in om nu bij te werken."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bevestig je identiteit om door te gaan"
+  },
+  "enterYourMasterPassword": {
+    "message": "Voer je hoofdwachtwoord in"
+  },
+  "updateSettings": {
+    "message": "Instellingen bijwerken"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticatiecode (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB versleutelde opslag voor bijlagen."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ versleutelde opslag voor bijlagen.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Noodtoegang."
   },
diff --git a/apps/browser/src/_locales/nn/messages.json b/apps/browser/src/_locales/nn/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/nn/messages.json
+++ b/apps/browser/src/_locales/nn/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/or/messages.json b/apps/browser/src/_locales/or/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/or/messages.json
+++ b/apps/browser/src/_locales/or/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/pl/messages.json b/apps/browser/src/_locales/pl/messages.json
index 9741f94da36..24729a2331b 100644
--- a/apps/browser/src/_locales/pl/messages.json
+++ b/apps/browser/src/_locales/pl/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Dowiedz się więcej"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Klucz uwierzytelniający (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB miejsca na zaszyfrowane załączniki."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Dostęp awaryjny."
   },
diff --git a/apps/browser/src/_locales/pt_BR/messages.json b/apps/browser/src/_locales/pt_BR/messages.json
index 319d415b612..c7a5300a873 100644
--- a/apps/browser/src/_locales/pt_BR/messages.json
+++ b/apps/browser/src/_locales/pt_BR/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Saiba mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as configurações de criptografia."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize suas configurações de criptografia"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas configurações de criptografia recomendadas melhorarão a segurança da sua conta. Digite sua senha principal para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Digite sua senha principal"
+  },
+  "updateSettings": {
+    "message": "Atualizar configurações"
+  },
+  "later": {
+    "message": "Depois"
+  },
   "authenticatorKeyTotp": {
     "message": "Chave do autenticador (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB de armazenamento criptografado para anexo de arquivos."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento criptografado para anexos de arquivo.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Acesso de emergência."
   },
diff --git a/apps/browser/src/_locales/pt_PT/messages.json b/apps/browser/src/_locales/pt_PT/messages.json
index 6b8568ddb1b..c03f3038f98 100644
--- a/apps/browser/src/_locales/pt_PT/messages.json
+++ b/apps/browser/src/_locales/pt_PT/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Saber mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as definições de encriptação."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize as suas definições de encriptação"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas definições de encriptação recomendadas irão melhorar a segurança da sua conta. Introduza a sua palavra-passe mestra para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme a sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Introduza a sua palavra-passe mestra"
+  },
+  "updateSettings": {
+    "message": "Atualizar definições"
+  },
+  "later": {
+    "message": "Mais tarde"
+  },
   "authenticatorKeyTotp": {
     "message": "Chave de autenticação (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB de armazenamento encriptado para anexos de ficheiros."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento encriptado para anexos de ficheiros.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Acesso de emergência."
   },
diff --git a/apps/browser/src/_locales/ro/messages.json b/apps/browser/src/_locales/ro/messages.json
index db7a1b8c657..85db8d8a4f3 100644
--- a/apps/browser/src/_locales/ro/messages.json
+++ b/apps/browser/src/_locales/ro/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Aflați mai multe"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Cheie de autentificare (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB spațiu de stocare criptat pentru atașamente de fișiere."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/ru/messages.json b/apps/browser/src/_locales/ru/messages.json
index 0535027daa9..58f2b372459 100644
--- a/apps/browser/src/_locales/ru/messages.json
+++ b/apps/browser/src/_locales/ru/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Подробнее"
   },
+  "migrationsFailed": {
+    "message": "Произошла ошибка при обновлении настроек шифрования."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновите настройки шифрования"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новые рекомендуемые настройки шифрования повысят безопасность вашего аккаунта. Введите мастер-пароль, чтобы обновить сейчас."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Подтвердите вашу личность, чтобы продолжить"
+  },
+  "enterYourMasterPassword": {
+    "message": "Введите ваш мастер-пароль"
+  },
+  "updateSettings": {
+    "message": "Обновить настройки"
+  },
+  "later": {
+    "message": "Позже"
+  },
   "authenticatorKeyTotp": {
     "message": "Ключ аутентификатора (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 ГБ зашифрованного хранилища для вложенных файлов."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Зашифрованного хранилища для вложенных файлов: $SIZE$",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Экстренный доступ"
   },
diff --git a/apps/browser/src/_locales/si/messages.json b/apps/browser/src/_locales/si/messages.json
index bb46b283322..ead646d0ac0 100644
--- a/apps/browser/src/_locales/si/messages.json
+++ b/apps/browser/src/_locales/si/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "වැඩිදුර ඉගෙන ගන්න"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "සත්යාපන යතුර (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "ගොනු ඇමුණුම් සඳහා 1 GB සංකේතාත්මක ගබඩා."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/sk/messages.json b/apps/browser/src/_locales/sk/messages.json
index 283442d95da..70620e6c5e5 100644
--- a/apps/browser/src/_locales/sk/messages.json
+++ b/apps/browser/src/_locales/sk/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Zistiť viac"
   },
+  "migrationsFailed": {
+    "message": "Pri aktualizácii nastavení šifrovania došlo k chybe."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aktualizujte nastavenie šifrovania"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Nové odporúčané nastavenia šifrovania zlepšia bezpečnosť vášho účtu. Ak ich chcete aktualizovať teraz, zadajte hlavné heslo."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Ak chcete pokračovať, potvrďte svoju identitu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Zadajte hlavné heslo"
+  },
+  "updateSettings": {
+    "message": "Aktualizovať nastavenia"
+  },
+  "later": {
+    "message": "Neskôr"
+  },
   "authenticatorKeyTotp": {
     "message": "Overovací kľúč (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB šifrovaného úložiska na prílohy."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrovaného úložiska na prílohy.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Núdzový prístup."
   },
diff --git a/apps/browser/src/_locales/sl/messages.json b/apps/browser/src/_locales/sl/messages.json
index 2d20050d7f1..4867f4b89f2 100644
--- a/apps/browser/src/_locales/sl/messages.json
+++ b/apps/browser/src/_locales/sl/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Več o tem"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Ključ avtentikatorja (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB šifriranega prostora za shrambo podatkov."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/sr/messages.json b/apps/browser/src/_locales/sr/messages.json
index 0c7562987fc..c04c113caca 100644
--- a/apps/browser/src/_locales/sr/messages.json
+++ b/apps/browser/src/_locales/sr/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Сазнај више"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Једнократни код"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1ГБ шифровано складиште за прилоге."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Хитан приступ."
   },
diff --git a/apps/browser/src/_locales/sv/messages.json b/apps/browser/src/_locales/sv/messages.json
index f5d55585b80..a6cf12541fd 100644
--- a/apps/browser/src/_locales/sv/messages.json
+++ b/apps/browser/src/_locales/sv/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Läs mer"
   },
+  "migrationsFailed": {
+    "message": "Ett fel inträffade när krypteringsinställningarna skulle uppdateras."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Uppdatera dina krypteringsinställningar"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nya rekommenderade krypteringsinställningarna kommer att förbättra säkerheten för ditt konto. Ange ditt huvudlösenord för att uppdatera nu."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bekräfta din identitet för att fortsätta"
+  },
+  "enterYourMasterPassword": {
+    "message": "Ange ditt huvudlösenord"
+  },
+  "updateSettings": {
+    "message": "Uppdatera inställningar"
+  },
+  "later": {
+    "message": "Senare"
+  },
   "authenticatorKeyTotp": {
     "message": "Autentiseringsnyckel (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB lagring av krypterade filer."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ krypterad lagring för filbilagor.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Nödåtkomst."
   },
diff --git a/apps/browser/src/_locales/ta/messages.json b/apps/browser/src/_locales/ta/messages.json
index 4d185501855..934cb8e1a01 100644
--- a/apps/browser/src/_locales/ta/messages.json
+++ b/apps/browser/src/_locales/ta/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "மேலும் அறிக"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "அங்கீகரிப்பு விசை (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "கோப்பு இணைப்புகளுக்கு 1 GB என்க்ரிப்ட் செய்யப்பட்ட ஸ்டோரேஜ்."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "அவசர அணுகல்."
   },
diff --git a/apps/browser/src/_locales/te/messages.json b/apps/browser/src/_locales/te/messages.json
index f829937ac51..684a04d9175 100644
--- a/apps/browser/src/_locales/te/messages.json
+++ b/apps/browser/src/_locales/te/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/th/messages.json b/apps/browser/src/_locales/th/messages.json
index ef6ba5b2077..bade59ad99b 100644
--- a/apps/browser/src/_locales/th/messages.json
+++ b/apps/browser/src/_locales/th/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "เรียนรู้เพิ่มเติม"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Authenticator Key (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 GB of encrypted file storage."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Emergency access."
   },
diff --git a/apps/browser/src/_locales/tr/messages.json b/apps/browser/src/_locales/tr/messages.json
index e6004ef387f..0ba7e2ffec3 100644
--- a/apps/browser/src/_locales/tr/messages.json
+++ b/apps/browser/src/_locales/tr/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Daha fazla bilgi al"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Kimlik doğrulama anahtarı (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "Dosya ekleri için 1 GB şifrelenmiş depolama."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Dosya ekleri için $SIZE$ şifrelenmiş depolama.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Acil durum erişimi."
   },
diff --git a/apps/browser/src/_locales/uk/messages.json b/apps/browser/src/_locales/uk/messages.json
index a1922a5abd8..147e63cce02 100644
--- a/apps/browser/src/_locales/uk/messages.json
+++ b/apps/browser/src/_locales/uk/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Докладніше"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Ключ автентифікації (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1 ГБ зашифрованого сховища для файлів."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Екстрений доступ."
   },
diff --git a/apps/browser/src/_locales/vi/messages.json b/apps/browser/src/_locales/vi/messages.json
index 415cf474af0..a94a38ffb63 100644
--- a/apps/browser/src/_locales/vi/messages.json
+++ b/apps/browser/src/_locales/vi/messages.json
@@ -586,7 +586,7 @@
     "message": "Các mục đã lưu trữ sẽ bị loại khỏi kết quả tìm kiếm chung và gợi ý tự động điền. Bạn có chắc chắn muốn lưu trữ mục này không?"
   },
   "upgradeToUseArchive": {
-    "message": "A premium membership is required to use Archive."
+    "message": "Cần là thành viên premium để sử dụng Archive."
   },
   "edit": {
     "message": "Sửa"
@@ -598,10 +598,10 @@
     "message": "Xem tất cả"
   },
   "showAll": {
-    "message": "Show all"
+    "message": "Hiện tất cả"
   },
   "viewLess": {
-    "message": "View less"
+    "message": "Ẩn bớt"
   },
   "viewLogin": {
     "message": "Xem đăng nhập"
@@ -806,10 +806,10 @@
     "message": "Mỗi khi khóa máy"
   },
   "onIdle": {
-    "message": "On system idle"
+    "message": "Khi hệ thống rãnh rỗi"
   },
   "onSleep": {
-    "message": "On system sleep"
+    "message": "Khi hệ thống ngủ"
   },
   "onRestart": {
     "message": "Mỗi khi khởi động lại trình duyệt"
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "Tìm hiểu thêm"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "Khóa xác thực (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "1GB bộ nhớ lưu trữ được mã hóa cho các tệp đính kèm."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ bộ nhớ lưu trữ được mã hóa cho các tệp đính kèm.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "Truy cập khẩn cấp."
   },
@@ -1874,7 +1904,7 @@
     "message": "Năm hết hạn"
   },
   "monthly": {
-    "message": "month"
+    "message": "tháng"
   },
   "expiration": {
     "message": "Hết hạn"
@@ -2446,7 +2476,7 @@
     }
   },
   "topLayerHijackWarning": {
-    "message": "This page is interfering with the Bitwarden experience. The Bitwarden inline menu has been temporarily disabled as a safety measure."
+    "message": "Trang này đang cản trở trải nghiệm Bitwarden. Menu nội tuyến Bitwarden đã tạm thời bị vô hiệu hóa như một biện pháp an toàn."
   },
   "setMasterPassword": {
     "message": "Đặt mật khẩu chính"
@@ -4912,7 +4942,7 @@
     "message": "Cao cấp"
   },
   "unlockFeaturesWithPremium": {
-    "message": "Unlock reporting, emergency access, and more security features with Premium."
+    "message": "Mở khóa tính năng báo cáo, quyền truy cập khẩn cấp và nhiều tính năng bảo mật khác với Premium."
   },
   "freeOrgsCannotUseAttachments": {
     "message": "Các tổ chức miễn phí không thể sử dụng tệp đính kèm"
@@ -4999,7 +5029,7 @@
     }
   },
   "defaultLabelWithValue": {
-    "message": "Default ( $VALUE$ )",
+    "message": "Mặc định ( $VALUE$ )",
     "description": "A label that indicates the default value for a field with the current default value in parentheses.",
     "placeholders": {
       "value": {
@@ -5825,19 +5855,19 @@
     "message": "Nâng cấp lên gói Cao cấp"
   },
   "unlockAdvancedSecurity": {
-    "message": "Unlock advanced security features"
+    "message": "Mở khóa các tính năng bảo mật nâng cao"
   },
   "unlockAdvancedSecurityDesc": {
-    "message": "A Premium subscription gives you more tools to stay secure and in control"
+    "message": "Đăng ký Premium cung cấp cho bạn nhiều công cụ hơn để luôn an toàn và kiểm soát"
   },
   "explorePremium": {
-    "message": "Explore Premium"
+    "message": "Khám phá Premium"
   },
   "loadingVault": {
-    "message": "Loading vault"
+    "message": "Đang tải kho"
   },
   "vaultLoaded": {
-    "message": "Vault loaded"
+    "message": "Đã tải kho"
   },
   "settingDisabledByPolicy": {
     "message": "Cài đặt này bị vô hiệu hóa bởi chính sách tổ chức của bạn.",
@@ -5850,6 +5880,6 @@
     "message": "Số thẻ"
   },
   "sessionTimeoutSettingsAction": {
-    "message": "Timeout action"
+    "message": "Hành động sau khi đóng kho"
   }
 }
diff --git a/apps/browser/src/_locales/zh_CN/messages.json b/apps/browser/src/_locales/zh_CN/messages.json
index 7a0662fb9f8..fd4b6380b1b 100644
--- a/apps/browser/src/_locales/zh_CN/messages.json
+++ b/apps/browser/src/_locales/zh_CN/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "进一步了解"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "验证器密钥 (TOTP)"
   },
@@ -1473,7 +1494,16 @@
     "message": "注册高级会员将获得："
   },
   "ppremiumSignUpStorage": {
-    "message": "1 GB 文件附件加密存储。"
+    "message": "1 GB 文件附件加密存储空间。"
+  },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ 文件附件加密存储空间。",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
   },
   "premiumSignUpEmergency": {
     "message": "紧急访问。"
diff --git a/apps/browser/src/_locales/zh_TW/messages.json b/apps/browser/src/_locales/zh_TW/messages.json
index 38fb50d6c8b..de78e415fa6 100644
--- a/apps/browser/src/_locales/zh_TW/messages.json
+++ b/apps/browser/src/_locales/zh_TW/messages.json
@@ -1406,6 +1406,27 @@
   "learnMore": {
     "message": "深入了解"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
+  "later": {
+    "message": "Later"
+  },
   "authenticatorKeyTotp": {
     "message": "驗證器金鑰 (TOTP)"
   },
@@ -1475,6 +1496,15 @@
   "ppremiumSignUpStorage": {
     "message": "用於檔案附件的 1 GB 加密儲存空間。"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpEmergency": {
     "message": "緊急存取"
   },
diff --git a/apps/browser/src/auth/popup/account-switching/current-account.component.html b/apps/browser/src/auth/popup/account-switching/current-account.component.html
index 2e2440f6258..7ab55f36753 100644
--- a/apps/browser/src/auth/popup/account-switching/current-account.component.html
+++ b/apps/browser/src/auth/popup/account-switching/current-account.component.html
@@ -2,7 +2,7 @@
   <button
     *ngIf="currentAccount$ | async as currentAccount; else defaultButton"
     type="button"
-    class="tw-rounded-full hover:tw-outline hover:tw-outline-1 hover:tw-outline-offset-1 hover:tw-outline-primary-600"
+    class="tw-rounded-full hover:tw-outline hover:tw-outline-1 hover:tw-outline-primary-600"
     (click)="currentAccountClicked()"
   >
     <span class="tw-sr-only"> {{ "bitwardenAccount" | i18n }} {{ currentAccount.email }}</span>
diff --git a/apps/browser/src/auth/popup/guards/platform-popout.guard.spec.ts b/apps/browser/src/auth/popup/guards/platform-popout.guard.spec.ts
new file mode 100644
index 00000000000..d39012fd88a
--- /dev/null
+++ b/apps/browser/src/auth/popup/guards/platform-popout.guard.spec.ts
@@ -0,0 +1,193 @@
+import { TestBed } from "@angular/core/testing";
+import { ActivatedRouteSnapshot, RouterStateSnapshot } from "@angular/router";
+
+import { BrowserApi } from "../../../platform/browser/browser-api";
+import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
+
+import { platformPopoutGuard } from "./platform-popout.guard";
+
+describe("platformPopoutGuard", () => {
+  let getPlatformInfoSpy: jest.SpyInstance;
+  let inPopoutSpy: jest.SpyInstance;
+  let inSidebarSpy: jest.SpyInstance;
+  let openPopoutSpy: jest.SpyInstance;
+  let closePopupSpy: jest.SpyInstance;
+
+  const mockRoute = {} as ActivatedRouteSnapshot;
+  const mockState: RouterStateSnapshot = {
+    url: "/login-with-passkey?param=value",
+  } as RouterStateSnapshot;
+
+  beforeEach(() => {
+    getPlatformInfoSpy = jest.spyOn(BrowserApi, "getPlatformInfo");
+    inPopoutSpy = jest.spyOn(BrowserPopupUtils, "inPopout");
+    inSidebarSpy = jest.spyOn(BrowserPopupUtils, "inSidebar");
+    openPopoutSpy = jest.spyOn(BrowserPopupUtils, "openPopout").mockImplementation();
+    closePopupSpy = jest.spyOn(BrowserApi, "closePopup").mockImplementation();
+
+    TestBed.configureTestingModule({});
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("when platform matches", () => {
+    beforeEach(() => {
+      getPlatformInfoSpy.mockResolvedValue({ os: "linux" });
+      inPopoutSpy.mockReturnValue(false);
+      inSidebarSpy.mockReturnValue(false);
+    });
+
+    it("should open popout and block navigation when not already in popout or sidebar", async () => {
+      const guard = platformPopoutGuard(["linux"]);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(getPlatformInfoSpy).toHaveBeenCalled();
+      expect(inPopoutSpy).toHaveBeenCalledWith(window);
+      expect(inSidebarSpy).toHaveBeenCalledWith(window);
+      expect(openPopoutSpy).toHaveBeenCalledWith(
+        "popup/index.html#/login-with-passkey?param=value&autoClosePopout=true",
+      );
+      expect(closePopupSpy).toHaveBeenCalledWith(window);
+      expect(result).toBe(false);
+    });
+
+    it("should allow navigation when already in popout", async () => {
+      inPopoutSpy.mockReturnValue(true);
+
+      const guard = platformPopoutGuard(["linux"]);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(closePopupSpy).not.toHaveBeenCalled();
+      expect(result).toBe(true);
+    });
+
+    it("should allow navigation when already in sidebar", async () => {
+      inSidebarSpy.mockReturnValue(true);
+
+      const guard = platformPopoutGuard(["linux"]);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(closePopupSpy).not.toHaveBeenCalled();
+      expect(result).toBe(true);
+    });
+  });
+
+  describe("when platform does not match", () => {
+    beforeEach(() => {
+      getPlatformInfoSpy.mockResolvedValue({ os: "win" });
+      inPopoutSpy.mockReturnValue(false);
+      inSidebarSpy.mockReturnValue(false);
+    });
+
+    it("should allow navigation without opening popout", async () => {
+      const guard = platformPopoutGuard(["linux"]);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(getPlatformInfoSpy).toHaveBeenCalled();
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(result).toBe(true);
+    });
+  });
+
+  describe("when forcePopout is true", () => {
+    beforeEach(() => {
+      getPlatformInfoSpy.mockResolvedValue({ os: "win" });
+      inPopoutSpy.mockReturnValue(false);
+      inSidebarSpy.mockReturnValue(false);
+    });
+
+    it("should open popout regardless of platform", async () => {
+      const guard = platformPopoutGuard(["linux"], true);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(openPopoutSpy).toHaveBeenCalledWith(
+        "popup/index.html#/login-with-passkey?param=value&autoClosePopout=true",
+      );
+      expect(closePopupSpy).toHaveBeenCalledWith(window);
+      expect(result).toBe(false);
+    });
+
+    it("should not open popout when already in popout", async () => {
+      inPopoutSpy.mockReturnValue(true);
+
+      const guard = platformPopoutGuard(["linux"], true);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(result).toBe(true);
+    });
+  });
+
+  describe("with multiple platforms", () => {
+    beforeEach(() => {
+      inPopoutSpy.mockReturnValue(false);
+      inSidebarSpy.mockReturnValue(false);
+    });
+
+    it.each(["linux", "mac", "win"])(
+      "should open popout when platform is %s and included in platforms array",
+      async (platform) => {
+        getPlatformInfoSpy.mockResolvedValue({ os: platform });
+
+        const guard = platformPopoutGuard(["linux", "mac", "win"]);
+        const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+        expect(openPopoutSpy).toHaveBeenCalledWith(
+          "popup/index.html#/login-with-passkey?param=value&autoClosePopout=true",
+        );
+        expect(closePopupSpy).toHaveBeenCalledWith(window);
+        expect(result).toBe(false);
+      },
+    );
+
+    it("should not open popout when platform is not in the array", async () => {
+      getPlatformInfoSpy.mockResolvedValue({ os: "android" });
+
+      const guard = platformPopoutGuard(["linux", "mac"]);
+      const result = await TestBed.runInInjectionContext(() => guard(mockRoute, mockState));
+
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(result).toBe(true);
+    });
+  });
+
+  describe("url handling", () => {
+    beforeEach(() => {
+      getPlatformInfoSpy.mockResolvedValue({ os: "linux" });
+      inPopoutSpy.mockReturnValue(false);
+      inSidebarSpy.mockReturnValue(false);
+    });
+
+    it("should preserve query parameters in the popout url", async () => {
+      const stateWithQuery: RouterStateSnapshot = {
+        url: "/path?foo=bar&baz=qux",
+      } as RouterStateSnapshot;
+
+      const guard = platformPopoutGuard(["linux"]);
+      await TestBed.runInInjectionContext(() => guard(mockRoute, stateWithQuery));
+
+      expect(openPopoutSpy).toHaveBeenCalledWith(
+        "popup/index.html#/path?foo=bar&baz=qux&autoClosePopout=true",
+      );
+      expect(closePopupSpy).toHaveBeenCalledWith(window);
+    });
+
+    it("should handle urls without query parameters", async () => {
+      const stateWithoutQuery: RouterStateSnapshot = {
+        url: "/simple-path",
+      } as RouterStateSnapshot;
+
+      const guard = platformPopoutGuard(["linux"]);
+      await TestBed.runInInjectionContext(() => guard(mockRoute, stateWithoutQuery));
+
+      expect(openPopoutSpy).toHaveBeenCalledWith(
+        "popup/index.html#/simple-path?autoClosePopout=true",
+      );
+      expect(closePopupSpy).toHaveBeenCalledWith(window);
+    });
+  });
+});
diff --git a/apps/browser/src/auth/popup/guards/platform-popout.guard.ts b/apps/browser/src/auth/popup/guards/platform-popout.guard.ts
new file mode 100644
index 00000000000..aad005e141b
--- /dev/null
+++ b/apps/browser/src/auth/popup/guards/platform-popout.guard.ts
@@ -0,0 +1,46 @@
+import { ActivatedRouteSnapshot, CanActivateFn, RouterStateSnapshot } from "@angular/router";
+
+import { BrowserApi } from "../../../platform/browser/browser-api";
+import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
+
+/**
+ * Guard that forces a popout window for specific platforms.
+ * Useful when popup context would close during operations (e.g., WebAuthn on Linux).
+ *
+ * @param platforms - Array of platform OS strings (e.g., ["linux", "mac", "win"])
+ * @param forcePopout - If true, always force popout regardless of platform (useful for testing)
+ * @returns CanActivateFn that opens popout and blocks navigation if conditions met
+ */
+export function platformPopoutGuard(
+  platforms: string[],
+  forcePopout: boolean = false,
+): CanActivateFn {
+  return async (route: ActivatedRouteSnapshot, state: RouterStateSnapshot) => {
+    // Check if current platform matches
+    const platformInfo = await BrowserApi.getPlatformInfo();
+    const isPlatformMatch = platforms.includes(platformInfo.os);
+
+    // Check if already in popout/sidebar
+    const inPopout = BrowserPopupUtils.inPopout(window);
+    const inSidebar = BrowserPopupUtils.inSidebar(window);
+
+    // Open popout if conditions met
+    if ((isPlatformMatch || forcePopout) && !inPopout && !inSidebar) {
+      // Add autoClosePopout query param to signal the popout should close after completion
+      const [path, existingQuery] = state.url.split("?");
+      const params = new URLSearchParams(existingQuery || "");
+      params.set("autoClosePopout", "true");
+      const urlWithAutoClose = `${path}?${params.toString()}`;
+
+      // Open the popout window
+      await BrowserPopupUtils.openPopout(`popup/index.html#${urlWithAutoClose}`);
+
+      // Close the original popup window
+      BrowserApi.closePopup(window);
+
+      return false; // Block navigation - popout will reload
+    }
+
+    return true; // Allow navigation
+  };
+}
diff --git a/apps/browser/src/auth/popup/login/extension-login-component.service.spec.ts b/apps/browser/src/auth/popup/login/extension-login-component.service.spec.ts
index bd85ff9293e..dc1a7b4bb6b 100644
--- a/apps/browser/src/auth/popup/login/extension-login-component.service.spec.ts
+++ b/apps/browser/src/auth/popup/login/extension-login-component.service.spec.ts
@@ -102,6 +102,36 @@ describe("ExtensionLoginComponentService", () => {
     });
   });
 
+  describe("redirectToSsoLoginWithOrganizationSsoIdentifier", () => {
+    it("launches SSO browser window with correct Url", async () => {
+      const email = "test@bitwarden.com";
+      const state = "testState";
+      const expectedState = "testState:clientId=browser";
+      const codeVerifier = "testCodeVerifier";
+      const codeChallenge = "testCodeChallenge";
+      const orgSsoIdentifier = "org-sso-identifier";
+
+      passwordGenerationService.generatePassword.mockResolvedValueOnce(state);
+      passwordGenerationService.generatePassword.mockResolvedValueOnce(codeVerifier);
+      jest.spyOn(Utils, "fromBufferToUrlB64").mockReturnValue(codeChallenge);
+
+      await service.redirectToSsoLoginWithOrganizationSsoIdentifier(email, orgSsoIdentifier);
+
+      expect(ssoUrlService.buildSsoUrl).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(String),
+        expect.any(String),
+        expect.any(String),
+        expect.any(String),
+        email,
+        orgSsoIdentifier,
+      );
+      expect(ssoLoginService.setSsoState).toHaveBeenCalledWith(expectedState);
+      expect(ssoLoginService.setCodeVerifier).toHaveBeenCalledWith(codeVerifier);
+      expect(platformUtilsService.launchUri).toHaveBeenCalled();
+    });
+  });
+
   describe("showBackButton", () => {
     it("sets showBackButton in extensionAnonLayoutWrapperDataService", () => {
       service.showBackButton(true);
diff --git a/apps/browser/src/auth/popup/login/extension-login-component.service.ts b/apps/browser/src/auth/popup/login/extension-login-component.service.ts
index 621c7d74876..cfaf6e04d10 100644
--- a/apps/browser/src/auth/popup/login/extension-login-component.service.ts
+++ b/apps/browser/src/auth/popup/login/extension-login-component.service.ts
@@ -47,6 +47,7 @@ export class ExtensionLoginComponentService
     email: string,
     state: string,
     codeChallenge: string,
+    orgSsoIdentifier?: string,
   ): Promise<void> {
     const env = await firstValueFrom(this.environmentService.environment$);
     const webVaultUrl = env.getWebVaultUrl();
@@ -60,6 +61,7 @@ export class ExtensionLoginComponentService
       state,
       codeChallenge,
       email,
+      orgSsoIdentifier,
     );
 
     this.platformUtilsService.launchUri(webAppSsoUrl);
diff --git a/apps/browser/src/auth/popup/settings/account-security.component.html b/apps/browser/src/auth/popup/settings/account-security.component.html
index 37efcee9012..b5d725b4a82 100644
--- a/apps/browser/src/auth/popup/settings/account-security.component.html
+++ b/apps/browser/src/auth/popup/settings/account-security.component.html
@@ -86,12 +86,12 @@
         </bit-section-header>
 
         <bit-card>
-          <bit-session-timeout-input
+          <bit-session-timeout-input-legacy
             [vaultTimeoutOptions]="vaultTimeoutOptions"
             [formControl]="form.controls.vaultTimeout"
             ngDefaultControl
           >
-          </bit-session-timeout-input>
+          </bit-session-timeout-input-legacy>
 
           <bit-form-field disableMargin>
             <bit-label for="vaultTimeoutAction">{{ "vaultTimeoutAction1" | i18n }}</bit-label>
diff --git a/apps/browser/src/auth/popup/settings/account-security.component.ts b/apps/browser/src/auth/popup/settings/account-security.component.ts
index e6e7be96c08..4ff29c8853e 100644
--- a/apps/browser/src/auth/popup/settings/account-security.component.ts
+++ b/apps/browser/src/auth/popup/settings/account-security.component.ts
@@ -70,7 +70,7 @@ import {
   BiometricsStatus,
 } from "@bitwarden/key-management";
 import {
-  SessionTimeoutInputComponent,
+  SessionTimeoutInputLegacyComponent,
   SessionTimeoutSettingsComponent,
 } from "@bitwarden/key-management-ui";
 
@@ -109,7 +109,7 @@ import { AwaitDesktopDialogComponent } from "./await-desktop-dialog.component";
     SessionTimeoutSettingsComponent,
     SpotlightComponent,
     TypographyModule,
-    SessionTimeoutInputComponent,
+    SessionTimeoutInputLegacyComponent,
   ],
 })
 export class AccountSecurityComponent implements OnInit, OnDestroy {
diff --git a/apps/browser/src/autofill/background/abstractions/overlay.background.ts b/apps/browser/src/autofill/background/abstractions/overlay.background.ts
index 96809fa26b2..c8c938a99b2 100644
--- a/apps/browser/src/autofill/background/abstractions/overlay.background.ts
+++ b/apps/browser/src/autofill/background/abstractions/overlay.background.ts
@@ -69,8 +69,8 @@ export type FieldRect = {
 };
 
 export type InlineMenuPosition = {
-  button?: InlineMenuElementPosition;
-  list?: InlineMenuElementPosition;
+  button?: InlineMenuElementPosition | null;
+  list?: InlineMenuElementPosition | null;
 };
 
 export type NewLoginCipherData = {
diff --git a/apps/browser/src/autofill/background/notification.background.ts b/apps/browser/src/autofill/background/notification.background.ts
index 547c5ba1575..1cbf915b06a 100644
--- a/apps/browser/src/autofill/background/notification.background.ts
+++ b/apps/browser/src/autofill/background/notification.background.ts
@@ -627,11 +627,11 @@ export default class NotificationBackground {
     }
 
     const username: string | null = data.username || null;
-    const currentPassword = data.password || null;
-    const newPassword = data.newPassword || null;
+    const currentPasswordFieldValue = data.password || null;
+    const newPasswordFieldValue = data.newPassword || null;
 
-    if (authStatus === AuthenticationStatus.Locked && newPassword !== null) {
-      await this.pushChangePasswordToQueue(null, loginDomain, newPassword, tab, true);
+    if (authStatus === AuthenticationStatus.Locked && newPasswordFieldValue !== null) {
+      await this.pushChangePasswordToQueue(null, loginDomain, newPasswordFieldValue, tab, true);
       return true;
     }
 
@@ -657,35 +657,49 @@ export default class NotificationBackground {
       const [cipher] = ciphers;
       if (
         username !== null &&
-        newPassword === null &&
-        cipher.login.username === normalizedUsername &&
-        cipher.login.password === currentPassword
+        newPasswordFieldValue === null &&
+        cipher.login.username.toLowerCase() === normalizedUsername &&
+        cipher.login.password === currentPasswordFieldValue
       ) {
         // Assumed to be a login
         return false;
       }
     }
 
-    if (currentPassword && !newPassword) {
+    if (
+      ciphers.length > 0 &&
+      currentPasswordFieldValue?.length &&
       // Only use current password for change if no new password present.
-      if (ciphers.length > 0) {
-        await this.pushChangePasswordToQueue(
-          ciphers.map((cipher) => cipher.id),
-          loginDomain,
-          currentPassword,
-          tab,
-        );
-        return true;
+      !newPasswordFieldValue
+    ) {
+      const currentPasswordMatchesAnExistingValue = ciphers.some(
+        (cipher) =>
+          cipher.login?.password?.length && cipher.login.password === currentPasswordFieldValue,
+      );
+
+      // The password entered matched a stored cipher value with
+      // the same username (no change)
+      if (currentPasswordMatchesAnExistingValue) {
+        return false;
       }
+
+      await this.pushChangePasswordToQueue(
+        ciphers.map((cipher) => cipher.id),
+        loginDomain,
+        currentPasswordFieldValue,
+        tab,
+      );
+
+      return true;
     }
 
-    if (newPassword) {
+    if (newPasswordFieldValue) {
       // Otherwise include all known ciphers.
       if (ciphers.length > 0) {
         await this.pushChangePasswordToQueue(
           ciphers.map((cipher) => cipher.id),
           loginDomain,
-          newPassword,
+          newPasswordFieldValue,
           tab,
         );
 
diff --git a/apps/browser/src/autofill/background/overlay-notifications.background.ts b/apps/browser/src/autofill/background/overlay-notifications.background.ts
index e08fe540710..86cdbffe059 100644
--- a/apps/browser/src/autofill/background/overlay-notifications.background.ts
+++ b/apps/browser/src/autofill/background/overlay-notifications.background.ts
@@ -262,11 +262,30 @@ export class OverlayNotificationsBackground implements OverlayNotificationsBackg
    */
   private notificationDataIncompleteOnBeforeRequest = (tabId: number) => {
     const modifyLoginData = this.modifyLoginCipherFormData.get(tabId);
-    return (
-      !modifyLoginData ||
-      !this.shouldAttemptNotification(modifyLoginData, NotificationTypes.Add) ||
-      !this.shouldAttemptNotification(modifyLoginData, NotificationTypes.Change)
+
+    if (!modifyLoginData) {
+      return true;
+    }
+
+    const shouldAttemptAddNotification = this.shouldAttemptNotification(
+      modifyLoginData,
+      NotificationTypes.Add,
     );
+
+    if (shouldAttemptAddNotification) {
+      return false;
+    }
+
+    const shouldAttemptChangeNotification = this.shouldAttemptNotification(
+      modifyLoginData,
+      NotificationTypes.Change,
+    );
+
+    if (shouldAttemptChangeNotification) {
+      return false;
+    }
+
+    return false;
   };
 
   /**
@@ -454,15 +473,27 @@ export class OverlayNotificationsBackground implements OverlayNotificationsBackg
     modifyLoginData: ModifyLoginCipherFormData,
     notificationType: NotificationType,
   ): boolean => {
+    // Intentionally not stripping whitespace characters here as they
+    // represent user entry.
+    const usernameFieldHasValue = !!(modifyLoginData?.username || "").length;
+    const passwordFieldHasValue = !!(modifyLoginData?.password || "").length;
+    const newPasswordFieldHasValue = !!(modifyLoginData?.newPassword || "").length;
+
+    const canBeUserLogin = usernameFieldHasValue && passwordFieldHasValue;
+    const canBePasswordUpdate = passwordFieldHasValue && newPasswordFieldHasValue;
+
     switch (notificationType) {
+      // `Add` case included because all forms with cached usernames (from previous
+      // visits) will appear to be "password only" and otherwise trigger the new login
+      // save notification.
       case NotificationTypes.Add:
-        return (
-          modifyLoginData?.username && !!(modifyLoginData.password || modifyLoginData.newPassword)
-        );
+        // Can be values for nonstored login or account creation
+        return usernameFieldHasValue && (passwordFieldHasValue || newPasswordFieldHasValue);
       case NotificationTypes.Change:
-        return !!(modifyLoginData.password || modifyLoginData.newPassword);
+        // Can be login with nonstored login changes or account password update
+        return canBeUserLogin || canBePasswordUpdate;
       case NotificationTypes.AtRiskPassword:
-        return !modifyLoginData.newPassword;
+        return !newPasswordFieldHasValue;
       case NotificationTypes.Unlock:
         // Unlock notifications are handled separately and do not require form data
         return false;
diff --git a/apps/browser/src/autofill/background/overlay.background.ts b/apps/browser/src/autofill/background/overlay.background.ts
index af8141f1ab8..04a53395130 100644
--- a/apps/browser/src/autofill/background/overlay.background.ts
+++ b/apps/browser/src/autofill/background/overlay.background.ts
@@ -1424,11 +1424,11 @@ export class OverlayBackground implements OverlayBackgroundInterface {
   }
 
   /**
-   * calculates the postion and width for multi-input totp field inline menu
-   * @param totpFieldArray - the totp fields used to evaluate the position of the menu
+   * calculates the position and width for multi-input TOTP field inline menu
+   * @param totpFieldArray - the TOTP fields used to evaluate the position of the menu
    */
   private calculateTotpMultiInputMenuBounds(totpFieldArray: AutofillField[]) {
-    // Filter the fields based on the provided totpfields
+    // Filter the fields based on the provided TOTP fields
     const filteredObjects = this.allFieldData.filter((obj) =>
       totpFieldArray.some((o) => o.opid === obj.opid),
     );
@@ -1451,8 +1451,8 @@ export class OverlayBackground implements OverlayBackgroundInterface {
   }
 
   /**
-   * calculates the postion for multi-input totp field inline button
-   * @param totpFieldArray - the totp fields used to evaluate the position of the menu
+   * calculates the position for multi-input TOTP field inline button
+   * @param totpFieldArray - the TOTP fields used to evaluate the position of the menu
    */
   private calculateTotpMultiInputButtonBounds(totpFieldArray: AutofillField[]) {
     const filteredObjects = this.allFieldData.filter((obj) =>
diff --git a/apps/browser/src/autofill/fido2/background/abstractions/fido2.background.ts b/apps/browser/src/autofill/fido2/background/abstractions/fido2.background.ts
index b341be28ebb..6ad069ad56e 100644
--- a/apps/browser/src/autofill/fido2/background/abstractions/fido2.background.ts
+++ b/apps/browser/src/autofill/fido2/background/abstractions/fido2.background.ts
@@ -13,7 +13,6 @@ type SharedFido2ScriptRegistrationOptions = SharedFido2ScriptInjectionDetails &
   matches: string[];
   excludeMatches: string[];
   allFrames: true;
-  world?: "MAIN" | "ISOLATED";
 };
 
 type Fido2ExtensionMessage = {
diff --git a/apps/browser/src/autofill/fido2/background/fido2.background.spec.ts b/apps/browser/src/autofill/fido2/background/fido2.background.spec.ts
index 76ad78a6cd8..752851b3d37 100644
--- a/apps/browser/src/autofill/fido2/background/fido2.background.spec.ts
+++ b/apps/browser/src/autofill/fido2/background/fido2.background.spec.ts
@@ -203,7 +203,6 @@ describe("Fido2Background", () => {
             { file: Fido2ContentScript.PageScriptDelayAppend },
             { file: Fido2ContentScript.ContentScript },
           ],
-          world: "ISOLATED",
           ...sharedRegistrationOptions,
         });
       });
diff --git a/apps/browser/src/autofill/fido2/background/fido2.background.ts b/apps/browser/src/autofill/fido2/background/fido2.background.ts
index 0ee7a43767f..22ee4a1822d 100644
--- a/apps/browser/src/autofill/fido2/background/fido2.background.ts
+++ b/apps/browser/src/autofill/fido2/background/fido2.background.ts
@@ -176,7 +176,6 @@ export class Fido2Background implements Fido2BackgroundInterface {
         { file: await this.getFido2PageScriptAppendFileName() },
         { file: Fido2ContentScript.ContentScript },
       ],
-      world: "ISOLATED",
       ...this.sharedRegistrationOptions,
     });
   }
diff --git a/apps/browser/src/autofill/fido2/content/fido2-page-script-append.mv2.spec.ts b/apps/browser/src/autofill/fido2/content/fido2-page-script-append.mv2.spec.ts
index 0b10841e390..b444c967080 100644
--- a/apps/browser/src/autofill/fido2/content/fido2-page-script-append.mv2.spec.ts
+++ b/apps/browser/src/autofill/fido2/content/fido2-page-script-append.mv2.spec.ts
@@ -29,48 +29,38 @@ describe("FIDO2 page-script for manifest v2", () => {
     expect(window.document.createElement).not.toHaveBeenCalled();
   });
 
-  it("appends the `page-script.js` file to the document head when the contentType is `text/html`", async () => {
-    const scriptContents = "test-script-contents";
+  it("appends the `page-script.js` file to the document head when the contentType is `text/html`", () => {
     jest.spyOn(window.document.head, "prepend").mockImplementation((node) => {
       createdScriptElement = node as HTMLScriptElement;
       return node;
     });
-    window.fetch = jest.fn().mockResolvedValue({
-      text: () => Promise.resolve(scriptContents),
-    } as Response);
 
     // FIXME: Remove when updating file. Eslint update
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     require("./fido2-page-script-delay-append.mv2.ts");
-    await jest.runAllTimersAsync();
 
     expect(window.document.createElement).toHaveBeenCalledWith("script");
     expect(chrome.runtime.getURL).toHaveBeenCalledWith(Fido2ContentScript.PageScript);
     expect(window.document.head.prepend).toHaveBeenCalledWith(expect.any(HTMLScriptElement));
-    expect(createdScriptElement.innerHTML).toBe(scriptContents);
+    expect(createdScriptElement.src).toBe(`chrome-extension://id/${Fido2ContentScript.PageScript}`);
   });
 
-  it("appends the `page-script.js` file to the document element if the head is not available", async () => {
-    const scriptContents = "test-script-contents";
+  it("appends the `page-script.js` file to the document element if the head is not available", () => {
     window.document.documentElement.removeChild(window.document.head);
     jest.spyOn(window.document.documentElement, "prepend").mockImplementation((node) => {
       createdScriptElement = node as HTMLScriptElement;
       return node;
     });
-    window.fetch = jest.fn().mockResolvedValue({
-      text: () => Promise.resolve(scriptContents),
-    } as Response);
 
     // FIXME: Remove when updating file. Eslint update
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     require("./fido2-page-script-delay-append.mv2.ts");
-    await jest.runAllTimersAsync();
 
     expect(window.document.createElement).toHaveBeenCalledWith("script");
     expect(chrome.runtime.getURL).toHaveBeenCalledWith(Fido2ContentScript.PageScript);
     expect(window.document.documentElement.prepend).toHaveBeenCalledWith(
       expect.any(HTMLScriptElement),
     );
-    expect(createdScriptElement.innerHTML).toBe(scriptContents);
+    expect(createdScriptElement.src).toBe(`chrome-extension://id/${Fido2ContentScript.PageScript}`);
   });
 });
diff --git a/apps/browser/src/autofill/fido2/content/fido2-page-script-delay-append.mv2.ts b/apps/browser/src/autofill/fido2/content/fido2-page-script-delay-append.mv2.ts
index 8c0d17c7e21..ffa6f7051c3 100644
--- a/apps/browser/src/autofill/fido2/content/fido2-page-script-delay-append.mv2.ts
+++ b/apps/browser/src/autofill/fido2/content/fido2-page-script-delay-append.mv2.ts
@@ -2,26 +2,17 @@
  * This script handles injection of the FIDO2 override page script into the document.
  * This is required for manifest v2, but will be removed when we migrate fully to manifest v3.
  */
-void (async function (globalContext) {
+(function (globalContext) {
   if (globalContext.document.contentType !== "text/html") {
     return;
   }
 
   const script = globalContext.document.createElement("script");
+  // We're removing stack trace information in the page script instead
+  // eslint-disable-next-line @bitwarden/platform/no-page-script-url-leakage
+  script.src = chrome.runtime.getURL("content/fido2-page-script.js");
   script.async = false;
 
-  const pageScriptUrl = chrome.runtime.getURL("content/fido2-page-script.js");
-  // Inject the script contents directly to avoid leaking the extension URL
-  try {
-    const response = await fetch(pageScriptUrl);
-    const scriptContents = await response.text();
-    script.innerHTML = scriptContents;
-  } catch {
-    // eslint-disable-next-line no-console
-    console.error("Failed to load FIDO2 page script contents. Injection failed.");
-    return;
-  }
-
   // We are ensuring that the script injection is delayed in the event that we are loading
   // within an iframe element. This prevents an issue with web mail clients that load content
   // using ajax within iframes. In particular, Zimbra web mail client was observed to have this issue.
diff --git a/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.spec.ts b/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.spec.ts
index 3bb86ee7876..f1ed6875f90 100644
--- a/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.spec.ts
+++ b/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.spec.ts
@@ -1,7 +1,7 @@
 import { mock } from "jest-mock-extended";
 
 import { EVENTS } from "@bitwarden/common/autofill/constants";
-import { ThemeType } from "@bitwarden/common/platform/enums";
+import { ThemeTypes } from "@bitwarden/common/platform/enums";
 
 import { AutofillOverlayPort } from "../../../enums/autofill-overlay.enum";
 import { createPortSpyMock } from "../../../spec/autofill-mocks";
@@ -66,17 +66,38 @@ describe("AutofillInlineMenuIframeService", () => {
       );
     });
 
-    // TODO CG - This test is brittle and failing due to how we are calling the private method. This needs to be reworked
-    it.skip("creates an aria alert element if the ariaAlert param is passed", () => {
-      const ariaAlert = "aria alert";
+    it("creates an aria alert element if the ariaAlert param is passed to AutofillInlineMenuIframeService", () => {
       jest.spyOn(autofillInlineMenuIframeService as any, "createAriaAlertElement");
 
       autofillInlineMenuIframeService.initMenuIframe();
 
-      expect(autofillInlineMenuIframeService["createAriaAlertElement"]).toHaveBeenCalledWith(
-        ariaAlert,
+      expect(autofillInlineMenuIframeService["createAriaAlertElement"]).toHaveBeenCalled();
+      expect(autofillInlineMenuIframeService["ariaAlertElement"]).toBeDefined();
+      expect(autofillInlineMenuIframeService["ariaAlertElement"].getAttribute("role")).toBe(
+        "alert",
       );
-      expect(autofillInlineMenuIframeService["ariaAlertElement"]).toMatchSnapshot();
+      expect(autofillInlineMenuIframeService["ariaAlertElement"].getAttribute("aria-live")).toBe(
+        "polite",
+      );
+      expect(autofillInlineMenuIframeService["ariaAlertElement"].getAttribute("aria-atomic")).toBe(
+        "true",
+      );
+    });
+
+    it("does not create an aria alert element if the ariaAlert param is not passed to AutofillInlineMenuIframeService", () => {
+      const shadowWithoutAlert = document.createElement("div").attachShadow({ mode: "open" });
+      const serviceWithoutAlert = new AutofillInlineMenuIframeService(
+        shadowWithoutAlert,
+        AutofillOverlayPort.Button,
+        { height: "0px" },
+        "title",
+      );
+      jest.spyOn(serviceWithoutAlert as any, "createAriaAlertElement");
+
+      serviceWithoutAlert.initMenuIframe();
+
+      expect(serviceWithoutAlert["createAriaAlertElement"]).not.toHaveBeenCalled();
+      expect(serviceWithoutAlert["ariaAlertElement"]).toBeUndefined();
     });
 
     describe("on load of the iframe source", () => {
@@ -200,7 +221,7 @@ describe("AutofillInlineMenuIframeService", () => {
         sendPortMessage(portSpy, { command: "updateAutofillInlineMenuPosition" });
 
         expect(
-          autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+          autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
         ).not.toHaveBeenCalled();
       });
 
@@ -216,7 +237,7 @@ describe("AutofillInlineMenuIframeService", () => {
 
           expect(autofillInlineMenuIframeService["portKey"]).toBe(portKey);
           expect(
-            autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+            autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
           ).toHaveBeenCalledWith(message, autofillInlineMenuIframeService["extensionOrigin"]);
         });
       });
@@ -234,14 +255,14 @@ describe("AutofillInlineMenuIframeService", () => {
         it("passes the message on to the iframe element", () => {
           const message = {
             command: "initAutofillInlineMenuList",
-            theme: ThemeType.Light,
+            theme: ThemeTypes.Light,
           };
 
           sendPortMessage(portSpy, message);
 
           expect(updateElementStylesSpy).not.toHaveBeenCalled();
           expect(
-            autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+            autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
           ).toHaveBeenCalledWith(message, autofillInlineMenuIframeService["extensionOrigin"]);
         });
 
@@ -249,18 +270,18 @@ describe("AutofillInlineMenuIframeService", () => {
           window.matchMedia = jest.fn(() => mock<MediaQueryList>({ matches: false }));
           const message = {
             command: "initAutofillInlineMenuList",
-            theme: ThemeType.System,
+            theme: ThemeTypes.System,
           };
 
           sendPortMessage(portSpy, message);
 
           expect(window.matchMedia).toHaveBeenCalledWith("(prefers-color-scheme: dark)");
           expect(
-            autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+            autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
           ).toHaveBeenCalledWith(
             {
               command: "initAutofillInlineMenuList",
-              theme: ThemeType.Light,
+              theme: ThemeTypes.Light,
             },
             autofillInlineMenuIframeService["extensionOrigin"],
           );
@@ -270,18 +291,18 @@ describe("AutofillInlineMenuIframeService", () => {
           window.matchMedia = jest.fn(() => mock<MediaQueryList>({ matches: true }));
           const message = {
             command: "initAutofillInlineMenuList",
-            theme: ThemeType.System,
+            theme: ThemeTypes.System,
           };
 
           sendPortMessage(portSpy, message);
 
           expect(window.matchMedia).toHaveBeenCalledWith("(prefers-color-scheme: dark)");
           expect(
-            autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+            autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
           ).toHaveBeenCalledWith(
             {
               command: "initAutofillInlineMenuList",
-              theme: ThemeType.Dark,
+              theme: ThemeTypes.Dark,
             },
             autofillInlineMenuIframeService["extensionOrigin"],
           );
@@ -290,7 +311,7 @@ describe("AutofillInlineMenuIframeService", () => {
         it("updates the border to match the `dark` theme", () => {
           const message = {
             command: "initAutofillInlineMenuList",
-            theme: ThemeType.Dark,
+            theme: ThemeTypes.Dark,
           };
 
           sendPortMessage(portSpy, message);
@@ -364,6 +385,219 @@ describe("AutofillInlineMenuIframeService", () => {
             autofillInlineMenuIframeService["handleFadeInInlineMenuIframe"],
           ).toHaveBeenCalled();
         });
+
+        it("closes the inline menu when iframe is outside the viewport (bottom)", () => {
+          const viewportHeight = 800;
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: 0,
+              left: 0,
+              right: 100,
+              bottom: viewportHeight + 1,
+              height: 98,
+              width: 262,
+            } as DOMRect);
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: viewportHeight,
+            writable: true,
+            configurable: true,
+          });
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: 1200,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
+
+        it("closes the inline menu when iframe is outside the viewport (right)", () => {
+          const viewportWidth = 1200;
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: 0,
+              left: 0,
+              right: viewportWidth + 1,
+              bottom: 100,
+              height: 98,
+              width: 262,
+            } as DOMRect);
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: 800,
+            writable: true,
+            configurable: true,
+          });
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: viewportWidth,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
+
+        it("closes the inline menu when iframe is outside the viewport (left)", () => {
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: 0,
+              left: -1,
+              right: 0,
+              bottom: 100,
+              height: 98,
+              width: 262,
+            } as DOMRect);
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: 800,
+            writable: true,
+            configurable: true,
+          });
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: 1200,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
+
+        it("closes the inline menu when iframe is outside the viewport (top)", () => {
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: -1,
+              left: 0,
+              right: 100,
+              bottom: 0,
+              height: 98,
+              width: 262,
+            } as DOMRect);
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: 800,
+            writable: true,
+            configurable: true,
+          });
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: 1200,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
+
+        it("allows iframe (do not close) when it has no dimensions", () => {
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: 0,
+              left: 0,
+              right: 0,
+              bottom: 0,
+              height: 0,
+              width: 0,
+            } as DOMRect);
+
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: 800,
+            writable: true,
+            configurable: true,
+          });
+
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: 1200,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).not.toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
+
+        it("uses visualViewport when available", () => {
+          jest.spyOn(globalThis.document, "hasFocus").mockReturnValue(true);
+          jest
+            .spyOn(autofillInlineMenuIframeService["iframe"], "getBoundingClientRect")
+            .mockReturnValue({
+              top: 0,
+              left: 0,
+              right: 100,
+              bottom: 700,
+              height: 98,
+              width: 262,
+            } as DOMRect);
+
+          Object.defineProperty(globalThis.window, "visualViewport", {
+            value: {
+              height: 600,
+              width: 1200,
+            } as VisualViewport,
+            writable: true,
+            configurable: true,
+          });
+
+          Object.defineProperty(globalThis.window, "innerHeight", {
+            value: 800,
+            writable: true,
+            configurable: true,
+          });
+
+          Object.defineProperty(globalThis.window, "innerWidth", {
+            value: 1200,
+            writable: true,
+            configurable: true,
+          });
+
+          sendPortMessage(portSpy, {
+            command: "updateAutofillInlineMenuPosition",
+            styles: {},
+          });
+
+          expect(sendExtensionMessageSpy).toHaveBeenCalledWith("closeAutofillInlineMenu", {
+            forceCloseInlineMenu: true,
+          });
+        });
       });
 
       it("updates the visibility of the iframe", () => {
@@ -381,7 +615,7 @@ describe("AutofillInlineMenuIframeService", () => {
         });
 
         expect(
-          autofillInlineMenuIframeService["iframe"].contentWindow.postMessage,
+          autofillInlineMenuIframeService["iframe"].contentWindow?.postMessage,
         ).toHaveBeenCalledWith(
           {
             command: "updateAutofillInlineMenuColorScheme",
diff --git a/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts b/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts
index 8b1423b1290..64ef7d180ed 100644
--- a/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts
+++ b/apps/browser/src/autofill/overlay/inline-menu/iframe-content/autofill-inline-menu-iframe.service.ts
@@ -282,6 +282,15 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
     const styles = this.fadeInTimeout ? Object.assign(position, { opacity: "0" }) : position;
     this.updateElementStyles(this.iframe, styles);
 
+    const elementHeightCompletelyInViewport = this.isElementCompletelyWithinViewport(
+      this.iframe.getBoundingClientRect(),
+    );
+
+    if (!elementHeightCompletelyInViewport) {
+      this.forceCloseInlineMenu();
+      return;
+    }
+
     if (this.fadeInTimeout) {
       this.handleFadeInInlineMenuIframe();
     }
@@ -289,6 +298,42 @@ export class AutofillInlineMenuIframeService implements AutofillInlineMenuIframe
     this.announceAriaAlert(this.ariaAlert, 2000);
   }
 
+  /**
+   * Check if element is completely within the browser viewport.
+   */
+  private isElementCompletelyWithinViewport(elementPosition: DOMRect) {
+    // An element that lacks size should be considered within the viewport
+    if (!elementPosition.height || !elementPosition.width) {
+      return true;
+    }
+
+    const [viewportHeight, viewportWidth] = this.getViewportSize();
+
+    const rightSideIsWithinViewport = (elementPosition.right || 0) <= viewportWidth;
+    const leftSideIsWithinViewport = (elementPosition.left || 0) >= 0;
+    const topSideIsWithinViewport = (elementPosition.top || 0) >= 0;
+    const bottomSideIsWithinViewport = (elementPosition.bottom || 0) <= viewportHeight;
+
+    return (
+      rightSideIsWithinViewport &&
+      leftSideIsWithinViewport &&
+      topSideIsWithinViewport &&
+      bottomSideIsWithinViewport
+    );
+  }
+
+  /** Use Visual Viewport API if available (better for mobile/zoom) */
+  private getViewportSize(): [
+    VisualViewport["height"] | Window["innerHeight"],
+    VisualViewport["width"] | Window["innerWidth"],
+  ] {
+    if ("visualViewport" in globalThis.window && globalThis.window.visualViewport) {
+      return [globalThis.window.visualViewport.height, globalThis.window.visualViewport.width];
+    }
+
+    return [globalThis.window.innerHeight, globalThis.window.innerWidth];
+  }
+
   /**
    * Gets the page color scheme meta tag and sends a message to the iframe
    * to update its color scheme. Will default to "normal" if the meta tag
diff --git a/apps/browser/src/autofill/overlay/inline-menu/pages/menu-container/autofill-inline-menu-container.ts b/apps/browser/src/autofill/overlay/inline-menu/pages/menu-container/autofill-inline-menu-container.ts
index 6c61cfae6b4..84a15fd1067 100644
--- a/apps/browser/src/autofill/overlay/inline-menu/pages/menu-container/autofill-inline-menu-container.ts
+++ b/apps/browser/src/autofill/overlay/inline-menu/pages/menu-container/autofill-inline-menu-container.ts
@@ -129,7 +129,12 @@ export class AutofillInlineMenuContainer {
     }
     try {
       const urlObj = new URL(url);
-      const isExtensionProtocol = /^[a-z]+(-[a-z]+)?-extension:$/i.test(urlObj.protocol);
+      const extensionProtocols = new Set([
+        "chrome-extension:",
+        "moz-extension:",
+        "safari-web-extension:",
+      ]);
+      const isExtensionProtocol = extensionProtocols.has(urlObj.protocol);
 
       if (!isExtensionProtocol) {
         return false;
diff --git a/apps/browser/src/autofill/popup/fido2/fido2.component.ts b/apps/browser/src/autofill/popup/fido2/fido2.component.ts
index c6799f93a5e..c1982d27d24 100644
--- a/apps/browser/src/autofill/popup/fido2/fido2.component.ts
+++ b/apps/browser/src/autofill/popup/fido2/fido2.component.ts
@@ -24,6 +24,7 @@ import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { DomainSettingsService } from "@bitwarden/common/autofill/services/domain-settings.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { Fido2Utils } from "@bitwarden/common/platform/services/fido2/fido2-utils";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { SearchService } from "@bitwarden/common/vault/abstractions/search.service";
 import { SecureNoteType, CipherType } from "@bitwarden/common/vault/enums";
@@ -198,7 +199,7 @@ export class Fido2Component implements OnInit, OnDestroy {
             this.displayedCiphers = this.ciphers.filter(
               (cipher) =>
                 cipher.login.matchesUri(this.url, equivalentDomains) &&
-                this.cipherHasNoOtherPasskeys(cipher, message.userHandle),
+                Fido2Utils.cipherHasNoOtherPasskeys(cipher, message.userHandle),
             );
 
             this.passkeyAction = PasskeyActions.Register;
@@ -472,16 +473,4 @@ export class Fido2Component implements OnInit, OnDestroy {
       ...msg,
     });
   }
-
-  /**
-   * This methods returns true if a cipher either has no passkeys, or has a passkey matching with userHandle
-   * @param userHandle
-   */
-  private cipherHasNoOtherPasskeys(cipher: CipherView, userHandle: string): boolean {
-    if (cipher.login.fido2Credentials == null || cipher.login.fido2Credentials.length === 0) {
-      return true;
-    }
-
-    return cipher.login.fido2Credentials.some((passkey) => passkey.userHandle === userHandle);
-  }
 }
diff --git a/apps/browser/src/autofill/services/autofill-constants.ts b/apps/browser/src/autofill/services/autofill-constants.ts
index 51d0513a7f8..0fbe2e67ae3 100644
--- a/apps/browser/src/autofill/services/autofill-constants.ts
+++ b/apps/browser/src/autofill/services/autofill-constants.ts
@@ -39,6 +39,7 @@ export class AutoFillConstants {
     "otpcode",
     "onetimepassword",
     "security_code",
+    "second-factor",
     "twofactor",
     "twofa",
     "twofactorcode",
diff --git a/apps/browser/src/autofill/services/autofill-overlay-content.service.spec.ts b/apps/browser/src/autofill/services/autofill-overlay-content.service.spec.ts
index 3c19589afef..0fb031b52e8 100644
--- a/apps/browser/src/autofill/services/autofill-overlay-content.service.spec.ts
+++ b/apps/browser/src/autofill/services/autofill-overlay-content.service.spec.ts
@@ -1603,14 +1603,14 @@ describe("AutofillOverlayContentService", () => {
 
         it("skips triggering submission if a button is not found", async () => {
           const submitButton = document.querySelector("button");
-          submitButton.remove();
+          submitButton?.remove();
 
           await autofillOverlayContentService.setupOverlayListeners(
             autofillFieldElement,
             autofillFieldData,
             pageDetailsMock,
           );
-          submitButton.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
+          submitButton?.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
 
           expect(sendExtensionMessageSpy).not.toHaveBeenCalledWith(
             "formFieldSubmitted",
@@ -1627,7 +1627,7 @@ describe("AutofillOverlayContentService", () => {
             pageDetailsMock,
           );
           await flushPromises();
-          submitButton.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
+          submitButton?.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
 
           expect(sendExtensionMessageSpy).toHaveBeenCalledWith(
             "formFieldSubmitted",
@@ -1641,7 +1641,7 @@ describe("AutofillOverlayContentService", () => {
             <div id="shadow-root"></div>
             <button id="button-el">Change Password</button>
           </div>`;
-          const shadowRoot = document.getElementById("shadow-root").attachShadow({ mode: "open" });
+          const shadowRoot = document.getElementById("shadow-root")!.attachShadow({ mode: "open" });
           shadowRoot.innerHTML = `
             <input type="password" id="password-field-1" placeholder="new password" />
           `;
@@ -1668,7 +1668,7 @@ describe("AutofillOverlayContentService", () => {
             pageDetailsMock,
           );
           await flushPromises();
-          buttonElement.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
+          buttonElement?.dispatchEvent(new KeyboardEvent("keyup", { code: "Enter" }));
 
           expect(sendExtensionMessageSpy).toHaveBeenCalledWith(
             "formFieldSubmitted",
@@ -1716,6 +1716,85 @@ describe("AutofillOverlayContentService", () => {
     });
   });
 
+  describe("refreshMenuLayerPosition", () => {
+    it("calls refreshTopLayerPosition on the inline menu content service", () => {
+      autofillOverlayContentService.refreshMenuLayerPosition();
+
+      expect(inlineMenuContentService.refreshTopLayerPosition).toHaveBeenCalled();
+    });
+
+    it("does not throw if inline menu content service is not available", () => {
+      const serviceWithoutInlineMenu = new AutofillOverlayContentService(
+        domQueryService,
+        domElementVisibilityService,
+        inlineMenuFieldQualificationService,
+      );
+
+      expect(() => serviceWithoutInlineMenu.refreshMenuLayerPosition()).not.toThrow();
+    });
+  });
+
+  describe("getOwnedInlineMenuTagNames", () => {
+    it("returns tag names from the inline menu content service", () => {
+      inlineMenuContentService.getOwnedTagNames.mockReturnValue(["div", "span"]);
+
+      const result = autofillOverlayContentService.getOwnedInlineMenuTagNames();
+
+      expect(result).toEqual(["div", "span"]);
+    });
+
+    it("returns an empty array if inline menu content service is not available", () => {
+      const serviceWithoutInlineMenu = new AutofillOverlayContentService(
+        domQueryService,
+        domElementVisibilityService,
+        inlineMenuFieldQualificationService,
+      );
+
+      const result = serviceWithoutInlineMenu.getOwnedInlineMenuTagNames();
+
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe("getUnownedTopLayerItems", () => {
+    it("returns unowned top layer items from the inline menu content service", () => {
+      const mockElements = document.querySelectorAll("div");
+      inlineMenuContentService.getUnownedTopLayerItems.mockReturnValue(mockElements);
+
+      const result = autofillOverlayContentService.getUnownedTopLayerItems(true);
+
+      expect(result).toEqual(mockElements);
+      expect(inlineMenuContentService.getUnownedTopLayerItems).toHaveBeenCalledWith(true);
+    });
+
+    it("returns undefined if inline menu content service is not available", () => {
+      const serviceWithoutInlineMenu = new AutofillOverlayContentService(
+        domQueryService,
+        domElementVisibilityService,
+        inlineMenuFieldQualificationService,
+      );
+
+      const result = serviceWithoutInlineMenu.getUnownedTopLayerItems();
+
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe("clearUserFilledFields", () => {
+    it("deletes all user filled fields", () => {
+      const mockElement1 = document.createElement("input") as FillableFormFieldElement;
+      const mockElement2 = document.createElement("input") as FillableFormFieldElement;
+      autofillOverlayContentService["userFilledFields"] = {
+        username: mockElement1,
+        password: mockElement2,
+      };
+
+      autofillOverlayContentService.clearUserFilledFields();
+
+      expect(autofillOverlayContentService["userFilledFields"]).toEqual({});
+    });
+  });
+
   describe("handleOverlayRepositionEvent", () => {
     const repositionEvents = [EVENTS.SCROLL, EVENTS.RESIZE];
     repositionEvents.forEach((repositionEvent) => {
@@ -2049,7 +2128,7 @@ describe("AutofillOverlayContentService", () => {
       });
 
       it("skips focusing an element if no recently focused field exists", async () => {
-        autofillOverlayContentService["mostRecentlyFocusedField"] = undefined;
+        (autofillOverlayContentService as any)["mostRecentlyFocusedField"] = null;
 
         sendMockExtensionMessage({
           command: "redirectAutofillInlineMenuFocusOut",
@@ -2149,7 +2228,6 @@ describe("AutofillOverlayContentService", () => {
       });
 
       it("returns null if the sub frame URL cannot be parsed correctly", async () => {
-        delete globalThis.location;
         globalThis.location = { href: "invalid-base" } as Location;
         sendMockExtensionMessage(
           {
diff --git a/apps/browser/src/autofill/services/collect-autofill-content.service.ts b/apps/browser/src/autofill/services/collect-autofill-content.service.ts
index 6f2c00a4dd4..367599f7ad0 100644
--- a/apps/browser/src/autofill/services/collect-autofill-content.service.ts
+++ b/apps/browser/src/autofill/services/collect-autofill-content.service.ts
@@ -1400,7 +1400,7 @@ export class CollectAutofillContentService implements CollectAutofillContentServ
     this.intersectionObserver = new IntersectionObserver(this.handleFormElementIntersection, {
       root: null,
       rootMargin: "0px",
-      threshold: 1.0,
+      threshold: 0.9999, // Safari doesn't seem to function properly with a threshold of 1,
     });
   }
 
diff --git a/apps/browser/src/autofill/services/inline-menu-field-qualification.service.ts b/apps/browser/src/autofill/services/inline-menu-field-qualification.service.ts
index f7c46a9fa77..f6afaae202f 100644
--- a/apps/browser/src/autofill/services/inline-menu-field-qualification.service.ts
+++ b/apps/browser/src/autofill/services/inline-menu-field-qualification.service.ts
@@ -945,7 +945,8 @@ export class InlineMenuFieldQualificationService
       !fieldType ||
       !this.usernameFieldTypes.has(fieldType) ||
       this.isExcludedFieldType(field, this.excludedAutofillFieldTypesSet) ||
-      this.fieldHasDisqualifyingAttributeValue(field)
+      this.fieldHasDisqualifyingAttributeValue(field) ||
+      this.isTotpField(field)
     ) {
       return false;
     }
diff --git a/apps/browser/src/background/main.background.ts b/apps/browser/src/background/main.background.ts
index 143f5d1f6b3..2540571abb0 100644
--- a/apps/browser/src/background/main.background.ts
+++ b/apps/browser/src/background/main.background.ts
@@ -297,6 +297,7 @@ import { SafariApp } from "../browser/safariApp";
 import { PhishingDataService } from "../dirt/phishing-detection/services/phishing-data.service";
 import { PhishingDetectionService } from "../dirt/phishing-detection/services/phishing-detection.service";
 import { BackgroundBrowserBiometricsService } from "../key-management/biometrics/background-browser-biometrics.service";
+import { BrowserSessionTimeoutTypeService } from "../key-management/session-timeout/services/browser-session-timeout-type.service";
 import VaultTimeoutService from "../key-management/vault-timeout/vault-timeout.service";
 import { BrowserActionsService } from "../platform/actions/browser-actions.service";
 import { DefaultBadgeBrowserApi } from "../platform/badge/badge-browser-api";
@@ -738,6 +739,10 @@ export default class MainBackground {
       this.accountService,
     );
 
+    const sessionTimeoutTypeService = new BrowserSessionTimeoutTypeService(
+      this.platformUtilsService,
+    );
+
     this.vaultTimeoutSettingsService = new DefaultVaultTimeoutSettingsService(
       this.accountService,
       pinStateService,
@@ -749,6 +754,7 @@ export default class MainBackground {
       this.stateProvider,
       this.logService,
       VaultTimeoutStringType.OnRestart, // default vault timeout
+      sessionTimeoutTypeService,
     );
 
     this.apiService = new ApiService(
@@ -835,10 +841,7 @@ export default class MainBackground {
     );
 
     this.pinService = new PinService(
-      this.accountService,
       this.encryptService,
-      this.kdfConfigService,
-      this.keyGenerationService,
       this.logService,
       this.keyService,
       this.sdkService,
@@ -1106,7 +1109,7 @@ export default class MainBackground {
       this.collectionService,
       this.keyService,
       this.encryptService,
-      this.pinService,
+      this.keyGenerationService,
       this.accountService,
       this.restrictedItemTypesService,
     );
@@ -1114,7 +1117,7 @@ export default class MainBackground {
     this.individualVaultExportService = new IndividualVaultExportService(
       this.folderService,
       this.cipherService,
-      this.pinService,
+      this.keyGenerationService,
       this.keyService,
       this.encryptService,
       this.cryptoFunctionService,
@@ -1128,7 +1131,7 @@ export default class MainBackground {
     this.organizationVaultExportService = new OrganizationVaultExportService(
       this.cipherService,
       this.exportApiService,
-      this.pinService,
+      this.keyGenerationService,
       this.keyService,
       this.encryptService,
       this.cryptoFunctionService,
diff --git a/apps/browser/src/background/runtime.background.ts b/apps/browser/src/background/runtime.background.ts
index 597babdc777..eba6b01fe90 100644
--- a/apps/browser/src/background/runtime.background.ts
+++ b/apps/browser/src/background/runtime.background.ts
@@ -294,19 +294,11 @@ export default class RuntimeBackground {
         await this.openPopup();
         break;
       case VaultMessages.OpenAtRiskPasswords: {
-        if (await this.shouldRejectManyOriginMessage(msg)) {
-          return;
-        }
-
         await this.main.openAtRisksPasswordsPage();
         this.announcePopupOpen();
         break;
       }
       case VaultMessages.OpenBrowserExtensionToUrl: {
-        if (await this.shouldRejectManyOriginMessage(msg)) {
-          return;
-        }
-
         await this.main.openTheExtensionToPage(msg.url);
         this.announcePopupOpen();
         break;
diff --git a/apps/browser/src/billing/popup/settings/premium-v2.component.html b/apps/browser/src/billing/popup/settings/premium-v2.component.html
index 47d72751af3..fea3e558057 100644
--- a/apps/browser/src/billing/popup/settings/premium-v2.component.html
+++ b/apps/browser/src/billing/popup/settings/premium-v2.component.html
@@ -12,7 +12,7 @@
         <div class="tw-flex tw-flex-col tw-p-2">
           <ul class="tw-list-disc tw-pl-5 tw-space-y-2 tw-break-words tw-mb-0">
             <li>
-              {{ "ppremiumSignUpStorage" | i18n }}
+              {{ "premiumSignUpStorageV2" | i18n: `${storageProvidedGb} GB` }}
             </li>
             <li>
               {{ "premiumSignUpTwoStepOptions" | i18n }}
diff --git a/apps/browser/src/billing/popup/settings/premium-v2.component.ts b/apps/browser/src/billing/popup/settings/premium-v2.component.ts
index b858b74242d..0c246d734e5 100644
--- a/apps/browser/src/billing/popup/settings/premium-v2.component.ts
+++ b/apps/browser/src/billing/popup/settings/premium-v2.component.ts
@@ -1,13 +1,14 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import { CommonModule, CurrencyPipe, Location } from "@angular/common";
-import { Component } from "@angular/core";
+import { Component, OnInit } from "@angular/core";
 import { RouterModule } from "@angular/router";
 
 import { PremiumComponent as BasePremiumComponent } from "@bitwarden/angular/billing/components/premium.component";
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstractions";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -44,7 +45,7 @@ import { PopupPageComponent } from "../../../platform/popup/layout/popup-page.co
     SectionComponent,
   ],
 })
-export class PremiumV2Component extends BasePremiumComponent {
+export class PremiumV2Component extends BasePremiumComponent implements OnInit {
   priceString: string;
 
   constructor(
@@ -59,6 +60,7 @@ export class PremiumV2Component extends BasePremiumComponent {
     billingAccountProfileStateService: BillingAccountProfileStateService,
     toastService: ToastService,
     accountService: AccountService,
+    billingApiService: BillingApiServiceAbstraction,
   ) {
     super(
       i18nService,
@@ -70,15 +72,18 @@ export class PremiumV2Component extends BasePremiumComponent {
       billingAccountProfileStateService,
       toastService,
       accountService,
+      billingApiService,
     );
-
+  }
+  async ngOnInit() {
+    await super.ngOnInit();
     // Support old price string. Can be removed in future once all translations are properly updated.
     const thePrice = this.currencyPipe.transform(this.price, "$");
     // Safari extension crashes due to $1 appearing in the price string ($10.00). Escape the $ to fix.
     const formattedPrice = this.platformUtilsService.isSafari()
       ? thePrice.replace("$", "$$$")
       : thePrice;
-    this.priceString = i18nService.t("premiumPriceV2", formattedPrice);
+    this.priceString = this.i18nService.t("premiumPriceV2", formattedPrice);
     if (this.priceString.indexOf("%price%") > -1) {
       this.priceString = this.priceString.replace("%price%", thePrice);
     }
diff --git a/apps/browser/src/key-management/biometrics/foreground-browser-biometrics.ts b/apps/browser/src/key-management/biometrics/foreground-browser-biometrics.ts
index b6e84fee31a..d803a457a81 100644
--- a/apps/browser/src/key-management/biometrics/foreground-browser-biometrics.ts
+++ b/apps/browser/src/key-management/biometrics/foreground-browser-biometrics.ts
@@ -48,7 +48,11 @@ export class ForegroundBrowserBiometricsService extends BiometricsService {
       result: BiometricsStatus;
       error: string;
     }>(BiometricsCommands.GetBiometricsStatusForUser, { userId: id });
-    return response.result;
+    if (response != null) {
+      return response.result;
+    } else {
+      return BiometricsStatus.DesktopDisconnected;
+    }
   }
 
   async getShouldAutopromptNow(): Promise<boolean> {
diff --git a/apps/browser/src/key-management/key-connector/remove-password.component.html b/apps/browser/src/key-management/key-connector/remove-password.component.html
deleted file mode 100644
index 427065e83f3..00000000000
--- a/apps/browser/src/key-management/key-connector/remove-password.component.html
+++ /dev/null
@@ -1,51 +0,0 @@
-<popup-page>
-  <popup-header slot="header" pageTitle="{{ 'removeMasterPassword' | i18n }}">
-    <ng-container slot="end">
-      <app-pop-out></app-pop-out>
-    </ng-container>
-  </popup-header>
-
-  @if (loading) {
-    <div class="tw-text-center">
-      <i
-        class="bwi bwi-spinner bwi-spin bwi-2x tw-text-muted"
-        title="{{ 'loading' | i18n }}"
-        aria-hidden="true"
-      ></i>
-      <span class="tw-sr-only">{{ "loading" | i18n }}</span>
-    </div>
-  } @else {
-    <p>{{ "removeMasterPasswordForOrganizationUserKeyConnector" | i18n }}</p>
-    <p class="tw-mb-0">{{ "organizationName" | i18n }}:</p>
-    <p class="tw-text-muted tw-mb-6">{{ organization.name }}</p>
-    <p class="tw-mb-0">{{ "keyConnectorDomain" | i18n }}:</p>
-    <p class="tw-text-muted tw-mb-6">{{ organization.keyConnectorUrl }}</p>
-    <button
-      type="button"
-      bitButton
-      buttonType="primary"
-      block
-      (click)="convert()"
-      [disabled]="action"
-      class="tw-mb-2"
-    >
-      <i
-        class="bwi bwi-spinner bwi-spin"
-        title="{{ 'loading' | i18n }}"
-        aria-hidden="true"
-        *ngIf="continuing"
-      ></i>
-      {{ "removeMasterPassword" | i18n }}
-    </button>
-
-    <button type="button" bitButton block (click)="leave()" [disabled]="action">
-      <i
-        class="bwi bwi-spinner bwi-spin"
-        title="{{ 'loading' | i18n }}"
-        aria-hidden="true"
-        *ngIf="leaving"
-      ></i>
-      {{ "leaveOrganization" | i18n }}
-    </button>
-  }
-</popup-page>
diff --git a/apps/browser/src/key-management/key-connector/remove-password.component.ts b/apps/browser/src/key-management/key-connector/remove-password.component.ts
deleted file mode 100644
index c4077a1eca9..00000000000
--- a/apps/browser/src/key-management/key-connector/remove-password.component.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-// FIXME (PM-22628): angular imports are forbidden in background
-// eslint-disable-next-line no-restricted-imports
-import { Component } from "@angular/core";
-
-import { RemovePasswordComponent as BaseRemovePasswordComponent } from "@bitwarden/key-management-ui";
-
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
-@Component({
-  selector: "app-remove-password",
-  templateUrl: "remove-password.component.html",
-  standalone: false,
-})
-export class RemovePasswordComponent extends BaseRemovePasswordComponent {}
diff --git a/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.spec.ts b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.spec.ts
new file mode 100644
index 00000000000..cf5d556a553
--- /dev/null
+++ b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.spec.ts
@@ -0,0 +1,57 @@
+import { mock } from "jest-mock-extended";
+
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
+import {
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
+
+import { BrowserSessionTimeoutSettingsComponentService } from "./browser-session-timeout-settings-component.service";
+
+describe("BrowserSessionTimeoutSettingsComponentService", () => {
+  let service: BrowserSessionTimeoutSettingsComponentService;
+  let mockI18nService: jest.Mocked<I18nService>;
+  let mockSessionTimeoutTypeService: jest.Mocked<SessionTimeoutTypeService>;
+  let mockPolicyService: jest.Mocked<PolicyService>;
+  let mockMessagingService: jest.Mocked<MessagingService>;
+
+  beforeEach(() => {
+    mockI18nService = mock<I18nService>();
+    mockSessionTimeoutTypeService = mock<SessionTimeoutTypeService>();
+    mockPolicyService = mock<PolicyService>();
+    mockMessagingService = mock<MessagingService>();
+
+    service = new BrowserSessionTimeoutSettingsComponentService(
+      mockI18nService,
+      mockSessionTimeoutTypeService,
+      mockPolicyService,
+      mockMessagingService,
+    );
+  });
+
+  describe("onTimeoutSave", () => {
+    it("should call messagingService.send with 'bgReseedStorage' when timeout is Never", () => {
+      service.onTimeoutSave(VaultTimeoutStringType.Never);
+
+      expect(mockMessagingService.send).toHaveBeenCalledWith("bgReseedStorage");
+    });
+
+    it.each([
+      VaultTimeoutNumberType.Immediately,
+      VaultTimeoutNumberType.OnMinute,
+      VaultTimeoutNumberType.EightHours,
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.Custom,
+    ])("should not call messagingService.send when timeout is %s", (timeoutValue) => {
+      service.onTimeoutSave(timeoutValue);
+
+      expect(mockMessagingService.send).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.ts b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.ts
index 297718687eb..24925e25e24 100644
--- a/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.ts
+++ b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-settings-component.service.ts
@@ -1,56 +1,24 @@
-import { defer, Observable, of } from "rxjs";
-
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
 import {
   VaultTimeout,
-  VaultTimeoutOption,
   VaultTimeoutStringType,
 } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { SessionTimeoutSettingsComponentService } from "@bitwarden/key-management-ui";
 
-export class BrowserSessionTimeoutSettingsComponentService
-  implements SessionTimeoutSettingsComponentService
-{
-  availableTimeoutOptions$: Observable<VaultTimeoutOption[]> = defer(() => {
-    const options: VaultTimeoutOption[] = [
-      { name: this.i18nService.t("immediately"), value: 0 },
-      { name: this.i18nService.t("oneMinute"), value: 1 },
-      { name: this.i18nService.t("fiveMinutes"), value: 5 },
-      { name: this.i18nService.t("fifteenMinutes"), value: 15 },
-      { name: this.i18nService.t("thirtyMinutes"), value: 30 },
-      { name: this.i18nService.t("oneHour"), value: 60 },
-      { name: this.i18nService.t("fourHours"), value: 240 },
-    ];
-
-    const showOnLocked =
-      !this.platformUtilsService.isFirefox() &&
-      !this.platformUtilsService.isSafari() &&
-      !(this.platformUtilsService.isOpera() && navigator.platform === "MacIntel");
-
-    if (showOnLocked) {
-      options.push({
-        name: this.i18nService.t("onLocked"),
-        value: VaultTimeoutStringType.OnLocked,
-      });
-    }
-
-    options.push(
-      { name: this.i18nService.t("onRestart"), value: VaultTimeoutStringType.OnRestart },
-      { name: this.i18nService.t("never"), value: VaultTimeoutStringType.Never },
-    );
-
-    return of(options);
-  });
-
+export class BrowserSessionTimeoutSettingsComponentService extends SessionTimeoutSettingsComponentService {
   constructor(
-    private readonly i18nService: I18nService,
-    private readonly platformUtilsService: PlatformUtilsService,
+    i18nService: I18nService,
+    sessionTimeoutTypeService: SessionTimeoutTypeService,
+    policyService: PolicyService,
     private readonly messagingService: MessagingService,
-  ) {}
+  ) {
+    super(i18nService, sessionTimeoutTypeService, policyService);
+  }
 
-  onTimeoutSave(timeout: VaultTimeout): void {
+  override onTimeoutSave(timeout: VaultTimeout): void {
     if (timeout === VaultTimeoutStringType.Never) {
       this.messagingService.send("bgReseedStorage");
     }
diff --git a/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.spec.ts b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.spec.ts
new file mode 100644
index 00000000000..83de5c51a4a
--- /dev/null
+++ b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.spec.ts
@@ -0,0 +1,139 @@
+import { mock } from "jest-mock-extended";
+
+import {
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+
+import { BrowserSessionTimeoutTypeService } from "./browser-session-timeout-type.service";
+
+describe("BrowserSessionTimeoutTypeService", () => {
+  let service: BrowserSessionTimeoutTypeService;
+  let mockPlatformUtilsService: jest.Mocked<PlatformUtilsService>;
+
+  beforeEach(() => {
+    mockPlatformUtilsService = mock<PlatformUtilsService>();
+    service = new BrowserSessionTimeoutTypeService(mockPlatformUtilsService);
+  });
+
+  describe("isAvailable", () => {
+    it.each([
+      VaultTimeoutNumberType.Immediately,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.Never,
+      VaultTimeoutStringType.Custom,
+    ])("should return true for always available type: %s", async (timeoutType) => {
+      const result = await service.isAvailable(timeoutType);
+
+      expect(result).toBe(true);
+    });
+
+    it.each([VaultTimeoutNumberType.OnMinute, VaultTimeoutNumberType.EightHours])(
+      "should return true for numeric timeout type: %s",
+      async (timeoutType) => {
+        const result = await service.isAvailable(timeoutType);
+
+        expect(result).toBe(true);
+      },
+    );
+
+    describe("OnLocked availability", () => {
+      const mockNavigatorPlatform = (platform: string) => {
+        Object.defineProperty(navigator, "platform", {
+          value: platform,
+          writable: true,
+          configurable: true,
+        });
+      };
+
+      beforeEach(() => {
+        mockNavigatorPlatform("Linux x86_64");
+        mockPlatformUtilsService.isFirefox.mockReturnValue(false);
+        mockPlatformUtilsService.isSafari.mockReturnValue(false);
+        mockPlatformUtilsService.isOpera.mockReturnValue(false);
+      });
+
+      it("should return true when not Firefox, Safari, or Opera on Mac", async () => {
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(true);
+      });
+
+      it("should return true when Opera on non-Mac platform", async () => {
+        mockNavigatorPlatform("Win32");
+        mockPlatformUtilsService.isOpera.mockReturnValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(true);
+      });
+
+      it("should return false when Opera on Mac", async () => {
+        mockNavigatorPlatform("MacIntel");
+        mockPlatformUtilsService.isOpera.mockReturnValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(false);
+      });
+
+      it("should return false when Firefox", async () => {
+        mockPlatformUtilsService.isFirefox.mockReturnValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(false);
+      });
+
+      it("should return false when Safari", async () => {
+        mockPlatformUtilsService.isSafari.mockReturnValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(false);
+      });
+    });
+
+    it.each([VaultTimeoutStringType.OnIdle, VaultTimeoutStringType.OnSleep])(
+      "should return false for unavailable timeout type: %s",
+      async (timeoutType) => {
+        const result = await service.isAvailable(timeoutType);
+
+        expect(result).toBe(false);
+      },
+    );
+  });
+
+  describe("getOrPromoteToAvailable", () => {
+    it.each([
+      VaultTimeoutNumberType.Immediately,
+      VaultTimeoutNumberType.OnMinute,
+      VaultTimeoutStringType.Never,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.Custom,
+    ])("should return the original type when it is available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(true);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(timeoutType);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+
+    it.each([
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnLocked,
+      5,
+    ])("should return OnRestart when type is not available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(VaultTimeoutStringType.OnRestart);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+  });
+});
diff --git a/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.ts b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.ts
new file mode 100644
index 00000000000..33ac3e356d4
--- /dev/null
+++ b/apps/browser/src/key-management/session-timeout/services/browser-session-timeout-type.service.ts
@@ -0,0 +1,43 @@
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
+import {
+  isVaultTimeoutTypeNumeric,
+  VaultTimeout,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+
+export class BrowserSessionTimeoutTypeService implements SessionTimeoutTypeService {
+  constructor(private readonly platformUtilsService: PlatformUtilsService) {}
+
+  async isAvailable(type: VaultTimeout): Promise<boolean> {
+    switch (type) {
+      case VaultTimeoutNumberType.Immediately:
+      case VaultTimeoutStringType.OnRestart:
+      case VaultTimeoutStringType.Never:
+      case VaultTimeoutStringType.Custom:
+        return true;
+      case VaultTimeoutStringType.OnLocked:
+        return (
+          !this.platformUtilsService.isFirefox() &&
+          !this.platformUtilsService.isSafari() &&
+          !(this.platformUtilsService.isOpera() && navigator.platform === "MacIntel")
+        );
+      default:
+        if (isVaultTimeoutTypeNumeric(type)) {
+          return true;
+        }
+        break;
+    }
+
+    return false;
+  }
+
+  async getOrPromoteToAvailable(type: VaultTimeout): Promise<VaultTimeout> {
+    const available = await this.isAvailable(type);
+    if (!available) {
+      return VaultTimeoutStringType.OnRestart;
+    }
+    return type;
+  }
+}
diff --git a/apps/browser/src/platform/popup/layout/popup-tab-navigation.component.ts b/apps/browser/src/platform/popup/layout/popup-tab-navigation.component.ts
index 4abd9cd4803..26138d57954 100644
--- a/apps/browser/src/platform/popup/layout/popup-tab-navigation.component.ts
+++ b/apps/browser/src/platform/popup/layout/popup-tab-navigation.component.ts
@@ -22,7 +22,7 @@ export type NavButton = {
   templateUrl: "popup-tab-navigation.component.html",
   imports: [CommonModule, LinkModule, RouterModule, JslibModule, IconModule],
   host: {
-    class: "tw-block tw-h-full tw-w-full tw-flex tw-flex-col",
+    class: "tw-block tw-size-full tw-flex tw-flex-col",
   },
 })
 export class PopupTabNavigationComponent {
diff --git a/apps/browser/src/popup/app-routing.module.ts b/apps/browser/src/popup/app-routing.module.ts
index a36396afa1a..eb64c076192 100644
--- a/apps/browser/src/popup/app-routing.module.ts
+++ b/apps/browser/src/popup/app-routing.module.ts
@@ -43,11 +43,16 @@ import {
   TwoFactorAuthGuard,
 } from "@bitwarden/auth/angular";
 import { AnonLayoutWrapperComponent, AnonLayoutWrapperData } from "@bitwarden/components";
-import { LockComponent, ConfirmKeyConnectorDomainComponent } from "@bitwarden/key-management-ui";
+import {
+  LockComponent,
+  ConfirmKeyConnectorDomainComponent,
+  RemovePasswordComponent,
+} from "@bitwarden/key-management-ui";
 
 import { AccountSwitcherComponent } from "../auth/popup/account-switching/account-switcher.component";
 import { AuthExtensionRoute } from "../auth/popup/constants/auth-extension-route.constant";
 import { fido2AuthGuard } from "../auth/popup/guards/fido2-auth.guard";
+import { platformPopoutGuard } from "../auth/popup/guards/platform-popout.guard";
 import { AccountSecurityComponent } from "../auth/popup/settings/account-security.component";
 import { ExtensionDeviceManagementComponent } from "../auth/popup/settings/extension-device-management.component";
 import { Fido2Component } from "../autofill/popup/fido2/fido2.component";
@@ -58,7 +63,6 @@ import { NotificationsSettingsComponent } from "../autofill/popup/settings/notif
 import { PremiumV2Component } from "../billing/popup/settings/premium-v2.component";
 import { PhishingWarning } from "../dirt/phishing-detection/popup/phishing-warning.component";
 import { ProtectedByComponent } from "../dirt/phishing-detection/popup/protected-by-component";
-import { RemovePasswordComponent } from "../key-management/key-connector/remove-password.component";
 import BrowserPopupUtils from "../platform/browser/browser-popup-utils";
 import { popupRouterCacheGuard } from "../platform/popup/view-cache/popup-router-cache.service";
 import { RouteCacheOptions } from "../platform/services/popup-view-cache-background.service";
@@ -187,9 +191,22 @@ const routes: Routes = [
   },
   {
     path: "remove-password",
-    component: RemovePasswordComponent,
+    component: ExtensionAnonLayoutWrapperComponent,
     canActivate: [authGuard],
     data: { elevation: 1 } satisfies RouteDataProperties,
+    children: [
+      {
+        path: "",
+        component: RemovePasswordComponent,
+        data: {
+          pageTitle: {
+            key: "verifyYourOrganization",
+          },
+          showBackButton: false,
+          pageIcon: LockIcon,
+        } satisfies ExtensionAnonLayoutWrapperData,
+      },
+    ],
   },
   {
     path: "view-cipher",
@@ -414,7 +431,7 @@ const routes: Routes = [
       },
       {
         path: AuthRoute.LoginWithPasskey,
-        canActivate: [unauthGuardFn(unauthRouteOverrides)],
+        canActivate: [unauthGuardFn(unauthRouteOverrides), platformPopoutGuard(["linux"])],
         data: {
           pageIcon: TwoFactorAuthSecurityKeyIcon,
           pageTitle: {
@@ -645,7 +662,7 @@ const routes: Routes = [
         component: ConfirmKeyConnectorDomainComponent,
         data: {
           pageTitle: {
-            key: "confirmKeyConnectorDomain",
+            key: "verifyYourOrganization",
           },
           showBackButton: true,
           pageIcon: DomainIcon,
diff --git a/apps/browser/src/popup/app.component.html b/apps/browser/src/popup/app.component.html
index 3d81354ca35..3a5c8021e17 100644
--- a/apps/browser/src/popup/app.component.html
+++ b/apps/browser/src/popup/app.component.html
@@ -13,8 +13,11 @@
     </bit-callout>
   </div>
 } @else {
-  <div [@routerTransition]="getRouteElevation(outlet)">
-    <router-outlet #outlet="outlet"></router-outlet>
+  <!-- eslint-disable-next-line -->
+  <div class="tw-h-screen tw-w-screen">
+    <div [@routerTransition]="getRouteElevation(outlet)" class="tw-size-full">
+      <router-outlet #outlet="outlet"></router-outlet>
+    </div>
+    <bit-toast-container></bit-toast-container>
   </div>
-  <bit-toast-container></bit-toast-container>
 }
diff --git a/apps/browser/src/popup/app.module.ts b/apps/browser/src/popup/app.module.ts
index 71846cc6444..d178cee2fc3 100644
--- a/apps/browser/src/popup/app.module.ts
+++ b/apps/browser/src/popup/app.module.ts
@@ -28,7 +28,6 @@ import { CurrentAccountComponent } from "../auth/popup/account-switching/current
 import { AccountSecurityComponent } from "../auth/popup/settings/account-security.component";
 import { AutofillComponent } from "../autofill/popup/settings/autofill.component";
 import { NotificationsSettingsComponent } from "../autofill/popup/settings/notifications.component";
-import { RemovePasswordComponent } from "../key-management/key-connector/remove-password.component";
 import { PopOutComponent } from "../platform/popup/components/pop-out.component";
 import { PopupFooterComponent } from "../platform/popup/layout/popup-footer.component";
 import { PopupHeaderComponent } from "../platform/popup/layout/popup-header.component";
@@ -85,13 +84,7 @@ import "../platform/popup/locales";
     CalloutModule,
     LinkModule,
   ],
-  declarations: [
-    AppComponent,
-    ColorPasswordPipe,
-    ColorPasswordCountPipe,
-    TabsV2Component,
-    RemovePasswordComponent,
-  ],
+  declarations: [AppComponent, ColorPasswordPipe, ColorPasswordCountPipe, TabsV2Component],
   exports: [CalloutModule],
   providers: [CurrencyPipe, DatePipe],
   bootstrap: [AppComponent],
diff --git a/apps/browser/src/popup/scss/base.scss b/apps/browser/src/popup/scss/base.scss
deleted file mode 100644
index 01b9d3f05d5..00000000000
--- a/apps/browser/src/popup/scss/base.scss
+++ /dev/null
@@ -1,453 +0,0 @@
-@import "variables.scss";
-
-* {
-  box-sizing: border-box;
-  padding: 0;
-  margin: 0;
-}
-
-html {
-  overflow: hidden;
-  min-height: 600px;
-  height: 100%;
-
-  &.body-sm {
-    min-height: 500px;
-  }
-
-  &.body-xs {
-    min-height: 400px;
-  }
-
-  &.body-xxs {
-    min-height: 300px;
-  }
-
-  &.body-3xs {
-    min-height: 240px;
-  }
-
-  &.body-full {
-    min-height: unset;
-    width: 100%;
-    height: 100%;
-
-    & body {
-      width: 100%;
-    }
-  }
-}
-
-html,
-body {
-  font-family: $font-family-sans-serif;
-  font-size: $font-size-base;
-  line-height: $line-height-base;
-  -webkit-font-smoothing: antialiased;
-}
-
-body {
-  width: 380px;
-  height: 100%;
-  position: relative;
-  min-height: inherit;
-  overflow: hidden;
-  color: $text-color;
-  background-color: $background-color;
-
-  @include themify($themes) {
-    color: themed("textColor");
-    background-color: themed("backgroundColor");
-  }
-}
-
-h1,
-h2,
-h3,
-h4,
-h5,
-h6 {
-  font-family: $font-family-sans-serif;
-  font-size: $font-size-base;
-  font-weight: normal;
-}
-
-p {
-  margin-bottom: 10px;
-}
-
-ul,
-ol {
-  margin-bottom: 10px;
-}
-
-img {
-  border: none;
-}
-
-a:not(popup-page a, popup-tab-navigation a) {
-  text-decoration: none;
-
-  @include themify($themes) {
-    color: themed("primaryColor");
-  }
-
-  &:hover,
-  &:focus {
-    @include themify($themes) {
-      color: darken(themed("primaryColor"), 6%);
-    }
-  }
-}
-
-input:not(bit-form-field input, bit-search input, input[bitcheckbox]),
-select:not(bit-form-field select),
-textarea:not(bit-form-field textarea) {
-  @include themify($themes) {
-    color: themed("textColor");
-    background-color: themed("inputBackgroundColor");
-  }
-}
-
-input:not(input[bitcheckbox]),
-select,
-textarea,
-button:not(bit-chip-select button) {
-  font-size: $font-size-base;
-  font-family: $font-family-sans-serif;
-}
-
-input[type*="date"] {
-  @include themify($themes) {
-    color-scheme: themed("dateInputColorScheme");
-  }
-}
-
-::-webkit-calendar-picker-indicator {
-  @include themify($themes) {
-    filter: themed("webkitCalendarPickerFilter");
-  }
-}
-
-::-webkit-calendar-picker-indicator:hover {
-  @include themify($themes) {
-    filter: themed("webkitCalendarPickerHoverFilter");
-  }
-  cursor: pointer;
-}
-
-select {
-  width: 100%;
-  padding: 0.35rem;
-}
-
-button {
-  cursor: pointer;
-}
-
-textarea {
-  resize: vertical;
-}
-
-app-root > div {
-  height: 100%;
-  width: 100%;
-}
-
-main::-webkit-scrollbar,
-cdk-virtual-scroll-viewport::-webkit-scrollbar,
-.vault-select::-webkit-scrollbar {
-  width: 10px;
-  height: 10px;
-}
-
-main::-webkit-scrollbar-track,
-.vault-select::-webkit-scrollbar-track {
-  background-color: transparent;
-}
-
-cdk-virtual-scroll-viewport::-webkit-scrollbar-track {
-  @include themify($themes) {
-    background-color: themed("backgroundColor");
-  }
-}
-
-main::-webkit-scrollbar-thumb,
-cdk-virtual-scroll-viewport::-webkit-scrollbar-thumb,
-.vault-select::-webkit-scrollbar-thumb {
-  border-radius: 10px;
-  margin-right: 1px;
-
-  @include themify($themes) {
-    background-color: themed("scrollbarColor");
-  }
-
-  &:hover {
-    @include themify($themes) {
-      background-color: themed("scrollbarHoverColor");
-    }
-  }
-}
-
-header:not(bit-callout header, bit-dialog header, popup-page header) {
-  height: 44px;
-  display: flex;
-
-  &:not(.no-theme) {
-    border-bottom: 1px solid #000000;
-
-    @include themify($themes) {
-      color: themed("headerColor");
-      background-color: themed("headerBackgroundColor");
-      border-bottom-color: themed("headerBorderColor");
-    }
-  }
-
-  .header-content {
-    display: flex;
-    flex: 1 1 auto;
-  }
-
-  .header-content > .right,
-  .header-content > .right > .right {
-    height: 100%;
-  }
-
-  .left,
-  .right {
-    flex: 1;
-    display: flex;
-    min-width: -webkit-min-content; /* Workaround to Chrome bug */
-    .header-icon {
-      margin-right: 5px;
-    }
-  }
-
-  .right {
-    justify-content: flex-end;
-    align-items: center;
-    app-avatar {
-      max-height: 30px;
-      margin-right: 5px;
-    }
-  }
-
-  .center {
-    display: flex;
-    align-items: center;
-    text-align: center;
-    min-width: 0;
-  }
-
-  .login-center {
-    margin: auto;
-  }
-
-  app-pop-out > button,
-  div > button:not(app-current-account button):not(.home-acc-switcher-btn),
-  div > a {
-    border: none;
-    padding: 0 10px;
-    text-decoration: none;
-    display: flex;
-    flex-direction: row;
-    justify-content: center;
-    align-items: center;
-    height: 100%;
-    white-space: pre;
-
-    &:not(.home-acc-switcher-btn):hover,
-    &:not(.home-acc-switcher-btn):focus {
-      @include themify($themes) {
-        background-color: themed("headerBackgroundHoverColor");
-        color: themed("headerColor");
-      }
-    }
-
-    &[disabled] {
-      opacity: 0.65;
-      cursor: default !important;
-      background-color: inherit !important;
-    }
-
-    i + span {
-      margin-left: 5px;
-    }
-  }
-
-  app-pop-out {
-    display: flex;
-    padding-right: 0.5em;
-  }
-
-  .title {
-    font-weight: bold;
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-  }
-
-  .search {
-    padding: 7px 10px;
-    width: 100%;
-    text-align: left;
-    position: relative;
-    display: flex;
-
-    .bwi {
-      position: absolute;
-      top: 15px;
-      left: 20px;
-
-      @include themify($themes) {
-        color: themed("headerInputPlaceholderColor");
-      }
-    }
-
-    input:not(bit-form-field input) {
-      width: 100%;
-      margin: 0;
-      border: none;
-      padding: 5px 10px 5px 30px;
-      border-radius: $border-radius;
-
-      @include themify($themes) {
-        background-color: themed("headerInputBackgroundColor");
-        color: themed("headerInputColor");
-      }
-
-      &::selection {
-        @include themify($themes) {
-          // explicitly set text selection to invert foreground/background
-          background-color: themed("headerInputColor");
-          color: themed("headerInputBackgroundColor");
-        }
-      }
-
-      &:focus {
-        border-radius: $border-radius;
-        outline: none;
-
-        @include themify($themes) {
-          background-color: themed("headerInputBackgroundFocusColor");
-        }
-      }
-
-      &::-webkit-input-placeholder {
-        @include themify($themes) {
-          color: themed("headerInputPlaceholderColor");
-        }
-      }
-      /** make the cancel button visible in both dark/light themes **/
-      &[type="search"]::-webkit-search-cancel-button {
-        -webkit-appearance: none;
-        appearance: none;
-        height: 15px;
-        width: 15px;
-        background-repeat: no-repeat;
-        mask-image: url("../images/close-button-white.svg");
-        -webkit-mask-image: url("../images/close-button-white.svg");
-        @include themify($themes) {
-          background-color: themed("headerInputColor");
-        }
-      }
-    }
-  }
-
-  .left + .search,
-  .left + .sr-only + .search {
-    padding-left: 0;
-
-    .bwi {
-      left: 10px;
-    }
-  }
-
-  .search + .right {
-    margin-left: -10px;
-  }
-}
-
-.content {
-  padding: 15px 5px;
-}
-
-app-root {
-  width: 100%;
-  height: 100vh;
-  display: flex;
-
-  @include themify($themes) {
-    background-color: themed("backgroundColor");
-  }
-}
-
-main:not(popup-page main):not(auth-anon-layout main) {
-  position: absolute;
-  top: 44px;
-  bottom: 0;
-  left: 0;
-  right: 0;
-  overflow-y: auto;
-  overflow-x: hidden;
-
-  @include themify($themes) {
-    background-color: themed("backgroundColor");
-  }
-
-  &.no-header {
-    top: 0;
-  }
-
-  &.flex {
-    display: flex;
-    flex-flow: column;
-    height: calc(100% - 44px);
-  }
-}
-
-.center-content,
-.no-items,
-.full-loading-spinner {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  height: 100%;
-  flex-direction: column;
-  flex-grow: 1;
-}
-
-.no-items,
-.full-loading-spinner {
-  text-align: center;
-  position: absolute;
-  top: 50%;
-  left: 50%;
-  transform: translate(-50%, -50%);
-
-  .no-items-image {
-    @include themify($themes) {
-      content: url("../images/search-desktop" + themed("svgSuffix"));
-    }
-  }
-
-  .bwi {
-    margin-bottom: 10px;
-
-    @include themify($themes) {
-      color: themed("disabledIconColor");
-    }
-  }
-}
-
-// cdk-virtual-scroll
-.cdk-virtual-scroll-viewport {
-  width: 100%;
-  height: 100%;
-  overflow-y: auto;
-  overflow-x: hidden;
-}
-
-.cdk-virtual-scroll-content-wrapper {
-  width: 100%;
-}
diff --git a/apps/browser/src/popup/scss/box.scss b/apps/browser/src/popup/scss/box.scss
deleted file mode 100644
index 763f73a15cb..00000000000
--- a/apps/browser/src/popup/scss/box.scss
+++ /dev/null
@@ -1,620 +0,0 @@
-@import "variables.scss";
-
-.box {
-  position: relative;
-  width: 100%;
-
-  &.first {
-    margin-top: 0;
-  }
-
-  .box-header {
-    margin: 0 10px 5px 10px;
-    text-transform: uppercase;
-    display: flex;
-
-    @include themify($themes) {
-      color: themed("headingColor");
-    }
-  }
-
-  .box-content {
-    @include themify($themes) {
-      background-color: themed("backgroundColor");
-      border-color: themed("borderColor");
-    }
-
-    &.box-content-padded {
-      padding: 10px 15px;
-    }
-
-    &.condensed .box-content-row,
-    .box-content-row.condensed {
-      padding-top: 5px;
-      padding-bottom: 5px;
-    }
-
-    &.no-hover .box-content-row,
-    .box-content-row.no-hover {
-      &:hover,
-      &:focus {
-        @include themify($themes) {
-          background-color: themed("boxBackgroundColor") !important;
-        }
-      }
-    }
-
-    &.single-line .box-content-row,
-    .box-content-row.single-line {
-      padding-top: 10px;
-      padding-bottom: 10px;
-      margin: 5px;
-    }
-
-    &.row-top-padding {
-      padding-top: 10px;
-    }
-  }
-
-  .box-footer {
-    margin: 0 5px 5px 5px;
-    padding: 0 10px 5px 10px;
-    font-size: $font-size-small;
-
-    button.btn {
-      font-size: $font-size-small;
-      padding: 0;
-    }
-
-    button.btn.primary {
-      font-size: $font-size-base;
-      padding: 7px 15px;
-      width: 100%;
-
-      &:hover {
-        @include themify($themes) {
-          border-color: themed("borderHoverColor") !important;
-        }
-      }
-    }
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-  }
-
-  &.list {
-    margin: 10px 0 20px 0;
-    .box-content {
-      .virtual-scroll-item {
-        display: inline-block;
-        width: 100%;
-      }
-
-      .box-content-row {
-        text-decoration: none;
-        border-radius: $border-radius;
-        // background-color: $background-color;
-
-        @include themify($themes) {
-          color: themed("textColor");
-          background-color: themed("boxBackgroundColor");
-        }
-
-        &.padded {
-          padding-top: 10px;
-          padding-bottom: 10px;
-        }
-
-        &.no-hover {
-          &:hover {
-            @include themify($themes) {
-              background-color: themed("boxBackgroundColor") !important;
-            }
-          }
-        }
-
-        &:hover,
-        &:focus,
-        &.active {
-          @include themify($themes) {
-            background-color: themed("listItemBackgroundHoverColor");
-          }
-        }
-
-        &:focus {
-          border-left: 5px solid #000000;
-          padding-left: 5px;
-
-          @include themify($themes) {
-            border-left-color: themed("mutedColor");
-          }
-        }
-
-        .action-buttons {
-          .row-btn {
-            padding-left: 5px;
-            padding-right: 5px;
-          }
-        }
-
-        .text:not(.no-ellipsis),
-        .detail {
-          white-space: nowrap;
-          overflow: hidden;
-          text-overflow: ellipsis;
-        }
-
-        .row-main {
-          display: flex;
-          min-width: 0;
-          align-items: normal;
-
-          .row-main-content {
-            min-width: 0;
-          }
-        }
-      }
-
-      &.single-line {
-        .box-content-row {
-          display: flex;
-          padding-top: 10px;
-          padding-bottom: 10px;
-          margin: 5px;
-          border-radius: $border-radius;
-        }
-      }
-    }
-  }
-}
-
-.box-content-row {
-  display: block;
-  padding: 5px 10px;
-  position: relative;
-  z-index: 1;
-  border-radius: $border-radius;
-  margin: 3px 5px;
-
-  @include themify($themes) {
-    background-color: themed("boxBackgroundColor");
-  }
-
-  &:last-child {
-    &:before {
-      border: none;
-      height: 0;
-    }
-  }
-
-  &.override-last:last-child:before {
-    border-bottom: 1px solid #000000;
-    @include themify($themes) {
-      border-bottom-color: themed("boxBorderColor");
-    }
-  }
-
-  &.last:last-child:before {
-    border-bottom: 1px solid #000000;
-    @include themify($themes) {
-      border-bottom-color: themed("boxBorderColor");
-    }
-  }
-
-  &:after {
-    content: "";
-    display: table;
-    clear: both;
-  }
-
-  &:hover,
-  &:focus,
-  &.active {
-    @include themify($themes) {
-      background-color: themed("boxBackgroundHoverColor");
-    }
-  }
-
-  &.pre {
-    white-space: pre;
-    overflow-x: auto;
-  }
-
-  &.pre-wrap {
-    white-space: pre-wrap;
-    overflow-x: auto;
-  }
-
-  .row-label,
-  label {
-    font-size: $font-size-small;
-    display: block;
-    width: 100%;
-    margin-bottom: 5px;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-
-    .sub-label {
-      margin-left: 10px;
-    }
-  }
-
-  .flex-label {
-    font-size: $font-size-small;
-    display: flex;
-    flex-grow: 1;
-    margin-bottom: 5px;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-
-    > a {
-      flex-grow: 0;
-    }
-  }
-
-  .text,
-  .detail {
-    display: block;
-    text-align: left;
-
-    @include themify($themes) {
-      color: themed("textColor");
-    }
-  }
-
-  .detail {
-    font-size: $font-size-small;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-  }
-
-  .img-right,
-  .txt-right {
-    float: right;
-    margin-left: 10px;
-  }
-
-  .row-main {
-    flex-grow: 1;
-    min-width: 0;
-  }
-
-  &.box-content-row-flex,
-  .box-content-row-flex,
-  &.box-content-row-checkbox,
-  &.box-content-row-link,
-  &.box-content-row-input,
-  &.box-content-row-slider,
-  &.box-content-row-multi {
-    display: flex;
-    align-items: center;
-    word-break: break-all;
-
-    &.box-content-row-word-break {
-      word-break: normal;
-    }
-  }
-
-  &.box-content-row-multi {
-    input:not([type="checkbox"]) {
-      width: 100%;
-    }
-
-    input + label.sr-only + select {
-      margin-top: 5px;
-    }
-
-    > a,
-    > button {
-      padding: 8px 8px 8px 4px;
-      margin: 0;
-
-      @include themify($themes) {
-        color: themed("dangerColor");
-      }
-    }
-  }
-
-  &.box-content-row-multi,
-  &.box-content-row-newmulti {
-    padding-left: 10px;
-  }
-
-  &.box-content-row-newmulti {
-    @include themify($themes) {
-      color: themed("primaryColor");
-    }
-  }
-
-  &.box-content-row-checkbox,
-  &.box-content-row-link,
-  &.box-content-row-input,
-  &.box-content-row-slider {
-    padding-top: 10px;
-    padding-bottom: 10px;
-    margin: 5px;
-
-    label,
-    .row-label {
-      font-size: $font-size-base;
-      display: block;
-      width: initial;
-      margin-bottom: 0;
-
-      @include themify($themes) {
-        color: themed("textColor");
-      }
-    }
-
-    > span {
-      @include themify($themes) {
-        color: themed("mutedColor");
-      }
-    }
-
-    > input {
-      margin: 0 0 0 auto;
-      padding: 0;
-    }
-
-    > * {
-      margin-right: 15px;
-
-      &:last-child {
-        margin-right: 0;
-      }
-    }
-  }
-
-  &.box-content-row-checkbox-left {
-    justify-content: flex-start;
-
-    > input {
-      margin: 0 15px 0 0;
-    }
-  }
-
-  &.box-content-row-input {
-    label {
-      white-space: nowrap;
-    }
-
-    input {
-      text-align: right;
-
-      &[type="number"] {
-        max-width: 50px;
-      }
-    }
-  }
-
-  &.box-content-row-slider {
-    input[type="range"] {
-      height: 10px;
-    }
-
-    input[type="number"] {
-      width: 45px;
-    }
-
-    label {
-      white-space: nowrap;
-    }
-  }
-
-  input:not([type="checkbox"]):not([type="radio"]),
-  textarea {
-    border: none;
-    width: 100%;
-    background-color: transparent !important;
-
-    &::-webkit-input-placeholder {
-      @include themify($themes) {
-        color: themed("inputPlaceholderColor");
-      }
-    }
-
-    &:not([type="file"]):focus {
-      outline: none;
-    }
-  }
-
-  select {
-    width: 100%;
-    border: 1px solid #000000;
-    border-radius: $border-radius;
-    padding: 7px 4px;
-
-    @include themify($themes) {
-      border-color: themed("inputBorderColor");
-    }
-  }
-
-  .action-buttons {
-    display: flex;
-    margin-left: 5px;
-
-    &.action-buttons-fixed {
-      align-self: start;
-      margin-top: 2px;
-    }
-
-    .row-btn {
-      cursor: pointer;
-      padding: 10px 8px;
-      background: none;
-      border: none;
-
-      @include themify($themes) {
-        color: themed("boxRowButtonColor");
-      }
-
-      &:hover,
-      &:focus {
-        @include themify($themes) {
-          color: themed("boxRowButtonHoverColor");
-        }
-      }
-
-      &.disabled,
-      &[disabled] {
-        @include themify($themes) {
-          color: themed("disabledIconColor");
-          opacity: themed("disabledBoxOpacity");
-        }
-
-        &:hover {
-          @include themify($themes) {
-            color: themed("disabledIconColor");
-            opacity: themed("disabledBoxOpacity");
-          }
-        }
-        cursor: default !important;
-      }
-    }
-
-    &.no-pad .row-btn {
-      padding-top: 0;
-      padding-bottom: 0;
-    }
-  }
-
-  &:not(.box-draggable-row) {
-    .action-buttons .row-btn:last-child {
-      margin-right: -3px;
-    }
-  }
-
-  &.box-draggable-row {
-    &.box-content-row-checkbox {
-      input[type="checkbox"] + .drag-handle {
-        margin-left: 10px;
-      }
-    }
-  }
-
-  .drag-handle {
-    cursor: move;
-    padding: 10px 2px 10px 8px;
-    user-select: none;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-  }
-
-  &.cdk-drag-preview {
-    position: relative;
-    display: flex;
-    align-items: center;
-    opacity: 0.8;
-
-    @include themify($themes) {
-      background-color: themed("boxBackgroundColor");
-    }
-  }
-
-  select.field-type {
-    margin: 5px 0 0 25px;
-    width: calc(100% - 25px);
-  }
-
-  .icon {
-    display: flex;
-    justify-content: center;
-    align-items: center;
-    min-width: 34px;
-    margin-left: -5px;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-
-    &.icon-small {
-      min-width: 25px;
-    }
-
-    img {
-      border-radius: $border-radius;
-      max-height: 20px;
-      max-width: 20px;
-    }
-  }
-
-  .progress {
-    display: flex;
-    height: 5px;
-    overflow: hidden;
-    margin: 5px -15px -10px;
-
-    .progress-bar {
-      display: flex;
-      flex-direction: column;
-      justify-content: center;
-      white-space: nowrap;
-      background-color: $brand-primary;
-    }
-  }
-
-  .radio-group {
-    display: flex;
-    justify-content: flex-start;
-    align-items: center;
-    margin-bottom: 5px;
-
-    input {
-      flex-grow: 0;
-    }
-
-    label {
-      margin: 0 0 0 5px;
-      flex-grow: 1;
-      font-size: $font-size-base;
-      display: block;
-      width: 100%;
-
-      @include themify($themes) {
-        color: themed("textColor");
-      }
-    }
-
-    &.align-start {
-      align-items: start;
-      margin-top: 10px;
-
-      label {
-        margin-top: -4px;
-      }
-    }
-  }
-}
-
-.truncate {
-  display: inline-block;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-form {
-  .box {
-    .box-content {
-      .box-content-row {
-        &.no-hover {
-          &:hover {
-            @include themify($themes) {
-              background-color: themed("transparentColor") !important;
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/apps/browser/src/popup/scss/buttons.scss b/apps/browser/src/popup/scss/buttons.scss
deleted file mode 100644
index e9af536dc3d..00000000000
--- a/apps/browser/src/popup/scss/buttons.scss
+++ /dev/null
@@ -1,118 +0,0 @@
-@import "variables.scss";
-
-.btn {
-  border-radius: $border-radius;
-  padding: 7px 15px;
-  border: 1px solid #000000;
-  font-size: $font-size-base;
-  text-align: center;
-  cursor: pointer;
-
-  @include themify($themes) {
-    background-color: themed("buttonBackgroundColor");
-    border-color: themed("buttonBorderColor");
-    color: themed("buttonColor");
-  }
-
-  &.primary {
-    @include themify($themes) {
-      color: themed("buttonPrimaryColor");
-    }
-  }
-
-  &.danger {
-    @include themify($themes) {
-      color: themed("buttonDangerColor");
-    }
-  }
-
-  &.callout-half {
-    font-weight: bold;
-    max-width: 50%;
-  }
-
-  &:hover:not([disabled]) {
-    cursor: pointer;
-
-    @include themify($themes) {
-      background-color: darken(themed("buttonBackgroundColor"), 1.5%);
-      border-color: darken(themed("buttonBorderColor"), 17%);
-      color: darken(themed("buttonColor"), 10%);
-    }
-
-    &.primary {
-      @include themify($themes) {
-        color: darken(themed("buttonPrimaryColor"), 6%);
-      }
-    }
-
-    &.danger {
-      @include themify($themes) {
-        color: darken(themed("buttonDangerColor"), 6%);
-      }
-    }
-  }
-
-  &:focus:not([disabled]) {
-    cursor: pointer;
-    outline: 0;
-
-    @include themify($themes) {
-      background-color: darken(themed("buttonBackgroundColor"), 6%);
-      border-color: darken(themed("buttonBorderColor"), 25%);
-    }
-  }
-
-  &[disabled] {
-    opacity: 0.65;
-    cursor: default !important;
-  }
-
-  &.block {
-    display: block;
-    width: calc(100% - 10px);
-    margin: 0 auto;
-  }
-
-  &.link,
-  &.neutral {
-    border: none !important;
-    background: none !important;
-
-    &:focus {
-      text-decoration: underline;
-    }
-  }
-}
-
-.action-buttons {
-  .btn {
-    &:focus {
-      outline: auto;
-    }
-  }
-}
-
-button.box-content-row {
-  display: block;
-  width: calc(100% - 10px);
-  text-align: left;
-  border-color: none;
-
-  @include themify($themes) {
-    background-color: themed("boxBackgroundColor");
-  }
-}
-
-button {
-  border: none;
-  background: transparent;
-  color: inherit;
-}
-
-.login-buttons {
-  .btn.block {
-    width: 100%;
-    margin-bottom: 10px;
-  }
-}
diff --git a/apps/browser/src/popup/scss/environment.scss b/apps/browser/src/popup/scss/environment.scss
deleted file mode 100644
index cd8f6379e2c..00000000000
--- a/apps/browser/src/popup/scss/environment.scss
+++ /dev/null
@@ -1,43 +0,0 @@
-@import "variables.scss";
-
-html.browser_safari {
-  &.safari_height_fix {
-    body {
-      height: 360px !important;
-
-      &.body-xs {
-        height: 300px !important;
-      }
-
-      &.body-full {
-        height: 100% !important;
-      }
-    }
-  }
-
-  header {
-    .search .bwi {
-      left: 20px;
-    }
-
-    .left + .search .bwi {
-      left: 10px;
-    }
-  }
-
-  .content {
-    &.login-page {
-      padding-top: 100px;
-    }
-  }
-
-  app-root {
-    border-width: 1px;
-    border-style: solid;
-    border-color: #000000;
-  }
-
-  &.theme_light app-root {
-    border-color: #777777;
-  }
-}
diff --git a/apps/browser/src/popup/scss/grid.scss b/apps/browser/src/popup/scss/grid.scss
deleted file mode 100644
index 8cdb29bb52c..00000000000
--- a/apps/browser/src/popup/scss/grid.scss
+++ /dev/null
@@ -1,11 +0,0 @@
-.row {
-  display: flex;
-  margin: 0 -15px;
-  width: 100%;
-}
-
-.col {
-  flex-basis: 0;
-  flex-grow: 1;
-  padding: 0 15px;
-}
diff --git a/apps/browser/src/popup/scss/misc.scss b/apps/browser/src/popup/scss/misc.scss
deleted file mode 100644
index 006e1d35f6a..00000000000
--- a/apps/browser/src/popup/scss/misc.scss
+++ /dev/null
@@ -1,348 +0,0 @@
-@import "variables.scss";
-
-small,
-.small {
-  font-size: $font-size-small;
-}
-
-.bg-primary {
-  @include themify($themes) {
-    background-color: themed("primaryColor") !important;
-  }
-}
-
-.bg-success {
-  @include themify($themes) {
-    background-color: themed("successColor") !important;
-  }
-}
-
-.bg-danger {
-  @include themify($themes) {
-    background-color: themed("dangerColor") !important;
-  }
-}
-
-.bg-info {
-  @include themify($themes) {
-    background-color: themed("infoColor") !important;
-  }
-}
-
-.bg-warning {
-  @include themify($themes) {
-    background-color: themed("warningColor") !important;
-  }
-}
-
-.text-primary {
-  @include themify($themes) {
-    color: themed("primaryColor") !important;
-  }
-}
-
-.text-success {
-  @include themify($themes) {
-    color: themed("successColor") !important;
-  }
-}
-
-.text-muted {
-  @include themify($themes) {
-    color: themed("mutedColor") !important;
-  }
-}
-
-.text-default {
-  @include themify($themes) {
-    color: themed("textColor") !important;
-  }
-}
-
-.text-danger {
-  @include themify($themes) {
-    color: themed("dangerColor") !important;
-  }
-}
-
-.text-info {
-  @include themify($themes) {
-    color: themed("infoColor") !important;
-  }
-}
-
-.text-warning {
-  @include themify($themes) {
-    color: themed("warningColor") !important;
-  }
-}
-
-.text-center {
-  text-align: center;
-}
-
-.font-weight-semibold {
-  font-weight: 600;
-}
-
-p.lead {
-  font-size: $font-size-large;
-  margin-bottom: 20px;
-  font-weight: normal;
-}
-
-.flex-right {
-  margin-left: auto;
-}
-
-.flex-bottom {
-  margin-top: auto;
-}
-
-.no-margin {
-  margin: 0 !important;
-}
-
-.display-block {
-  display: block !important;
-}
-
-.monospaced {
-  font-family: $font-family-monospace;
-}
-
-.show-whitespace {
-  white-space: pre-wrap;
-}
-
-.img-responsive {
-  display: block;
-  max-width: 100%;
-  height: auto;
-}
-
-.img-rounded {
-  border-radius: $border-radius;
-}
-
-.select-index-top {
-  position: relative;
-  z-index: 100;
-}
-
-.sr-only {
-  position: absolute !important;
-  width: 1px !important;
-  height: 1px !important;
-  padding: 0 !important;
-  margin: -1px !important;
-  overflow: hidden !important;
-  clip: rect(0, 0, 0, 0) !important;
-  border: 0 !important;
-}
-
-:not(:focus) > .exists-only-on-parent-focus {
-  display: none;
-}
-
-.password-wrapper {
-  overflow-wrap: break-word;
-  white-space: pre-wrap;
-  min-width: 0;
-}
-
-.password-number {
-  @include themify($themes) {
-    color: themed("passwordNumberColor");
-  }
-}
-
-.password-special {
-  @include themify($themes) {
-    color: themed("passwordSpecialColor");
-  }
-}
-
-.password-character {
-  display: inline-flex;
-  flex-direction: column;
-  align-items: center;
-  width: 30px;
-  height: 36px;
-  font-weight: 600;
-
-  &:nth-child(odd) {
-    @include themify($themes) {
-      background-color: themed("backgroundColor");
-    }
-  }
-}
-
-.password-count {
-  white-space: nowrap;
-  font-size: 8px;
-
-  @include themify($themes) {
-    color: themed("passwordCountText") !important;
-  }
-}
-
-#duo-frame {
-  background: url("../images/loading.svg") 0 0 no-repeat;
-  width: 100%;
-  height: 470px;
-  margin-bottom: -10px;
-
-  iframe {
-    width: 100%;
-    height: 100%;
-    border: none;
-  }
-}
-
-#web-authn-frame {
-  width: 100%;
-  height: 40px;
-
-  iframe {
-    border: none;
-    height: 100%;
-    width: 100%;
-  }
-}
-
-body.linux-webauthn {
-  width: 485px !important;
-  #web-authn-frame {
-    iframe {
-      width: 375px;
-      margin: 0 55px;
-    }
-  }
-}
-
-app-root > #loading {
-  display: flex;
-  text-align: center;
-  justify-content: center;
-  align-items: center;
-  height: 100%;
-  width: 100%;
-  color: $text-muted;
-
-  @include themify($themes) {
-    color: themed("mutedColor");
-  }
-}
-
-app-vault-icon,
-.app-vault-icon {
-  display: flex;
-}
-
-.logo-image {
-  margin: 0 auto;
-  width: 142px;
-  height: 21px;
-  background-size: 142px 21px;
-  background-repeat: no-repeat;
-  @include themify($themes) {
-    background-image: url("../images/logo-" + themed("logoSuffix") + "@2x.png");
-  }
-  @media (min-width: 219px) {
-    width: 189px;
-    height: 28px;
-    background-size: 189px 28px;
-  }
-  @media (min-width: 314px) {
-    width: 284px;
-    height: 43px;
-    background-size: 284px 43px;
-  }
-}
-
-[hidden] {
-  display: none !important;
-}
-
-.draggable {
-  cursor: move;
-}
-
-input[type="password"]::-ms-reveal {
-  display: none;
-}
-
-.flex {
-  display: flex;
-
-  &.flex-grow {
-    > * {
-      flex: 1;
-    }
-  }
-}
-
-// Text selection styles
-// Set explicit selection styles (assumes primary accent color has sufficient
-// contrast against the background, so its inversion is also still readable)
-// and suppress user selection for most elements (to make it more app-like)
-
-:not(bit-form-field input)::selection {
-  @include themify($themes) {
-    color: themed("backgroundColor");
-    background-color: themed("primaryAccentColor");
-  }
-}
-
-h1,
-h2,
-h3,
-label,
-a,
-button,
-p,
-img,
-.box-header,
-.box-footer,
-.callout,
-.row-label,
-.modal-title,
-.overlay-container {
-  user-select: none;
-
-  &.user-select {
-    user-select: auto;
-  }
-}
-
-/* tweak for inconsistent line heights in cipher view */
-.box-footer button,
-.box-footer a {
-  line-height: 1;
-}
-
-// Workaround for slow performance on external monitors on Chrome + MacOS
-// See: https://bugs.chromium.org/p/chromium/issues/detail?id=971701#c64
-@keyframes redraw {
-  0% {
-    opacity: 0.99;
-  }
-  100% {
-    opacity: 1;
-  }
-}
-html.force_redraw {
-  animation: redraw 1s linear infinite;
-}
-
-/* override for vault icon in browser (pre extension refresh) */
-app-vault-icon:not(app-vault-list-items-container app-vault-icon) > div {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  float: left;
-  height: 36px;
-  width: 34px;
-  margin-left: -5px;
-}
diff --git a/apps/browser/src/popup/scss/pages.scss b/apps/browser/src/popup/scss/pages.scss
deleted file mode 100644
index 56c5f80c86c..00000000000
--- a/apps/browser/src/popup/scss/pages.scss
+++ /dev/null
@@ -1,144 +0,0 @@
-@import "variables.scss";
-
-app-home {
-  position: fixed;
-  height: 100%;
-  width: 100%;
-
-  .center-content {
-    margin-top: -50px;
-    height: calc(100% + 50px);
-  }
-
-  img {
-    width: 284px;
-    margin: 0 auto;
-  }
-
-  p.lead {
-    margin: 30px 0;
-  }
-
-  .btn + .btn {
-    margin-top: 10px;
-  }
-
-  button.settings-icon {
-    position: absolute;
-    top: 10px;
-    left: 10px;
-
-    @include themify($themes) {
-      color: themed("mutedColor");
-    }
-
-    &:not(:hover):not(:focus) {
-      span {
-        clip: rect(0 0 0 0);
-        clip-path: inset(50%);
-        height: 1px;
-        overflow: hidden;
-        position: absolute;
-        white-space: nowrap;
-        width: 1px;
-      }
-    }
-
-    &:hover,
-    &:focus {
-      text-decoration: none;
-
-      @include themify($themes) {
-        color: themed("primaryColor");
-      }
-    }
-  }
-}
-
-body.body-sm,
-body.body-xs {
-  app-home {
-    .center-content {
-      margin-top: 0;
-      height: 100%;
-    }
-
-    p.lead {
-      margin: 15px 0;
-    }
-  }
-}
-
-body.body-full {
-  app-home {
-    .center-content {
-      margin-top: -80px;
-      height: calc(100% + 80px);
-    }
-  }
-}
-
-.createAccountLink {
-  padding: 30px 10px 0 10px;
-}
-
-.remember-email-check {
-  padding-top: 18px;
-  padding-left: 10px;
-  padding-bottom: 18px;
-}
-
-.login-buttons > button {
-  margin: 15px 0 15px 0;
-}
-
-.useBrowserlink {
-  margin-left: 5px;
-  margin-top: 20px;
-
-  span {
-    font-weight: 700;
-    font-size: $font-size-small;
-  }
-}
-
-.fido2-browser-selector-dropdown {
-  @include themify($themes) {
-    background-color: themed("boxBackgroundColor");
-  }
-  padding: 8px;
-  width: 100%;
-  box-shadow:
-    0 2px 2px 0 rgba(0, 0, 0, 0.14),
-    0 3px 1px -2px rgba(0, 0, 0, 0.12),
-    0 1px 5px 0 rgba(0, 0, 0, 0.2);
-  border-radius: $border-radius;
-}
-
-.fido2-browser-selector-dropdown-item {
-  @include themify($themes) {
-    color: themed("textColor") !important;
-  }
-  width: 100%;
-  text-align: left;
-  padding: 0px 15px 0px 5px;
-  margin-bottom: 5px;
-  border-radius: 3px;
-  border: 1px solid transparent;
-  transition: all 0.2s ease-in-out;
-
-  &:hover {
-    @include themify($themes) {
-      background-color: themed("listItemBackgroundHoverColor") !important;
-    }
-  }
-
-  &:last-child {
-    margin-bottom: 0;
-  }
-}
-
-/** Temporary fix for avatar, will not be required once we migrate to tailwind preflight **/
-bit-avatar svg {
-  display: block;
-}
diff --git a/apps/browser/src/popup/scss/plugins.scss b/apps/browser/src/popup/scss/plugins.scss
deleted file mode 100644
index 591e8a1bd0c..00000000000
--- a/apps/browser/src/popup/scss/plugins.scss
+++ /dev/null
@@ -1,23 +0,0 @@
-@import "variables.scss";
-
-@each $mfaType in $mfaTypes {
-  .mfaType#{$mfaType} {
-    content: url("../images/two-factor/" + $mfaType + ".png");
-    max-width: 100px;
-  }
-}
-
-.mfaType1 {
-  @include themify($themes) {
-    content: url("../images/two-factor/1" + themed("mfaLogoSuffix"));
-    max-width: 100px;
-    max-height: 45px;
-  }
-}
-
-.mfaType7 {
-  @include themify($themes) {
-    content: url("../images/two-factor/7" + themed("mfaLogoSuffix"));
-    max-width: 100px;
-  }
-}
diff --git a/apps/browser/src/popup/scss/popup.scss b/apps/browser/src/popup/scss/popup.scss
index b150de2c75d..59b4d472f23 100644
--- a/apps/browser/src/popup/scss/popup.scss
+++ b/apps/browser/src/popup/scss/popup.scss
@@ -1,13 +1,50 @@
 @import "../../../../../libs/angular/src/scss/bwicons/styles/style.scss";
 @import "variables.scss";
 @import "../../../../../libs/angular/src/scss/icons.scss";
-@import "base.scss";
-@import "grid.scss";
-@import "box.scss";
-@import "buttons.scss";
-@import "misc.scss";
-@import "environment.scss";
-@import "pages.scss";
-@import "plugins.scss";
 @import "@angular/cdk/overlay-prebuilt.css";
 @import "../../../../../libs/components/src/multi-select/scss/bw.theme";
+
+.cdk-virtual-scroll-content-wrapper {
+  width: 100%;
+}
+
+// MFA Types for logo styling with no dark theme alternative
+$mfaTypes: 0, 2, 3, 4, 6;
+
+@each $mfaType in $mfaTypes {
+  .mfaType#{$mfaType} {
+    content: url("../images/two-factor/" + $mfaType + ".png");
+    max-width: 100px;
+  }
+}
+
+.mfaType0 {
+  content: url("../images/two-factor/0.png");
+  max-width: 100px;
+  max-height: 45px;
+}
+
+.mfaType1 {
+  max-width: 100px;
+  max-height: 45px;
+
+  &:is(.theme_light *) {
+    content: url("../images/two-factor/1.png");
+  }
+
+  &:is(.theme_dark *) {
+    content: url("../images/two-factor/1-w.png");
+  }
+}
+
+.mfaType7 {
+  max-width: 100px;
+
+  &:is(.theme_light *) {
+    content: url("../images/two-factor/7.png");
+  }
+
+  &:is(.theme_dark *) {
+    content: url("../images/two-factor/7-w.png");
+  }
+}
diff --git a/apps/browser/src/popup/scss/tailwind.css b/apps/browser/src/popup/scss/tailwind.css
index 54139990356..f58950cc86a 100644
--- a/apps/browser/src/popup/scss/tailwind.css
+++ b/apps/browser/src/popup/scss/tailwind.css
@@ -1,4 +1,104 @@
-@import "../../../../../libs/components/src/tw-theme.css";
+@import "../../../../../libs/components/src/tw-theme-preflight.css";
+
+@layer base {
+  html {
+    overflow: hidden;
+    min-height: 600px;
+    height: 100%;
+
+    &.body-sm {
+      min-height: 500px;
+    }
+
+    &.body-xs {
+      min-height: 400px;
+    }
+
+    &.body-xxs {
+      min-height: 300px;
+    }
+
+    &.body-3xs {
+      min-height: 240px;
+    }
+
+    &.body-full {
+      min-height: unset;
+      width: 100%;
+      height: 100%;
+
+      & body {
+        width: 100%;
+      }
+    }
+  }
+
+  html.browser_safari {
+    &.safari_height_fix {
+      body {
+        height: 360px !important;
+
+        &.body-xs {
+          height: 300px !important;
+        }
+
+        &.body-full {
+          height: 100% !important;
+        }
+      }
+    }
+
+    app-root {
+      border-width: 1px;
+      border-style: solid;
+      border-color: #000000;
+    }
+
+    &.theme_light app-root {
+      border-color: #777777;
+    }
+  }
+
+  body {
+    width: 380px;
+    height: 100%;
+    position: relative;
+    min-height: inherit;
+    overflow: hidden;
+    @apply tw-bg-background-alt;
+  }
+
+  /**
+   * Workaround for slow performance on external monitors on Chrome + MacOS
+   * See: https://bugs.chromium.org/p/chromium/issues/detail?id=971701#c64
+   */
+  @keyframes redraw {
+    0% {
+      opacity: 0.99;
+    }
+    100% {
+      opacity: 1;
+    }
+  }
+  html.force_redraw {
+    animation: redraw 1s linear infinite;
+  }
+
+  /** 
+   * Text selection style:
+   * suppress user selection for most elements (to make it more app-like) 
+   */
+  h1,
+  h2,
+  h3,
+  label,
+  a,
+  button,
+  p,
+  img {
+    user-select: none;
+  }
+}
 
 @layer components {
   /** Safari Support */
@@ -19,4 +119,59 @@
   html:not(.browser_safari) .tw-styled-scrollbar {
     scrollbar-color: rgb(var(--color-secondary-500)) rgb(var(--color-background-alt));
   }
+
+  #duo-frame {
+    background: url("../images/loading.svg") 0 0 no-repeat;
+    width: 100%;
+    height: 470px;
+    margin-bottom: -10px;
+
+    iframe {
+      width: 100%;
+      height: 100%;
+      border: none;
+    }
+  }
+
+  #web-authn-frame {
+    width: 100%;
+    height: 40px;
+
+    iframe {
+      border: none;
+      height: 100%;
+      width: 100%;
+    }
+  }
+
+  body.linux-webauthn {
+    width: 485px !important;
+    #web-authn-frame {
+      iframe {
+        width: 375px;
+        margin: 0 55px;
+      }
+    }
+  }
+
+  app-root > #loading {
+    display: flex;
+    text-align: center;
+    justify-content: center;
+    align-items: center;
+    height: 100%;
+    width: 100%;
+
+    @apply tw-text-muted;
+  }
+
+  /** 
+   * Text selection style:
+   * Set explicit selection styles (assumes primary accent color has sufficient
+   * contrast against the background, so its inversion is also still readable)
+   */
+  :not(bit-form-field input)::selection {
+    @apply tw-text-contrast;
+    @apply tw-bg-primary-700;
+  }
 }
diff --git a/apps/browser/src/popup/scss/variables.scss b/apps/browser/src/popup/scss/variables.scss
index e57e98fd0cc..02a10521bca 100644
--- a/apps/browser/src/popup/scss/variables.scss
+++ b/apps/browser/src/popup/scss/variables.scss
@@ -1,178 +1,42 @@
-$dark-icon-themes: "theme_dark";
+/**
+ * DEPRECATED: DO NOT MODIFY OR USE!
+ */
+
+$dark-icon-themes: "theme_dark";
 
 $font-family-sans-serif: Inter, "Helvetica Neue", Helvetica, Arial, sans-serif;
 $font-family-monospace: Menlo, Monaco, Consolas, "Courier New", monospace;
-$font-size-base: 16px;
-$font-size-large: 18px;
-$font-size-xlarge: 22px;
-$font-size-xxlarge: 28px;
-$font-size-small: 12px;
 $text-color: #000000;
-$border-color: #f0f0f0;
 $border-color-dark: #ddd;
-$list-item-hover: #fbfbfb;
-$list-icon-color: #767679;
-$disabled-box-opacity: 1;
-$border-radius: 6px;
-$line-height-base: 1.42857143;
-$icon-hover-color: lighten($text-color, 50%);
-
-$mfaTypes: 0, 2, 3, 4, 6;
-
-$gray: #555;
-$gray-light: #777;
-$text-muted: $gray-light;
-
 $brand-primary: #175ddc;
-$brand-danger: #c83522;
 $brand-success: #017e45;
-$brand-info: #555555;
-$brand-warning: #8b6609;
-$brand-primary-accent: #1252a3;
-
 $background-color: #f0f0f0;
-
-$box-background-color: white;
-$box-background-hover-color: $list-item-hover;
-$box-border-color: $border-color;
-$border-color-alt: #c3c5c7;
-
-$button-border-color: darken($border-color-dark, 12%);
-$button-background-color: white;
-$button-color: lighten($text-color, 40%);
 $button-color-primary: darken($brand-primary, 8%);
-$button-color-danger: darken($brand-danger, 10%);
-
-$code-color: #c01176;
-$code-color-dark: #f08dc7;
 
 $themes: (
   light: (
     textColor: $text-color,
-    hoverColorTransparent: rgba($text-color, 0.15),
     borderColor: $border-color-dark,
     backgroundColor: $background-color,
-    borderColorAlt: $border-color-alt,
-    backgroundColorAlt: #ffffff,
-    scrollbarColor: rgba(100, 100, 100, 0.2),
-    scrollbarHoverColor: rgba(100, 100, 100, 0.4),
-    boxBackgroundColor: $box-background-color,
-    boxBackgroundHoverColor: $box-background-hover-color,
-    boxBorderColor: $box-border-color,
-    tabBackgroundColor: #ffffff,
-    tabBackgroundHoverColor: $list-item-hover,
-    headerColor: #ffffff,
-    headerBackgroundColor: $brand-primary,
-    headerBackgroundHoverColor: rgba(255, 255, 255, 0.1),
-    headerBorderColor: $brand-primary,
-    headerInputBackgroundColor: darken($brand-primary, 8%),
-    headerInputBackgroundFocusColor: darken($brand-primary, 10%),
-    headerInputColor: #ffffff,
-    headerInputPlaceholderColor: lighten($brand-primary, 35%),
-    listItemBackgroundHoverColor: $list-item-hover,
-    disabledIconColor: $list-icon-color,
-    disabledBoxOpacity: $disabled-box-opacity,
-    headingColor: $gray-light,
-    labelColor: $gray-light,
-    mutedColor: $text-muted,
-    totpStrokeColor: $brand-primary,
-    boxRowButtonColor: $brand-primary,
-    boxRowButtonHoverColor: darken($brand-primary, 10%),
     inputBorderColor: darken($border-color-dark, 7%),
     inputBackgroundColor: #ffffff,
-    inputPlaceholderColor: lighten($gray-light, 35%),
-    buttonBackgroundColor: $button-background-color,
-    buttonBorderColor: $button-border-color,
-    buttonColor: $button-color,
     buttonPrimaryColor: $button-color-primary,
-    buttonDangerColor: $button-color-danger,
     primaryColor: $brand-primary,
-    primaryAccentColor: $brand-primary-accent,
-    dangerColor: $brand-danger,
     successColor: $brand-success,
-    infoColor: $brand-info,
-    warningColor: $brand-warning,
-    logoSuffix: "dark",
-    mfaLogoSuffix: ".png",
     passwordNumberColor: #007fde,
     passwordSpecialColor: #c40800,
-    passwordCountText: #212529,
-    calloutBorderColor: $border-color-dark,
-    calloutBackgroundColor: $box-background-color,
-    toastTextColor: #ffffff,
-    svgSuffix: "-light.svg",
-    transparentColor: rgba(0, 0, 0, 0),
-    dateInputColorScheme: light,
-    // https://stackoverflow.com/a/53336754
-    webkitCalendarPickerFilter: invert(46%) sepia(69%) saturate(6397%) hue-rotate(211deg)
-      brightness(85%) contrast(103%),
-    // light has no hover so use same color
-    webkitCalendarPickerHoverFilter: invert(46%) sepia(69%) saturate(6397%) hue-rotate(211deg)
-      brightness(85%) contrast(103%),
-    codeColor: $code-color,
   ),
   dark: (
     textColor: #ffffff,
-    hoverColorTransparent: rgba($text-color, 0.15),
     borderColor: #161c26,
     backgroundColor: #161c26,
-    borderColorAlt: #6e788a,
-    backgroundColorAlt: #2f343d,
-    scrollbarColor: #6e788a,
-    scrollbarHoverColor: #8d94a5,
-    boxBackgroundColor: #2f343d,
-    boxBackgroundHoverColor: #3c424e,
-    boxBorderColor: #4c525f,
-    tabBackgroundColor: #2f343d,
-    tabBackgroundHoverColor: #3c424e,
-    headerColor: #ffffff,
-    headerBackgroundColor: #2f343d,
-    headerBackgroundHoverColor: #3c424e,
-    headerBorderColor: #161c26,
-    headerInputBackgroundColor: #3c424e,
-    headerInputBackgroundFocusColor: #4c525f,
-    headerInputColor: #ffffff,
-    headerInputPlaceholderColor: #bac0ce,
-    listItemBackgroundHoverColor: #3c424e,
-    disabledIconColor: #bac0ce,
-    disabledBoxOpacity: 0.5,
-    headingColor: #bac0ce,
-    labelColor: #bac0ce,
-    mutedColor: #bac0ce,
-    totpStrokeColor: #4c525f,
-    boxRowButtonColor: #bac0ce,
-    boxRowButtonHoverColor: #ffffff,
     inputBorderColor: #4c525f,
     inputBackgroundColor: #2f343d,
-    inputPlaceholderColor: #bac0ce,
-    buttonBackgroundColor: #3c424e,
-    buttonBorderColor: #4c525f,
-    buttonColor: #bac0ce,
     buttonPrimaryColor: #6f9df1,
-    buttonDangerColor: #ff8d85,
     primaryColor: #6f9df1,
-    primaryAccentColor: #6f9df1,
-    dangerColor: #ff8d85,
     successColor: #52e07c,
-    infoColor: #a4b0c6,
-    warningColor: #ffeb66,
-    logoSuffix: "white",
-    mfaLogoSuffix: "-w.png",
     passwordNumberColor: #6f9df1,
     passwordSpecialColor: #ff8d85,
-    passwordCountText: #ffffff,
-    calloutBorderColor: #4c525f,
-    calloutBackgroundColor: #3c424e,
-    toastTextColor: #1f242e,
-    svgSuffix: "-dark.svg",
-    transparentColor: rgba(0, 0, 0, 0),
-    dateInputColorScheme: dark,
-    // https://stackoverflow.com/a/53336754 - must prepend brightness(0) saturate(100%) to dark themed date inputs
-    webkitCalendarPickerFilter: brightness(0) saturate(100%) invert(86%) sepia(19%) saturate(152%)
-      hue-rotate(184deg) brightness(87%) contrast(93%),
-    webkitCalendarPickerHoverFilter: brightness(0) saturate(100%) invert(100%) sepia(0%)
-      saturate(0%) hue-rotate(93deg) brightness(103%) contrast(103%),
-    codeColor: $code-color-dark,
   ),
 );
 
diff --git a/apps/browser/src/popup/services/services.module.ts b/apps/browser/src/popup/services/services.module.ts
index c462319dc2e..bb89eff1147 100644
--- a/apps/browser/src/popup/services/services.module.ts
+++ b/apps/browser/src/popup/services/services.module.ts
@@ -76,6 +76,7 @@ import {
   InternalMasterPasswordServiceAbstraction,
   MasterPasswordServiceAbstraction,
 } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
 import {
   VaultTimeoutService,
   VaultTimeoutStringType,
@@ -135,6 +136,7 @@ import {
   DialogService,
   ToastService,
 } from "@bitwarden/components";
+import { GeneratorServicesModule } from "@bitwarden/generator-components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
 import {
   BiometricsService,
@@ -170,6 +172,7 @@ import { InlineMenuFieldQualificationService } from "../../autofill/services/inl
 import { ForegroundBrowserBiometricsService } from "../../key-management/biometrics/foreground-browser-biometrics";
 import { ExtensionLockComponentService } from "../../key-management/lock/services/extension-lock-component.service";
 import { BrowserSessionTimeoutSettingsComponentService } from "../../key-management/session-timeout/services/browser-session-timeout-settings-component.service";
+import { BrowserSessionTimeoutTypeService } from "../../key-management/session-timeout/services/browser-session-timeout-type.service";
 import { ForegroundVaultTimeoutService } from "../../key-management/vault-timeout/foreground-vault-timeout.service";
 import { BrowserActionsService } from "../../platform/actions/browser-actions.service";
 import { BrowserApi } from "../../platform/browser/browser-api";
@@ -723,15 +726,25 @@ const safeProviders: SafeProvider[] = [
     useClass: ExtensionNewDeviceVerificationComponentService,
     deps: [],
   }),
+  safeProvider({
+    provide: SessionTimeoutTypeService,
+    useClass: BrowserSessionTimeoutTypeService,
+    deps: [PlatformUtilsService],
+  }),
   safeProvider({
     provide: SessionTimeoutSettingsComponentService,
     useClass: BrowserSessionTimeoutSettingsComponentService,
-    deps: [I18nServiceAbstraction, PlatformUtilsService, MessagingServiceAbstraction],
+    deps: [
+      I18nServiceAbstraction,
+      SessionTimeoutTypeService,
+      PolicyService,
+      MessagingServiceAbstraction,
+    ],
   }),
 ];
 
 @NgModule({
-  imports: [JslibServicesModule],
+  imports: [JslibServicesModule, GeneratorServicesModule],
   declarations: [],
   // Do not register your dependency here! Add it to the typesafeProviders array using the helper function
   providers: safeProviders,
diff --git a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.spec.ts b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.spec.ts
index 1bffcd9ad51..f2c9d470816 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.spec.ts
@@ -381,4 +381,88 @@ describe("AddEditV2Component", () => {
       expect(navigate).toHaveBeenCalledWith(["/tabs/vault"]);
     });
   });
+
+  describe("reloadAddEditCipherData", () => {
+    beforeEach(fakeAsync(() => {
+      addEditCipherInfo$.next({
+        cipher: {
+          name: "InitialName",
+          type: CipherType.Login,
+          login: {
+            password: "initialPassword",
+            username: "initialUsername",
+            uris: [{ uri: "https://initial.com" }],
+          },
+        },
+      } as AddEditCipherInfo);
+      queryParams$.next({});
+      tick();
+
+      cipherServiceMock.setAddEditCipherInfo.mockClear();
+    }));
+
+    it("replaces all initialValues with new data, clearing stale fields", fakeAsync(() => {
+      const newCipherInfo = {
+        cipher: {
+          name: "UpdatedName",
+          type: CipherType.Login,
+          login: {
+            password: "updatedPassword",
+            uris: [{ uri: "https://updated.com" }],
+          },
+        },
+      } as AddEditCipherInfo;
+
+      addEditCipherInfo$.next(newCipherInfo);
+
+      const messageListener = component["messageListener"];
+      messageListener({ command: "reloadAddEditCipherData" });
+      tick();
+
+      expect(component.config.initialValues).toEqual({
+        name: "UpdatedName",
+        password: "updatedPassword",
+        loginUri: "https://updated.com",
+      } as OptionalInitialValues);
+
+      expect(cipherServiceMock.setAddEditCipherInfo).toHaveBeenCalledWith(null, "UserId");
+    }));
+
+    it("does not reload data if config is not set", fakeAsync(() => {
+      component.config = null;
+
+      const messageListener = component["messageListener"];
+      messageListener({ command: "reloadAddEditCipherData" });
+      tick();
+
+      expect(cipherServiceMock.setAddEditCipherInfo).not.toHaveBeenCalled();
+    }));
+
+    it("does not reload data if latestCipherInfo is null", fakeAsync(() => {
+      addEditCipherInfo$.next(null);
+
+      const messageListener = component["messageListener"];
+      messageListener({ command: "reloadAddEditCipherData" });
+      tick();
+
+      expect(component.config.initialValues).toEqual({
+        name: "InitialName",
+        password: "initialPassword",
+        username: "initialUsername",
+        loginUri: "https://initial.com",
+      } as OptionalInitialValues);
+
+      expect(cipherServiceMock.setAddEditCipherInfo).not.toHaveBeenCalled();
+    }));
+
+    it("ignores messages with different commands", fakeAsync(() => {
+      const initialValues = component.config.initialValues;
+
+      const messageListener = component["messageListener"];
+      messageListener({ command: "someOtherCommand" });
+      tick();
+
+      expect(component.config.initialValues).toBe(initialValues);
+    }));
+  });
 });
diff --git a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
index 60e44cefbdf..22aad854dd0 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
@@ -1,7 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import { CommonModule } from "@angular/common";
-import { Component, OnInit } from "@angular/core";
+import { Component, OnInit, OnDestroy } from "@angular/core";
 import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
 import { FormsModule } from "@angular/forms";
 import { ActivatedRoute, Params, Router } from "@angular/router";
@@ -158,7 +158,7 @@ export type AddEditQueryParams = Partial<Record<keyof QueryParams, string>>;
     IconButtonModule,
   ],
 })
-export class AddEditV2Component implements OnInit {
+export class AddEditV2Component implements OnInit, OnDestroy {
   headerText: string;
   config: CipherFormConfig;
   canDeleteCipher$: Observable<boolean>;
@@ -200,12 +200,58 @@ export class AddEditV2Component implements OnInit {
     this.subscribeToParams();
   }
 
+  private messageListener: (message: any) => void;
+
   async ngOnInit() {
     this.fido2PopoutSessionData = await firstValueFrom(this.fido2PopoutSessionData$);
 
     if (BrowserPopupUtils.inPopout(window)) {
       this.popupCloseWarningService.enable();
     }
+
+    // Listen for messages to reload cipher data when the pop up is already open
+    this.messageListener = async (message: any) => {
+      if (message?.command === "reloadAddEditCipherData") {
+        try {
+          await this.reloadCipherData();
+        } catch (error) {
+          this.logService.error("Failed to reload cipher data", error);
+        }
+      }
+    };
+    BrowserApi.addListener(chrome.runtime.onMessage, this.messageListener);
+  }
+
+  ngOnDestroy() {
+    if (this.messageListener) {
+      BrowserApi.removeListener(chrome.runtime.onMessage, this.messageListener);
+    }
+  }
+
+  /**
+   * Reloads the cipher data when the popup is already open and new form data is submitted.
+   * This completely replaces the initialValues to clear any stale data from the previous submission.
+   */
+  private async reloadCipherData() {
+    if (!this.config) {
+      return;
+    }
+
+    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+
+    const latestCipherInfo = await firstValueFrom(
+      this.cipherService.addEditCipherInfo$(activeUserId),
+    );
+
+    if (latestCipherInfo != null) {
+      this.config = {
+        ...this.config,
+        initialValues: mapAddEditCipherInfoToInitialValues(latestCipherInfo),
+      };
+
+      // Be sure to clear the "cached" cipher info, so it doesn't get used again
+      await this.cipherService.setAddEditCipherInfo(null, activeUserId);
+    }
   }
 
   /**
diff --git a/apps/browser/src/vault/popup/components/vault-v2/attachments/attachments-v2.component.spec.ts b/apps/browser/src/vault/popup/components/vault-v2/attachments/attachments-v2.component.spec.ts
index 871163ac80b..1da2d352c14 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/attachments/attachments-v2.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/attachments/attachments-v2.component.spec.ts
@@ -1,4 +1,4 @@
-import { Component, Input } from "@angular/core";
+import { Component, input, ChangeDetectionStrategy } from "@angular/core";
 import { ComponentFixture, TestBed, fakeAsync, tick } from "@angular/core/testing";
 import { By } from "@angular/platform-browser";
 import { ActivatedRoute, Router } from "@angular/router";
@@ -25,31 +25,23 @@ import { PopupRouterCacheService } from "../../../../../platform/popup/view-cach
 
 import { AttachmentsV2Component } from "./attachments-v2.component";
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "popup-header",
   template: `<ng-content></ng-content>`,
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class MockPopupHeaderComponent {
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() pageTitle: string;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() backAction: () => void;
+  readonly pageTitle = input<string>();
+  readonly backAction = input<() => void>();
 }
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "popup-footer",
   template: `<ng-content></ng-content>`,
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class MockPopupFooterComponent {
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() pageTitle: string;
+  readonly pageTitle = input<string>();
 }
 
 describe("AttachmentsV2Component", () => {
@@ -120,7 +112,7 @@ describe("AttachmentsV2Component", () => {
     const submitBtn = fixture.debugElement.queryAll(By.directive(ButtonComponent))[1]
       .componentInstance;
 
-    expect(cipherAttachment.submitBtn).toEqual(submitBtn);
+    expect(cipherAttachment.submitBtn()).toEqual(submitBtn);
   });
 
   it("navigates the user to the edit view `onUploadSuccess`", fakeAsync(() => {
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.spec.ts b/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.spec.ts
index 577b7d96771..b9f48b7407b 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.spec.ts
@@ -108,7 +108,7 @@ describe("ItemMoreOptionsComponent", () => {
         { provide: RestrictedItemTypesService, useValue: { restricted$: of([]) } },
         {
           provide: CipherArchiveService,
-          useValue: { userCanArchive$: () => of(true), hasArchiveFlagEnabled$: () => of(true) },
+          useValue: { userCanArchive$: () => of(true), hasArchiveFlagEnabled$: of(true) },
         },
         { provide: ToastService, useValue: { showToast: () => {} } },
         { provide: Router, useValue: { navigate: () => Promise.resolve(true) } },
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts b/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts
index 4dfaf7bc66f..b65acc6ca8e 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-more-options/item-more-options.component.ts
@@ -141,7 +141,7 @@ export class ItemMoreOptionsComponent {
     }),
   );
 
-  protected showArchive$: Observable<boolean> = this.cipherArchiveService.hasArchiveFlagEnabled$();
+  protected showArchive$: Observable<boolean> = this.cipherArchiveService.hasArchiveFlagEnabled$;
 
   protected canArchive$: Observable<boolean> = this.accountService.activeAccount$.pipe(
     getUserId,
diff --git a/apps/browser/src/vault/popup/components/vault-v2/new-item-dropdown/new-item-dropdown-v2.component.html b/apps/browser/src/vault/popup/components/vault-v2/new-item-dropdown/new-item-dropdown-v2.component.html
index 7dd0a5a3bc7..fa8683c12dc 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/new-item-dropdown/new-item-dropdown-v2.component.html
+++ b/apps/browser/src/vault/popup/components/vault-v2/new-item-dropdown/new-item-dropdown-v2.component.html
@@ -1,5 +1,5 @@
-<button bitButton size="small" [bitMenuTriggerFor]="itemOptions" buttonType="primary" type="button">
-  <i class="bwi bwi-plus" aria-hidden="true"></i>
+<button bitButton [bitMenuTriggerFor]="itemOptions" buttonType="primary" type="button">
+  <i class="bwi bwi-plus tw-me-2" aria-hidden="true"></i>
   {{ "new" | i18n }}
 </button>
 <bit-menu #itemOptions>
diff --git a/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.spec.ts b/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.spec.ts
index 5563cd3033b..4b992d9f1ee 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.spec.ts
@@ -180,7 +180,7 @@ describe("VaultV2Component", () => {
   const nudgesSvc = {
     showNudgeSpotlight$: jest.fn().mockImplementation((_type: NudgeType) => of(false)),
     dismissNudge: jest.fn().mockResolvedValue(undefined),
-  } as Partial<NudgesService>;
+  };
 
   const dialogSvc = {} as Partial<DialogService>;
 
@@ -209,6 +209,10 @@ describe("VaultV2Component", () => {
       .mockResolvedValue(new Date(Date.now() - 8 * 24 * 60 * 60 * 1000)), // 8 days ago
   };
 
+  const configSvc = {
+    getFeatureFlag$: jest.fn().mockImplementation((_flag: string) => of(false)),
+  };
+
   beforeEach(async () => {
     jest.clearAllMocks();
     await TestBed.configureTestingModule({
@@ -256,9 +260,7 @@ describe("VaultV2Component", () => {
         { provide: StateProvider, useValue: mock<StateProvider>() },
         {
           provide: ConfigService,
-          useValue: {
-            getFeatureFlag$: (_: string) => of(false),
-          },
+          useValue: configSvc,
         },
         {
           provide: SearchService,
@@ -453,7 +455,9 @@ describe("VaultV2Component", () => {
 
     hasPremiumFromAnySource$.next(false);
 
-    (nudgesSvc.showNudgeSpotlight$ as jest.Mock).mockImplementation((type: NudgeType) =>
+    configSvc.getFeatureFlag$.mockImplementation((_flag: string) => of(true));
+
+    nudgesSvc.showNudgeSpotlight$.mockImplementation((type: NudgeType) =>
       of(type === NudgeType.PremiumUpgrade),
     );
 
@@ -482,9 +486,11 @@ describe("VaultV2Component", () => {
   }));
 
   it("renders Empty-Vault spotlight when vaultState is Empty and nudge is on", fakeAsync(() => {
+    configSvc.getFeatureFlag$.mockImplementation((_flag: string) => of(false));
+
     itemsSvc.emptyVault$.next(true);
 
-    (nudgesSvc.showNudgeSpotlight$ as jest.Mock).mockImplementation((type: NudgeType) => {
+    nudgesSvc.showNudgeSpotlight$.mockImplementation((type: NudgeType) => {
       return of(type === NudgeType.EmptyVaultNudge);
     });
 
diff --git a/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.ts
index 9cee4f66b67..63d971081df 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/vault-v2.component.ts
@@ -137,6 +137,10 @@ export class VaultV2Component implements OnInit, AfterViewInit, OnDestroy {
     FeatureFlag.VaultLoadingSkeletons,
   );
 
+  protected premiumSpotlightFeatureFlag$ = this.configService.getFeatureFlag$(
+    FeatureFlag.BrowserPremiumSpotlight,
+  );
+
   private showPremiumNudgeSpotlight$ = this.activeUserId$.pipe(
     switchMap((userId) => this.nudgesService.showNudgeSpotlight$(NudgeType.PremiumUpgrade, userId)),
   );
@@ -164,6 +168,7 @@ export class VaultV2Component implements OnInit, AfterViewInit, OnDestroy {
   );
 
   protected showPremiumSpotlight$ = combineLatest([
+    this.premiumSpotlightFeatureFlag$,
     this.showPremiumNudgeSpotlight$,
     this.showHasItemsVaultSpotlight$,
     this.hasPremium$,
@@ -171,8 +176,13 @@ export class VaultV2Component implements OnInit, AfterViewInit, OnDestroy {
     this.accountAgeInDays$,
   ]).pipe(
     map(
-      ([showPremiumNudge, showHasItemsNudge, hasPremium, count, age]) =>
-        showPremiumNudge && !showHasItemsNudge && !hasPremium && count >= 5 && age >= 7,
+      ([featureFlagEnabled, showPremiumNudge, showHasItemsNudge, hasPremium, count, age]) =>
+        featureFlagEnabled &&
+        showPremiumNudge &&
+        !showHasItemsNudge &&
+        !hasPremium &&
+        count >= 5 &&
+        age >= 7,
     ),
     shareReplay({ bufferSize: 1, refCount: true }),
   );
diff --git a/apps/browser/src/vault/popup/settings/vault-settings-v2.component.ts b/apps/browser/src/vault/popup/settings/vault-settings-v2.component.ts
index c6db820c232..e085cb21c2d 100644
--- a/apps/browser/src/vault/popup/settings/vault-settings-v2.component.ts
+++ b/apps/browser/src/vault/popup/settings/vault-settings-v2.component.ts
@@ -49,7 +49,7 @@ export class VaultSettingsV2Component implements OnInit, OnDestroy {
     this.userId$.pipe(switchMap((userId) => this.cipherArchiveService.userCanArchive$(userId))),
   );
 
-  protected readonly showArchiveItem = toSignal(this.cipherArchiveService.hasArchiveFlagEnabled$());
+  protected readonly showArchiveItem = toSignal(this.cipherArchiveService.hasArchiveFlagEnabled$);
 
   protected readonly userHasArchivedItems = toSignal(
     this.userId$.pipe(
diff --git a/apps/browser/src/vault/popup/utils/vault-popout-window.spec.ts b/apps/browser/src/vault/popup/utils/vault-popout-window.spec.ts
index 4597c004290..3389228dda4 100644
--- a/apps/browser/src/vault/popup/utils/vault-popout-window.spec.ts
+++ b/apps/browser/src/vault/popup/utils/vault-popout-window.spec.ts
@@ -2,6 +2,7 @@ import { mock } from "jest-mock-extended";
 
 import { CipherType } from "@bitwarden/common/vault/enums";
 
+import { BrowserApi } from "../../../platform/browser/browser-api";
 import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
 
 import {
@@ -23,6 +24,19 @@ describe("VaultPopoutWindow", () => {
     .spyOn(BrowserPopupUtils, "closeSingleActionPopout")
     .mockImplementation();
 
+  beforeEach(() => {
+    jest.spyOn(BrowserApi, "tabsQuery").mockResolvedValue([]);
+    jest.spyOn(BrowserApi, "updateWindowProperties").mockResolvedValue();
+    global.chrome = {
+      ...global.chrome,
+      runtime: {
+        ...global.chrome?.runtime,
+        sendMessage: jest.fn().mockResolvedValue(undefined),
+        getURL: jest.fn((path) => `chrome-extension://extension-id/${path}`),
+      },
+    };
+  });
+
   afterEach(() => {
     jest.clearAllMocks();
   });
@@ -123,6 +137,32 @@ describe("VaultPopoutWindow", () => {
         },
       );
     });
+
+    it("sends a message to refresh data when the popup is already open", async () => {
+      const existingPopupTab = {
+        id: 123,
+        windowId: 456,
+        url: `chrome-extension://extension-id/popup/index.html#/edit-cipher?singleActionPopout=${VaultPopoutType.addEditVaultItem}_${CipherType.Login}`,
+      } as chrome.tabs.Tab;
+
+      jest.spyOn(BrowserApi, "tabsQuery").mockResolvedValue([existingPopupTab]);
+      const sendMessageSpy = jest.spyOn(chrome.runtime, "sendMessage");
+      const updateWindowSpy = jest.spyOn(BrowserApi, "updateWindowProperties");
+
+      await openAddEditVaultItemPopout(
+        mock<chrome.tabs.Tab>({ windowId: 1, url: "https://jest-testing-website.com" }),
+        {
+          cipherType: CipherType.Login,
+        },
+      );
+
+      expect(openPopoutSpy).not.toHaveBeenCalled();
+      expect(sendMessageSpy).toHaveBeenCalledWith({
+        command: "reloadAddEditCipherData",
+        data: { cipherId: undefined, cipherType: CipherType.Login },
+      });
+      expect(updateWindowSpy).toHaveBeenCalledWith(456, { focused: true });
+    });
   });
 
   describe("closeAddEditVaultItemPopout", () => {
diff --git a/apps/browser/src/vault/popup/utils/vault-popout-window.ts b/apps/browser/src/vault/popup/utils/vault-popout-window.ts
index 3dae96b6cc7..cccf005cd2e 100644
--- a/apps/browser/src/vault/popup/utils/vault-popout-window.ts
+++ b/apps/browser/src/vault/popup/utils/vault-popout-window.ts
@@ -115,10 +115,26 @@ async function openAddEditVaultItemPopout(
     addEditCipherUrl += formatQueryString("uri", url);
   }
 
-  await BrowserPopupUtils.openPopout(addEditCipherUrl, {
-    singleActionKey,
-    senderWindowId: windowId,
-  });
+  const extensionUrl = chrome.runtime.getURL("popup/index.html");
+  const existingPopupTabs = await BrowserApi.tabsQuery({ url: `${extensionUrl}*` });
+  const existingPopup = existingPopupTabs.find((tab) =>
+    tab.url?.includes(`singleActionPopout=${singleActionKey}`),
+  );
+  // Check if the an existing popup is already open
+  try {
+    await chrome.runtime.sendMessage({
+      command: "reloadAddEditCipherData",
+      data: { cipherId, cipherType },
+    });
+    await BrowserApi.updateWindowProperties(existingPopup.windowId, {
+      focused: true,
+    });
+  } catch {
+    await BrowserPopupUtils.openPopout(addEditCipherUrl, {
+      singleActionKey,
+      senderWindowId: windowId,
+    });
+  }
 }
 
 /**
diff --git a/apps/browser/tailwind.config.js b/apps/browser/tailwind.config.js
index 134001bbf13..faaa7fa4128 100644
--- a/apps/browser/tailwind.config.js
+++ b/apps/browser/tailwind.config.js
@@ -12,5 +12,6 @@ config.content = [
   "../../libs/vault/src/**/*.{html,ts}",
   "../../libs/pricing/src/**/*.{html,ts}",
 ];
+config.corePlugins.preflight = true;
 
 module.exports = config;
diff --git a/apps/cli/package.json b/apps/cli/package.json
index adddc99b4d7..0ae4bf9ce30 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -75,7 +75,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.3",
+    "koa": "3.1.1",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lowdb": "1.0.0",
@@ -83,12 +83,12 @@
     "multer": "2.0.2",
     "node-fetch": "2.6.12",
     "node-forge": "1.3.2",
-    "open": "10.1.2",
+    "open": "11.0.0",
     "papaparse": "5.5.3",
     "proper-lockfile": "4.1.2",
     "rxjs": "7.8.1",
     "semver": "7.7.3",
-    "tldts": "7.0.18",
+    "tldts": "7.0.19",
     "zxcvbn": "4.4.2"
   }
 }
diff --git a/apps/cli/src/auth/commands/login.command.ts b/apps/cli/src/auth/commands/login.command.ts
index d0ab062d0b3..d8859318b52 100644
--- a/apps/cli/src/auth/commands/login.command.ts
+++ b/apps/cli/src/auth/commands/login.command.ts
@@ -31,6 +31,7 @@ import { TwoFactorService, TwoFactorApiService } from "@bitwarden/common/auth/tw
 import { ClientType } from "@bitwarden/common/enums";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { MasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
@@ -81,6 +82,7 @@ export class LoginCommand {
     protected ssoUrlService: SsoUrlService,
     protected i18nService: I18nService,
     protected masterPasswordService: MasterPasswordServiceAbstraction,
+    protected encryptedMigrator: EncryptedMigrator,
   ) {}
 
   async run(email: string, password: string, options: OptionValues) {
@@ -111,20 +113,14 @@ export class LoginCommand {
     } else if (options.sso != null && this.canInteract) {
       // If the optional Org SSO Identifier isn't provided, the option value is `true`.
       const orgSsoIdentifier = options.sso === true ? null : options.sso;
-      const passwordOptions: any = {
-        type: "password",
-        length: 64,
-        uppercase: true,
-        lowercase: true,
-        numbers: true,
-        special: false,
-      };
-      const state = await this.passwordGenerationService.generatePassword(passwordOptions);
-      ssoCodeVerifier = await this.passwordGenerationService.generatePassword(passwordOptions);
-      const codeVerifierHash = await this.cryptoFunctionService.hash(ssoCodeVerifier, "sha256");
-      const codeChallenge = Utils.fromBufferToUrlB64(codeVerifierHash);
+      const ssoPromptData = await this.makeSsoPromptData();
+      ssoCodeVerifier = ssoPromptData.ssoCodeVerifier;
       try {
-        const ssoParams = await this.openSsoPrompt(codeChallenge, state, orgSsoIdentifier);
+        const ssoParams = await this.openSsoPrompt(
+          ssoPromptData.codeChallenge,
+          ssoPromptData.state,
+          orgSsoIdentifier,
+        );
         ssoCode = ssoParams.ssoCode;
         orgIdentifier = ssoParams.orgIdentifier;
       } catch {
@@ -229,9 +225,43 @@ export class LoginCommand {
           new PasswordLoginCredentials(email, password, twoFactor),
         );
       }
+
+      // Begin Acting on initial AuthResult
+
       if (response.requiresEncryptionKeyMigration) {
         return Response.error(this.i18nService.t("legacyEncryptionUnsupported"));
       }
+
+      // Opting for not checking feature flag since the server will not respond with
+      // SsoOrganizationIdentifier if the feature flag is not enabled.
+      if (response.requiresSso && this.canInteract) {
+        const ssoPromptData = await this.makeSsoPromptData();
+        ssoCodeVerifier = ssoPromptData.ssoCodeVerifier;
+        try {
+          const ssoParams = await this.openSsoPrompt(
+            ssoPromptData.codeChallenge,
+            ssoPromptData.state,
+            response.ssoOrganizationIdentifier,
+          );
+          ssoCode = ssoParams.ssoCode;
+          orgIdentifier = ssoParams.orgIdentifier;
+          if (ssoCode != null && ssoCodeVerifier != null) {
+            response = await this.loginStrategyService.logIn(
+              new SsoLoginCredentials(
+                ssoCode,
+                ssoCodeVerifier,
+                this.ssoRedirectUri,
+                orgIdentifier,
+                undefined, // email to look up 2FA token not required as CLI can't remember 2FA token
+                twoFactor,
+              ),
+            );
+          }
+        } catch {
+          return Response.badRequest("Something went wrong. Try again.");
+        }
+      }
+
       if (response.requiresTwoFactor) {
         const twoFactorProviders = await this.twoFactorService.getSupportedProviders(null);
         if (twoFactorProviders.length === 0) {
@@ -277,6 +307,10 @@ export class LoginCommand {
         if (twoFactorToken == null && selectedProvider.type === TwoFactorProviderType.Email) {
           const emailReq = new TwoFactorEmailRequest();
           emailReq.email = await this.loginStrategyService.getEmail();
+          // if the user was logging in with SSO, we need to include the SSO session token
+          if (response.ssoEmail2FaSessionToken != null) {
+            emailReq.ssoEmail2FaSessionToken = response.ssoEmail2FaSessionToken;
+          }
           emailReq.masterPasswordHash = await this.loginStrategyService.getMasterPasswordHash();
           await this.twoFactorApiService.postTwoFactorEmail(emailReq);
         }
@@ -322,6 +356,7 @@ export class LoginCommand {
         response = await this.loginStrategyService.logInNewDeviceVerification(newDeviceToken);
       }
 
+      // We check response two factor again here since MFA could fail based on the logic on ln 226
       if (response.requiresTwoFactor) {
         return Response.error("Login failed.");
       }
@@ -367,6 +402,8 @@ export class LoginCommand {
         }
       }
 
+      await this.encryptedMigrator.runMigrations(response.userId, password);
+
       return await this.handleSuccessResponse(response);
     } catch (e) {
       if (
@@ -688,6 +725,27 @@ export class LoginCommand {
     };
   }
 
+  /// Generate SSO prompt data: code verifier, code challenge, and state
+  private async makeSsoPromptData(): Promise<{
+    ssoCodeVerifier: string;
+    codeChallenge: string;
+    state: string;
+  }> {
+    const passwordOptions: any = {
+      type: "password",
+      length: 64,
+      uppercase: true,
+      lowercase: true,
+      numbers: true,
+      special: false,
+    };
+    const state = await this.passwordGenerationService.generatePassword(passwordOptions);
+    const ssoCodeVerifier = await this.passwordGenerationService.generatePassword(passwordOptions);
+    const codeVerifierHash = await this.cryptoFunctionService.hash(ssoCodeVerifier, "sha256");
+    const codeChallenge = Utils.fromBufferToUrlB64(codeVerifierHash);
+    return { ssoCodeVerifier, codeChallenge, state };
+  }
+
   private async openSsoPrompt(
     codeChallenge: string,
     state: string,
diff --git a/apps/cli/src/base-program.ts b/apps/cli/src/base-program.ts
index 69a5e4e1bde..71c3830b4cc 100644
--- a/apps/cli/src/base-program.ts
+++ b/apps/cli/src/base-program.ts
@@ -182,6 +182,7 @@ export abstract class BaseProgram {
         this.serviceContainer.organizationApiService,
         this.serviceContainer.logout,
         this.serviceContainer.i18nService,
+        this.serviceContainer.encryptedMigrator,
         this.serviceContainer.masterPasswordUnlockService,
         this.serviceContainer.configService,
       );
diff --git a/apps/cli/src/commands/edit.command.ts b/apps/cli/src/commands/edit.command.ts
index 14a218c7141..d95e8333dca 100644
--- a/apps/cli/src/commands/edit.command.ts
+++ b/apps/cli/src/commands/edit.command.ts
@@ -186,15 +186,15 @@ export class EditCommand {
       return Response.notFound();
     }
 
-    let folderView = await folder.decrypt();
+    const userKey = await firstValueFrom(this.keyService.userKey$(activeUserId));
+    let folderView = await folder.decrypt(userKey);
     folderView = FolderExport.toView(req, folderView);
 
-    const userKey = await this.keyService.getUserKey(activeUserId);
     const encFolder = await this.folderService.encrypt(folderView, userKey);
     try {
       const folder = await this.folderApiService.save(encFolder, activeUserId);
       const updatedFolder = new Folder(folder);
-      const decFolder = await updatedFolder.decrypt();
+      const decFolder = await updatedFolder.decrypt(userKey);
       const res = new FolderResponse(decFolder);
       return Response.success(res);
     } catch (e) {
diff --git a/apps/cli/src/commands/get.command.ts b/apps/cli/src/commands/get.command.ts
index 93e711d748f..35816b56fb2 100644
--- a/apps/cli/src/commands/get.command.ts
+++ b/apps/cli/src/commands/get.command.ts
@@ -417,10 +417,11 @@ export class GetCommand extends DownloadCommand {
   private async getFolder(id: string) {
     let decFolder: FolderView = null;
     const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+    const userKey = await firstValueFrom(this.keyService.userKey$(activeUserId));
     if (Utils.isGuid(id)) {
       const folder = await this.folderService.getFromState(id, activeUserId);
       if (folder != null) {
-        decFolder = await folder.decrypt();
+        decFolder = await folder.decrypt(userKey);
       }
     } else if (id.trim() !== "") {
       let folders = await this.folderService.getAllDecryptedFromState(activeUserId);
diff --git a/apps/cli/src/key-management/commands/unlock.command.spec.ts b/apps/cli/src/key-management/commands/unlock.command.spec.ts
index 928a750dca6..70e9a8fd232 100644
--- a/apps/cli/src/key-management/commands/unlock.command.spec.ts
+++ b/apps/cli/src/key-management/commands/unlock.command.spec.ts
@@ -7,6 +7,7 @@ import { UserVerificationService } from "@bitwarden/common/auth/abstractions/use
 import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
 import { MasterPasswordVerificationResponse } from "@bitwarden/common/auth/types/verification";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { MasterPasswordUnlockService } from "@bitwarden/common/key-management/master-password/abstractions/master-password-unlock.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
@@ -40,6 +41,7 @@ describe("UnlockCommand", () => {
   const organizationApiService = mock<OrganizationApiServiceAbstraction>();
   const logout = jest.fn();
   const i18nService = mock<I18nService>();
+  const encryptedMigrator = mock<EncryptedMigrator>();
   const masterPasswordUnlockService = mock<MasterPasswordUnlockService>();
   const configService = mock<ConfigService>();
 
@@ -92,6 +94,7 @@ describe("UnlockCommand", () => {
       organizationApiService,
       logout,
       i18nService,
+      encryptedMigrator,
       masterPasswordUnlockService,
       configService,
     );
diff --git a/apps/cli/src/key-management/commands/unlock.command.ts b/apps/cli/src/key-management/commands/unlock.command.ts
index 4ae8ce823a4..c88d9ae1cc4 100644
--- a/apps/cli/src/key-management/commands/unlock.command.ts
+++ b/apps/cli/src/key-management/commands/unlock.command.ts
@@ -9,6 +9,7 @@ import { VerificationType } from "@bitwarden/common/auth/enums/verification-type
 import { MasterPasswordVerification } from "@bitwarden/common/auth/types/verification";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { MasterPasswordUnlockService } from "@bitwarden/common/key-management/master-password/abstractions/master-password-unlock.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
@@ -38,6 +39,7 @@ export class UnlockCommand {
     private organizationApiService: OrganizationApiServiceAbstraction,
     private logout: () => Promise<void>,
     private i18nService: I18nService,
+    private encryptedMigrator: EncryptedMigrator,
     private masterPasswordUnlockService: MasterPasswordUnlockService,
     private configService: ConfigService,
   ) {}
@@ -116,6 +118,8 @@ export class UnlockCommand {
       }
     }
 
+    await this.encryptedMigrator.runMigrations(userId, password);
+
     return this.successResponse();
   }
 
diff --git a/apps/cli/src/key-management/session-timeout/services/cli-session-timeout-type.service.ts b/apps/cli/src/key-management/session-timeout/services/cli-session-timeout-type.service.ts
new file mode 100644
index 00000000000..8143b37b8a3
--- /dev/null
+++ b/apps/cli/src/key-management/session-timeout/services/cli-session-timeout-type.service.ts
@@ -0,0 +1,15 @@
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
+import {
+  VaultTimeout,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+
+export class CliSessionTimeoutTypeService implements SessionTimeoutTypeService {
+  async isAvailable(timeout: VaultTimeout): Promise<boolean> {
+    return timeout === VaultTimeoutStringType.Never;
+  }
+
+  async getOrPromoteToAvailable(_: VaultTimeout): Promise<VaultTimeout> {
+    return VaultTimeoutStringType.Never;
+  }
+}
diff --git a/apps/cli/src/oss-serve-configurator.ts b/apps/cli/src/oss-serve-configurator.ts
index bd51cf4dd91..dbe17224d07 100644
--- a/apps/cli/src/oss-serve-configurator.ts
+++ b/apps/cli/src/oss-serve-configurator.ts
@@ -176,6 +176,7 @@ export class OssServeConfigurator {
       this.serviceContainer.organizationApiService,
       async () => await this.serviceContainer.logout(),
       this.serviceContainer.i18nService,
+      this.serviceContainer.encryptedMigrator,
       this.serviceContainer.masterPasswordUnlockService,
       this.serviceContainer.configService,
     );
diff --git a/apps/cli/src/platform/services/cli-sdk-load.service.ts b/apps/cli/src/platform/services/cli-sdk-load.service.ts
index 638e64a8214..13a4c19d51d 100644
--- a/apps/cli/src/platform/services/cli-sdk-load.service.ts
+++ b/apps/cli/src/platform/services/cli-sdk-load.service.ts
@@ -3,6 +3,8 @@ import * as sdk from "@bitwarden/sdk-internal";
 
 export class CliSdkLoadService extends SdkLoadService {
   async load(): Promise<void> {
+    // CLI uses stdout for user interaction / automations so we cannot log info / debug here.
+    SdkLoadService.logLevel = sdk.LogLevel.Error;
     const module = await import("@bitwarden/sdk-internal/bitwarden_wasm_internal_bg.wasm");
     (sdk as any).init(module);
   }
diff --git a/apps/cli/src/program.ts b/apps/cli/src/program.ts
index a5f12b34035..3e5b5678629 100644
--- a/apps/cli/src/program.ts
+++ b/apps/cli/src/program.ts
@@ -195,6 +195,7 @@ export class Program extends BaseProgram {
             this.serviceContainer.ssoUrlService,
             this.serviceContainer.i18nService,
             this.serviceContainer.masterPasswordService,
+            this.serviceContainer.encryptedMigrator,
           );
           const response = await command.run(email, password, options);
           this.processResponse(response, true);
@@ -277,6 +278,11 @@ export class Program extends BaseProgram {
       })
       .option("--check", "Check lock status.", async () => {
         await this.exitIfNotAuthed();
+        const userId = (await firstValueFrom(this.serviceContainer.accountService.activeAccount$))
+          ?.id;
+        await this.serviceContainer.userAutoUnlockKeyService.setUserKeyInMemoryIfAutoUserKeySet(
+          userId,
+        );
 
         const authStatus = await this.serviceContainer.authService.getAuthStatus();
         if (authStatus === AuthenticationStatus.Unlocked) {
@@ -306,6 +312,7 @@ export class Program extends BaseProgram {
             this.serviceContainer.organizationApiService,
             async () => await this.serviceContainer.logout(),
             this.serviceContainer.i18nService,
+            this.serviceContainer.encryptedMigrator,
             this.serviceContainer.masterPasswordUnlockService,
             this.serviceContainer.configService,
           );
diff --git a/apps/cli/src/service-container/service-container.ts b/apps/cli/src/service-container/service-container.ts
index c163b7581b4..2d4ea7d00b5 100644
--- a/apps/cli/src/service-container/service-container.ts
+++ b/apps/cli/src/service-container/service-container.ts
@@ -76,6 +76,10 @@ import {
 import { EncryptServiceImplementation } from "@bitwarden/common/key-management/crypto/services/encrypt.service.implementation";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { DeviceTrustService } from "@bitwarden/common/key-management/device-trust/services/device-trust.service.implementation";
+import { DefaultEncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/default-encrypted-migrator";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
+import { DefaultChangeKdfApiService } from "@bitwarden/common/key-management/kdf/change-kdf-api.service";
+import { DefaultChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf.service";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/services/key-connector.service";
 import { MasterPasswordUnlockService } from "@bitwarden/common/key-management/master-password/abstractions/master-password-unlock.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
@@ -207,6 +211,7 @@ import {
 
 import { CliBiometricsService } from "../key-management/cli-biometrics-service";
 import { CliProcessReloadService } from "../key-management/cli-process-reload.service";
+import { CliSessionTimeoutTypeService } from "../key-management/session-timeout/services/cli-session-timeout-type.service";
 import { flagEnabled } from "../platform/flags";
 import { CliPlatformUtilsService } from "../platform/services/cli-platform-utils.service";
 import { CliSdkLoadService } from "../platform/services/cli-sdk-load.service";
@@ -324,6 +329,7 @@ export class ServiceContainer {
   cipherEncryptionService: CipherEncryptionService;
   restrictedItemTypesService: RestrictedItemTypesService;
   cliRestrictedItemTypesService: CliRestrictedItemTypesService;
+  encryptedMigrator: EncryptedMigrator;
   securityStateService: SecurityStateService;
   masterPasswordUnlockService: MasterPasswordUnlockService;
   cipherArchiveService: CipherArchiveService;
@@ -486,10 +492,7 @@ export class ServiceContainer {
 
     const pinStateService = new PinStateService(this.stateProvider);
     this.pinService = new PinService(
-      this.accountService,
       this.encryptService,
-      this.kdfConfigService,
-      this.keyGenerationService,
       this.logService,
       this.keyService,
       this.sdkService,
@@ -524,6 +527,8 @@ export class ServiceContainer {
       this.accountService,
     );
 
+    const sessionTimeoutTypeService = new CliSessionTimeoutTypeService();
+
     this.vaultTimeoutSettingsService = new DefaultVaultTimeoutSettingsService(
       this.accountService,
       pinStateService,
@@ -535,6 +540,7 @@ export class ServiceContainer {
       this.stateProvider,
       this.logService,
       VaultTimeoutStringType.Never, // default vault timeout
+      sessionTimeoutTypeService,
     );
 
     const refreshAccessTokenErrorCallback = () => {
@@ -899,7 +905,7 @@ export class ServiceContainer {
       this.collectionService,
       this.keyService,
       this.encryptService,
-      this.pinService,
+      this.keyGenerationService,
       this.accountService,
       this.restrictedItemTypesService,
     );
@@ -907,7 +913,7 @@ export class ServiceContainer {
     this.individualExportService = new IndividualVaultExportService(
       this.folderService,
       this.cipherService,
-      this.pinService,
+      this.keyGenerationService,
       this.keyService,
       this.encryptService,
       this.cryptoFunctionService,
@@ -921,7 +927,7 @@ export class ServiceContainer {
     this.organizationExportService = new OrganizationVaultExportService(
       this.cipherService,
       this.vaultExportApiService,
-      this.pinService,
+      this.keyGenerationService,
       this.keyService,
       this.encryptService,
       this.cryptoFunctionService,
@@ -975,6 +981,16 @@ export class ServiceContainer {
     );
 
     this.masterPasswordApiService = new MasterPasswordApiService(this.apiService, this.logService);
+    const changeKdfApiService = new DefaultChangeKdfApiService(this.apiService);
+    const changeKdfService = new DefaultChangeKdfService(changeKdfApiService, this.sdkService);
+    this.encryptedMigrator = new DefaultEncryptedMigrator(
+      this.kdfConfigService,
+      changeKdfService,
+      this.logService,
+      this.configService,
+      this.masterPasswordService,
+      this.syncService,
+    );
   }
 
   async logout() {
diff --git a/apps/cli/src/vault/create.command.ts b/apps/cli/src/vault/create.command.ts
index 5602c593942..d826766dc65 100644
--- a/apps/cli/src/vault/create.command.ts
+++ b/apps/cli/src/vault/create.command.ts
@@ -181,12 +181,12 @@ export class CreateCommand {
 
   private async createFolder(req: FolderExport) {
     const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
-    const userKey = await this.keyService.getUserKey(activeUserId);
+    const userKey = await firstValueFrom(this.keyService.userKey$(activeUserId));
     const folder = await this.folderService.encrypt(FolderExport.toView(req), userKey);
     try {
       const folderData = await this.folderApiService.save(folder, activeUserId);
       const newFolder = new Folder(folderData);
-      const decFolder = await newFolder.decrypt();
+      const decFolder = await newFolder.decrypt(userKey);
       const res = new FolderResponse(decFolder);
       return Response.success(res);
     } catch (e) {
diff --git a/apps/desktop/desktop_native/Cargo.lock b/apps/desktop/desktop_native/Cargo.lock
index 3b9b8c2db27..5978659f21e 100644
--- a/apps/desktop/desktop_native/Cargo.lock
+++ b/apps/desktop/desktop_native/Cargo.lock
@@ -2,21 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -114,9 +99,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.94"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "arboard"
@@ -138,14 +123,14 @@ dependencies = [
 
 [[package]]
 name = "ashpd"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cbdf310d77fd3aaee6ea2093db7011dc2d35d2eb3481e5607f1f8d942ed99df"
+checksum = "da0986d5b4f0802160191ad75f8d33ada000558757db3defb70299ca95d9fcbd"
 dependencies = [
  "enumflags2",
  "futures-channel",
  "futures-util",
- "rand 0.9.1",
+ "rand 0.9.2",
  "serde",
  "serde_repr",
  "tokio",
@@ -347,23 +332,8 @@ dependencies = [
  "mockall",
  "serial_test",
  "tracing",
- "windows 0.61.1",
- "windows-core 0.61.0",
-]
-
-[[package]]
-name = "backtrace"
-version = "0.3.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets 0.52.6",
+ "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -457,7 +427,7 @@ dependencies = [
  "tokio",
  "tracing",
  "tracing-subscriber",
- "windows 0.61.1",
+ "windows",
 ]
 
 [[package]]
@@ -501,6 +471,12 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "bumpalo"
+version = "3.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -509,9 +485,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 
 [[package]]
 name = "camino"
@@ -556,9 +532,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.46"
+version = "1.2.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
+checksum = "90583009037521a116abf44494efecd645ba48b6622457080f080b85544e2215"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -614,7 +590,7 @@ dependencies = [
  "hex",
  "oo7",
  "pbkdf2",
- "rand 0.9.1",
+ "rand 0.9.2",
  "rusqlite",
  "security-framework",
  "serde",
@@ -623,7 +599,7 @@ dependencies = [
  "tokio",
  "tracing",
  "verifysign",
- "windows 0.61.1",
+ "windows",
 ]
 
 [[package]]
@@ -709,9 +685,9 @@ checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "convert_case"
-version = "0.6.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+checksum = "baaaa0ecca5b51987b9423ccdc971514dd8b0bb7b4060b983d3664dad3f1f89f"
 dependencies = [
  "unicode-segmentation",
 ]
@@ -770,16 +746,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "ctor"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
-dependencies = [
- "quote",
- "syn",
-]
-
 [[package]]
 name = "ctor"
 version = "0.5.0"
@@ -867,7 +833,7 @@ dependencies = [
  "memsec",
  "oo7",
  "pin-project",
- "rand 0.9.1",
+ "rand 0.9.2",
  "scopeguard",
  "secmem-proc",
  "security-framework",
@@ -877,13 +843,13 @@ dependencies = [
  "sha2",
  "ssh-key",
  "sysinfo",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-util",
  "tracing",
  "typenum",
  "widestring",
- "windows 0.61.1",
+ "windows",
  "windows-future",
  "zbus",
  "zbus_polkit",
@@ -1409,17 +1375,11 @@ dependencies = [
  "polyval",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
 [[package]]
 name = "glob"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "goblin"
@@ -1499,14 +1459,14 @@ dependencies = [
 
 [[package]]
 name = "homedir"
-version = "0.3.4"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bdbbd5bc8c5749697ccaa352fa45aff8730cf21c68029c0eef1ffed7c3d6ba2"
+checksum = "68df315d2857b2d8d2898be54a85e1d001bbbe0dbb5f8ef847b48dd3a23c4527"
 dependencies = [
  "cfg-if",
- "nix 0.29.0",
+ "nix",
  "widestring",
- "windows 0.57.0",
+ "windows",
 ]
 
 [[package]]
@@ -1663,6 +1623,16 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "js-sys"
+version = "0.3.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1674,9 +1644,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.178"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
 
 [[package]]
 name = "libloading"
@@ -1685,7 +1655,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a793df0d7afeac54f95b471d3af7f0d4fb975699f972341a4b76988d49cdf0c"
 dependencies = [
  "cfg-if",
- "windows-targets 0.53.3",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -1841,15 +1811,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
-dependencies = [
- "adler2",
-]
-
 [[package]]
 name = "mio"
 version = "1.0.3"
@@ -1889,32 +1850,33 @@ dependencies = [
 
 [[package]]
 name = "napi"
-version = "2.16.17"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55740c4ae1d8696773c78fdafd5d0e5fe9bc9f1b071c7ba493ba5c413a9184f3"
+checksum = "f1b74e3dce5230795bb4d2821b941706dee733c7308752507254b0497f39cad7"
 dependencies = [
  "bitflags",
- "ctor 0.2.9",
- "napi-derive",
+ "ctor",
+ "napi-build",
  "napi-sys",
- "once_cell",
+ "nohash-hasher",
+ "rustc-hash",
  "tokio",
 ]
 
 [[package]]
 name = "napi-build"
-version = "2.2.0"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03acbfa4f156a32188bfa09b86dc11a431b5725253fc1fc6f6df5bed273382c4"
+checksum = "dcae8ad5609d14afb3a3b91dee88c757016261b151e9dcecabf1b2a31a6cab14"
 
 [[package]]
 name = "napi-derive"
-version = "2.16.13"
+version = "3.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cbe2585d8ac223f7d34f13701434b9d5f4eb9c332cccce8dee57ea18ab8ab0c"
+checksum = "7552d5a579b834614bbd496db5109f1b9f1c758f08224b0dee1e408333adf0d0"
 dependencies = [
- "cfg-if",
  "convert_case",
+ "ctor",
  "napi-derive-backend",
  "proc-macro2",
  "quote",
@@ -1923,40 +1885,26 @@ dependencies = [
 
 [[package]]
 name = "napi-derive-backend"
-version = "1.0.75"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1639aaa9eeb76e91c6ae66da8ce3e89e921cd3885e99ec85f4abacae72fc91bf"
+checksum = "5f6a81ac7486b70f2532a289603340862c06eea5a1e650c1ffeda2ce1238516a"
 dependencies = [
  "convert_case",
- "once_cell",
  "proc-macro2",
  "quote",
- "regex",
  "semver",
  "syn",
 ]
 
 [[package]]
 name = "napi-sys"
-version = "2.4.0"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "427802e8ec3a734331fec1035594a210ce1ff4dc5bc1950530920ab717964ea3"
+checksum = "3e4e7135a8f97aa0f1509cce21a8a1f9dcec1b50d8dee006b48a5adb69a9d64d"
 dependencies = [
  "libloading",
 ]
 
-[[package]]
-name = "nix"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
-dependencies = [
- "bitflags",
- "cfg-if",
- "cfg_aliases",
- "libc",
-]
-
 [[package]]
 name = "nix"
 version = "0.30.1"
@@ -1970,6 +1918,12 @@ dependencies = [
  "memoffset",
 ]
 
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -2173,15 +2127,6 @@ dependencies = [
  "objc2-core-foundation",
 ]
 
-[[package]]
-name = "object"
-version = "0.36.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.3"
@@ -2190,9 +2135,9 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "oo7"
-version = "0.4.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb23d3ec3527d65a83be1c1795cb883c52cfa57147d42acc797127df56fc489"
+checksum = "e3299dd401feaf1d45afd8fd1c0586f10fcfb22f244bb9afa942cec73503b89d"
 dependencies = [
  "aes",
  "ashpd",
@@ -2208,7 +2153,7 @@ dependencies = [
  "num",
  "num-bigint-dig",
  "pbkdf2",
- "rand 0.9.1",
+ "rand 0.9.2",
  "serde",
  "sha2",
  "subtle",
@@ -2548,7 +2493,7 @@ dependencies = [
 name = "process_isolation"
 version = "0.0.0"
 dependencies = [
- "ctor 0.5.0",
+ "ctor",
  "desktop_core",
  "libc",
  "tracing",
@@ -2591,9 +2536,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -2660,19 +2605,7 @@ checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b"
 dependencies = [
  "getrandom 0.2.16",
  "libredox",
- "thiserror 2.0.12",
-]
-
-[[package]]
-name = "regex"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -2748,10 +2681,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustc-demangle"
-version = "0.1.24"
+name = "rustc-hash"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
 
 [[package]]
 name = "rustc_version"
@@ -2798,6 +2731,12 @@ dependencies = [
  "rustix 1.0.7",
 ]
 
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
 [[package]]
 name = "ryu"
 version = "1.0.20"
@@ -2870,15 +2809,15 @@ dependencies = [
  "libc",
  "rustix 1.0.7",
  "rustix-linux-procfs",
- "thiserror 2.0.12",
- "windows 0.61.1",
+ "thiserror 2.0.17",
+ "windows",
 ]
 
 [[package]]
 name = "security-framework"
-version = "3.5.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc198e42d9b7510827939c9a15f5062a0c913f3371d765977e586d2fe6c16f4a"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
 dependencies = [
  "bitflags",
  "core-foundation",
@@ -3068,12 +3007,12 @@ checksum = "b7c388c1b5e93756d0c740965c41e8822f866621d41acbdf6336a6a168f8840c"
 
 [[package]]
 name = "socket2"
-version = "0.5.9"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3188,16 +3127,16 @@ dependencies = [
 
 [[package]]
 name = "sysinfo"
-version = "0.35.0"
+version = "0.37.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b897c8ea620e181c7955369a31be5f48d9a9121cb59fd33ecef9ff2a34323422"
+checksum = "16607d5caffd1c07ce073528f9ed972d88db15dd44023fa57142963be3feb11f"
 dependencies = [
  "libc",
  "memchr",
  "ntapi",
  "objc2-core-foundation",
  "objc2-io-kit",
- "windows 0.61.1",
+ "windows",
 ]
 
 [[package]]
@@ -3239,11 +3178,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.17",
 ]
 
 [[package]]
@@ -3259,9 +3198,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3289,11 +3228,10 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
@@ -3303,14 +3241,14 @@ dependencies = [
  "socket2",
  "tokio-macros",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3319,9 +3257,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.13"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3680,6 +3618,17 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "uuid"
+version = "1.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+dependencies = [
+ "js-sys",
+ "serde",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -3745,6 +3694,51 @@ dependencies = [
  "wit-bindgen-rt",
 ]
 
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
+dependencies = [
+ "unicode-ident",
+]
+
 [[package]]
 name = "wayland-backend"
 version = "0.3.10"
@@ -3852,16 +3846,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
-[[package]]
-name = "windows"
-version = "0.57.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143"
-dependencies = [
- "windows-core 0.57.0",
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows"
 version = "0.61.1"
@@ -3869,7 +3853,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c5ee8f3d025738cb02bad7868bbb5f8a6327501e870bf51f1b455b0a2454a419"
 dependencies = [
  "windows-collections",
- "windows-core 0.61.0",
+ "windows-core",
  "windows-future",
  "windows-link 0.1.3",
  "windows-numerics",
@@ -3881,19 +3865,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
 dependencies = [
- "windows-core 0.61.0",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.57.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d"
-dependencies = [
- "windows-implement 0.57.0",
- "windows-interface 0.57.0",
- "windows-result 0.1.2",
- "windows-targets 0.52.6",
+ "windows-core",
 ]
 
 [[package]]
@@ -3902,8 +3874,8 @@ version = "0.61.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
 dependencies = [
- "windows-implement 0.60.0",
- "windows-interface 0.59.1",
+ "windows-implement",
+ "windows-interface",
  "windows-link 0.1.3",
  "windows-result 0.3.4",
  "windows-strings 0.4.2",
@@ -3915,21 +3887,10 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a1d6bbefcb7b60acd19828e1bc965da6fcf18a7e39490c5f8be71e54a19ba32"
 dependencies = [
- "windows-core 0.61.0",
+ "windows-core",
  "windows-link 0.1.3",
 ]
 
-[[package]]
-name = "windows-implement"
-version = "0.57.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "windows-implement"
 version = "0.60.0"
@@ -3941,17 +3902,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "windows-interface"
-version = "0.57.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "windows-interface"
 version = "0.59.1"
@@ -3981,7 +3931,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
 dependencies = [
- "windows-core 0.61.0",
+ "windows-core",
  "windows-link 0.1.3",
 ]
 
@@ -3996,15 +3946,6 @@ dependencies = [
  "windows-strings 0.5.1",
 ]
 
-[[package]]
-name = "windows-result"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e383302e8ec8515204254685643de10811af0ed97ea37210dc26fb0032647f8"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -4262,8 +4203,8 @@ name = "windows_plugin_authenticator"
 version = "0.0.0"
 dependencies = [
  "hex",
- "windows 0.61.1",
- "windows-core 0.61.0",
+ "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -4434,9 +4375,9 @@ dependencies = [
 
 [[package]]
 name = "zbus"
-version = "5.11.0"
+version = "5.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d07e46d035fb8e375b2ce63ba4e4ff90a7f73cf2ffb0138b29e1158d2eaadf7"
+checksum = "b622b18155f7a93d1cd2dc8c01d2d6a44e08fb9ebb7b3f9e6ed101488bad6c91"
 dependencies = [
  "async-broadcast",
  "async-executor",
@@ -4452,14 +4393,15 @@ dependencies = [
  "futures-core",
  "futures-lite",
  "hex",
- "nix 0.30.1",
+ "nix",
  "ordered-stream",
  "serde",
  "serde_repr",
  "tokio",
  "tracing",
  "uds_windows",
- "windows-sys 0.60.2",
+ "uuid",
+ "windows-sys 0.61.2",
  "winnow",
  "zbus_macros",
  "zbus_names",
@@ -4468,9 +4410,9 @@ dependencies = [
 
 [[package]]
 name = "zbus_macros"
-version = "5.11.0"
+version = "5.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57e797a9c847ed3ccc5b6254e8bcce056494b375b511b3d6edcec0aeb4defaca"
+checksum = "1cdb94821ca8a87ca9c298b5d1cbd80e2a8b67115d99f6e4551ac49e42b6a314"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
diff --git a/apps/desktop/desktop_native/Cargo.toml b/apps/desktop/desktop_native/Cargo.toml
index 0b09daa9bdd..26f791fd660 100644
--- a/apps/desktop/desktop_native/Cargo.toml
+++ b/apps/desktop/desktop_native/Cargo.toml
@@ -21,13 +21,13 @@ publish = false
 [workspace.dependencies]
 aes = "=0.8.4"
 aes-gcm = "=0.10.3"
-anyhow = "=1.0.94"
+anyhow = "=1.0.100"
 arboard = { version = "=3.6.1", default-features = false }
-ashpd = "=0.11.0"
+ashpd = "=0.12.0"
 base64 = "=0.22.1"
 bitwarden-russh = { git = "https://github.com/bitwarden/bitwarden-russh.git", rev = "a641316227227f8777fdf56ac9fa2d6b5f7fe662" }
 byteorder = "=1.5.0"
-bytes = "=1.10.1"
+bytes = "=1.11.0"
 cbc = "=0.1.2"
 chacha20poly1305 = "=0.10.1"
 core-foundation = "=0.10.1"
@@ -37,33 +37,33 @@ ed25519 = "=2.2.3"
 embed_plist = "=1.2.2"
 futures = "=0.3.31"
 hex = "=0.4.3"
-homedir = "=0.3.4"
+homedir = "=0.3.6"
 interprocess = "=2.2.1"
-libc = "=0.2.177"
+libc = "=0.2.178"
 linux-keyutils = "=0.2.4"
 memsec = "=0.7.0"
-napi = "=2.16.17"
-napi-build = "=2.2.0"
-napi-derive = "=2.16.13"
-oo7 = "=0.4.3"
+napi = "=3.3.0"
+napi-build = "=2.2.3"
+napi-derive = "=3.2.5"
+oo7 = "=0.5.0"
 pin-project = "=1.1.10"
 pkcs8 = "=0.10.2"
-rand = "=0.9.1"
+rand = "=0.9.2"
 rsa = "=0.9.6"
 russh-cryptovec = "=0.7.3"
 scopeguard = "=1.2.0"
 secmem-proc = "=0.3.7"
-security-framework = "=3.5.0"
+security-framework = "=3.5.1"
 security-framework-sys = "=2.15.0"
 serde = "=1.0.209"
 serde_json = "=1.0.127"
 sha2 = "=0.10.8"
 ssh-encoding = "=0.2.0"
 ssh-key = { version = "=0.6.7", default-features = false }
-sysinfo = "=0.35.0"
-thiserror = "=2.0.12"
-tokio = "=1.45.0"
-tokio-util = "=0.7.13"
+sysinfo = "=0.37.2"
+thiserror = "=2.0.17"
+tokio = "=1.48.0"
+tokio-util = "=0.7.17"
 tracing = "=0.1.41"
 tracing-subscriber = { version = "=0.3.20", features = [
     "fmt",
@@ -77,7 +77,7 @@ windows = "=0.61.1"
 windows-core = "=0.61.0"
 windows-future = "=0.2.0"
 windows-registry = "=0.6.1"
-zbus = "=5.11.0"
+zbus = "=5.12.0"
 zbus_polkit = "=5.0.0"
 zeroizing-alloc = "=0.1.0"
 
diff --git a/apps/desktop/desktop_native/build.js b/apps/desktop/desktop_native/build.js
index a7ed89a9c17..e267e28a08c 100644
--- a/apps/desktop/desktop_native/build.js
+++ b/apps/desktop/desktop_native/build.js
@@ -11,8 +11,8 @@ const rustTargetsMap = {
     "aarch64-pc-windows-msvc":    { nodeArch: 'arm64', platform: 'win32'  },
     "x86_64-apple-darwin":        { nodeArch: 'x64',   platform: 'darwin' },
     "aarch64-apple-darwin":       { nodeArch: 'arm64', platform: 'darwin' },
-    'x86_64-unknown-linux-musl':  { nodeArch: 'x64',   platform: 'linux'  },
-    'aarch64-unknown-linux-musl': { nodeArch: 'arm64', platform: 'linux'  },
+    'x86_64-unknown-linux-gnu':   { nodeArch: 'x64',   platform: 'linux'  },
+    'aarch64-unknown-linux-gnu':  { nodeArch: 'arm64', platform: 'linux'  },
 }
 
 // Ensure the dist directory exists
diff --git a/apps/desktop/desktop_native/chromium_importer/src/chromium/mod.rs b/apps/desktop/desktop_native/chromium_importer/src/chromium/mod.rs
index e57b40b5778..7011a2cce63 100644
--- a/apps/desktop/desktop_native/chromium_importer/src/chromium/mod.rs
+++ b/apps/desktop/desktop_native/chromium_importer/src/chromium/mod.rs
@@ -61,8 +61,8 @@ impl InstalledBrowserRetriever for DefaultInstalledBrowserRetriever {
         let mut browsers = Vec::with_capacity(SUPPORTED_BROWSER_MAP.len());
 
         for (browser, config) in SUPPORTED_BROWSER_MAP.iter() {
-            let data_dir = get_browser_data_dir(config)?;
-            if data_dir.exists() {
+            let data_dir = get_and_validate_data_dir(config);
+            if data_dir.is_ok() {
                 browsers.push((*browser).to_string());
             }
         }
@@ -114,7 +114,7 @@ pub async fn import_logins(
 #[derive(Debug, Clone, Copy)]
 pub(crate) struct BrowserConfig {
     pub name: &'static str,
-    pub data_dir: &'static str,
+    pub data_dir: &'static [&'static str],
 }
 
 pub(crate) static SUPPORTED_BROWSER_MAP: LazyLock<
@@ -126,11 +126,19 @@ pub(crate) static SUPPORTED_BROWSER_MAP: LazyLock<
         .collect::<std::collections::HashMap<_, _>>()
 });
 
-fn get_browser_data_dir(config: &BrowserConfig) -> Result<PathBuf> {
-    let dir = dirs::home_dir()
-        .ok_or_else(|| anyhow!("Home directory not found"))?
-        .join(config.data_dir);
-    Ok(dir)
+fn get_and_validate_data_dir(config: &BrowserConfig) -> Result<PathBuf> {
+    for data_dir in config.data_dir.iter() {
+        let dir = dirs::home_dir()
+            .ok_or_else(|| anyhow!("Home directory not found"))?
+            .join(data_dir);
+        if dir.exists() {
+            return Ok(dir);
+        }
+    }
+    Err(anyhow!(
+        "Browser user data directory '{:?}' not found",
+        config.data_dir
+    ))
 }
 
 //
@@ -174,13 +182,7 @@ fn load_local_state_for_browser(browser_name: &String) -> Result<(PathBuf, Local
         .get(browser_name.as_str())
         .ok_or_else(|| anyhow!("Unsupported browser: {}", browser_name))?;
 
-    let data_dir = get_browser_data_dir(config)?;
-    if !data_dir.exists() {
-        return Err(anyhow!(
-            "Browser user data directory '{}' not found",
-            data_dir.display()
-        ));
-    }
+    let data_dir = get_and_validate_data_dir(config)?;
 
     let local_state = load_local_state(&data_dir)?;
 
diff --git a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/linux.rs b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/linux.rs
index 14e38797640..f542e23129a 100644
--- a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/linux.rs
+++ b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/linux.rs
@@ -18,19 +18,22 @@ use crate::{
 pub(crate) const SUPPORTED_BROWSERS: &[BrowserConfig] = &[
     BrowserConfig {
         name: "Chrome",
-        data_dir: ".config/google-chrome",
+        data_dir: &[".config/google-chrome"],
     },
     BrowserConfig {
         name: "Chromium",
-        data_dir: "snap/chromium/common/chromium",
+        data_dir: &["snap/chromium/common/chromium"],
     },
     BrowserConfig {
         name: "Brave",
-        data_dir: "snap/brave/current/.config/BraveSoftware/Brave-Browser",
+        data_dir: &[
+            "snap/brave/current/.config/BraveSoftware/Brave-Browser",
+            ".config/BraveSoftware/Brave-Browser",
+        ],
     },
     BrowserConfig {
         name: "Opera",
-        data_dir: "snap/opera/current/.config/opera",
+        data_dir: &["snap/opera/current/.config/opera", ".config/opera"],
     },
 ];
 
diff --git a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/macos.rs b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/macos.rs
index 5d0b4f0c75c..6cd746d60b6 100644
--- a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/macos.rs
+++ b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/macos.rs
@@ -14,31 +14,31 @@ use crate::{
 pub(crate) const SUPPORTED_BROWSERS: &[BrowserConfig] = &[
     BrowserConfig {
         name: "Chrome",
-        data_dir: "Library/Application Support/Google/Chrome",
+        data_dir: &["Library/Application Support/Google/Chrome"],
     },
     BrowserConfig {
         name: "Chromium",
-        data_dir: "Library/Application Support/Chromium",
+        data_dir: &["Library/Application Support/Chromium"],
     },
     BrowserConfig {
         name: "Microsoft Edge",
-        data_dir: "Library/Application Support/Microsoft Edge",
+        data_dir: &["Library/Application Support/Microsoft Edge"],
     },
     BrowserConfig {
         name: "Brave",
-        data_dir: "Library/Application Support/BraveSoftware/Brave-Browser",
+        data_dir: &["Library/Application Support/BraveSoftware/Brave-Browser"],
     },
     BrowserConfig {
         name: "Arc",
-        data_dir: "Library/Application Support/Arc/User Data",
+        data_dir: &["Library/Application Support/Arc/User Data"],
     },
     BrowserConfig {
         name: "Opera",
-        data_dir: "Library/Application Support/com.operasoftware.Opera",
+        data_dir: &["Library/Application Support/com.operasoftware.Opera"],
     },
     BrowserConfig {
         name: "Vivaldi",
-        data_dir: "Library/Application Support/Vivaldi",
+        data_dir: &["Library/Application Support/Vivaldi"],
     },
 ];
 
diff --git a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/windows/mod.rs b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/windows/mod.rs
index 9cc89ed2161..524b5994873 100644
--- a/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/windows/mod.rs
+++ b/apps/desktop/desktop_native/chromium_importer/src/chromium/platform/windows/mod.rs
@@ -25,27 +25,27 @@ pub use signature::*;
 pub(crate) const SUPPORTED_BROWSERS: &[BrowserConfig] = &[
     BrowserConfig {
         name: "Brave",
-        data_dir: "AppData/Local/BraveSoftware/Brave-Browser/User Data",
+        data_dir: &["AppData/Local/BraveSoftware/Brave-Browser/User Data"],
     },
     BrowserConfig {
         name: "Chrome",
-        data_dir: "AppData/Local/Google/Chrome/User Data",
+        data_dir: &["AppData/Local/Google/Chrome/User Data"],
     },
     BrowserConfig {
         name: "Chromium",
-        data_dir: "AppData/Local/Chromium/User Data",
+        data_dir: &["AppData/Local/Chromium/User Data"],
     },
     BrowserConfig {
         name: "Microsoft Edge",
-        data_dir: "AppData/Local/Microsoft/Edge/User Data",
+        data_dir: &["AppData/Local/Microsoft/Edge/User Data"],
     },
     BrowserConfig {
         name: "Opera",
-        data_dir: "AppData/Roaming/Opera Software/Opera Stable",
+        data_dir: &["AppData/Roaming/Opera Software/Opera Stable"],
     },
     BrowserConfig {
         name: "Vivaldi",
-        data_dir: "AppData/Local/Vivaldi/User Data",
+        data_dir: &["AppData/Local/Vivaldi/User Data"],
     },
 ];
 
diff --git a/apps/desktop/desktop_native/chromium_importer/src/metadata.rs b/apps/desktop/desktop_native/chromium_importer/src/metadata.rs
index 51a181f7f49..9aa2cea6e5e 100644
--- a/apps/desktop/desktop_native/chromium_importer/src/metadata.rs
+++ b/apps/desktop/desktop_native/chromium_importer/src/metadata.rs
@@ -7,9 +7,9 @@ pub struct NativeImporterMetadata {
     /// Identifies the importer
     pub id: String,
     /// Describes the strategies used to obtain imported data
-    pub loaders: Vec<&'static str>,
+    pub loaders: Vec<String>,
     /// Identifies the instructions for the importer
-    pub instructions: &'static str,
+    pub instructions: String,
 }
 
 /// Returns a map of supported importers based on the current platform.
@@ -36,9 +36,9 @@ pub fn get_supported_importers<T: InstalledBrowserRetriever>(
         PLATFORM_SUPPORTED_BROWSERS.iter().map(|b| b.name).collect();
 
     for (id, browser_name) in IMPORTERS {
-        let mut loaders: Vec<&'static str> = vec!["file"];
+        let mut loaders: Vec<String> = vec!["file".to_string()];
         if supported.contains(browser_name) {
-            loaders.push("chromium");
+            loaders.push("chromium".to_string());
         }
 
         if installed_browsers.contains(&browser_name.to_string()) {
@@ -47,7 +47,7 @@ pub fn get_supported_importers<T: InstalledBrowserRetriever>(
                 NativeImporterMetadata {
                     id: id.to_string(),
                     loaders,
-                    instructions: "chromium",
+                    instructions: "chromium".to_string(),
                 },
             );
         }
@@ -79,12 +79,9 @@ mod tests {
         map.keys().cloned().collect()
     }
 
-    fn get_loaders(
-        map: &HashMap<String, NativeImporterMetadata>,
-        id: &str,
-    ) -> HashSet<&'static str> {
+    fn get_loaders(map: &HashMap<String, NativeImporterMetadata>, id: &str) -> HashSet<String> {
         map.get(id)
-            .map(|m| m.loaders.iter().copied().collect::<HashSet<_>>())
+            .map(|m| m.loaders.iter().cloned().collect::<HashSet<_>>())
             .unwrap_or_default()
     }
 
@@ -107,7 +104,7 @@ mod tests {
         for (key, meta) in map.iter() {
             assert_eq!(&meta.id, key);
             assert_eq!(meta.instructions, "chromium");
-            assert!(meta.loaders.contains(&"file"));
+            assert!(meta.loaders.contains(&"file".to_owned()));
         }
     }
 
@@ -147,7 +144,7 @@ mod tests {
         for (key, meta) in map.iter() {
             assert_eq!(&meta.id, key);
             assert_eq!(meta.instructions, "chromium");
-            assert!(meta.loaders.contains(&"file"));
+            assert!(meta.loaders.contains(&"file".to_owned()));
         }
     }
 
@@ -183,7 +180,7 @@ mod tests {
         for (key, meta) in map.iter() {
             assert_eq!(&meta.id, key);
             assert_eq!(meta.instructions, "chromium");
-            assert!(meta.loaders.contains(&"file"));
+            assert!(meta.loaders.contains(&"file".to_owned()));
         }
     }
 
diff --git a/apps/desktop/desktop_native/core/src/biometric_v2/windows.rs b/apps/desktop/desktop_native/core/src/biometric_v2/windows.rs
index 32d2eb7e6e6..669dd757c40 100644
--- a/apps/desktop/desktop_native/core/src/biometric_v2/windows.rs
+++ b/apps/desktop/desktop_native/core/src/biometric_v2/windows.rs
@@ -285,8 +285,8 @@ async fn windows_hello_authenticate_with_crypto(
         return Err(anyhow!("Failed to sign data"));
     }
 
-    let signature_buffer = signature.Result()?;
-    let signature_value = unsafe { as_mut_bytes(&signature_buffer)? };
+    let mut signature_buffer = signature.Result()?;
+    let signature_value = unsafe { as_mut_bytes(&mut signature_buffer)? };
 
     // The signature is deterministic based on the challenge and keychain key. Thus, it can be
     // hashed to a key. It is unclear what entropy this key provides.
@@ -368,7 +368,7 @@ fn decrypt_data(
     Ok(plaintext)
 }
 
-unsafe fn as_mut_bytes(buffer: &IBuffer) -> Result<&mut [u8]> {
+unsafe fn as_mut_bytes(buffer: &mut IBuffer) -> Result<&mut [u8]> {
     let interop = buffer.cast::<IBufferByteAccess>()?;
 
     unsafe {
diff --git a/apps/desktop/desktop_native/macos_provider/Cargo.toml b/apps/desktop/desktop_native/macos_provider/Cargo.toml
index 50f1834851d..8a34460268a 100644
--- a/apps/desktop/desktop_native/macos_provider/Cargo.toml
+++ b/apps/desktop/desktop_native/macos_provider/Cargo.toml
@@ -24,7 +24,7 @@ serde_json = { workspace = true }
 tokio = { workspace = true, features = ["sync"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
-tracing-oslog = "0.3.0"
+tracing-oslog = "=0.3.0"
 
 [build-dependencies]
 uniffi = { workspace = true, features = ["build"] }
diff --git a/apps/desktop/desktop_native/macos_provider/README.md b/apps/desktop/desktop_native/macos_provider/README.md
new file mode 100644
index 00000000000..1d4c1902465
--- /dev/null
+++ b/apps/desktop/desktop_native/macos_provider/README.md
@@ -0,0 +1,35 @@
+# Explainer: Mac OS Native Passkey Provider
+
+This document describes the changes introduced in https://github.com/bitwarden/clients/pull/13963, where we introduce the MacOS Native Passkey Provider. It gives the high level explanation of the architecture and some of the quirks and additional good to know context.
+
+## The high level
+MacOS has native APIs (similar to iOS) to allow Credential Managers to provide credentials to the MacOS autofill system (in the PR referenced above, we only provide passkeys).
+
+We’ve written a Swift-based native autofill-extension. It’s bundled in the app-bundle in PlugIns, similar to the safari-extension.
+
+This swift extension currently communicates with our Electron app through IPC based on a unix socket. The IPC implementation is done in Rust and utilized through UniFFI + NAPI bindings.
+
+Footnotes:
+
+* We're not using the IPC framework as the implementation pre-dates the IPC framework.
+* Alternatives like XPC or CFMessagePort may have better support for when the app is sandboxed. 
+
+Electron receives the messages and passes it to Angular (through the electron-renderer event system).
+
+Our existing fido2 services in the renderer respond to events, displaying UI as necessary, and returns the signature back through the same mechanism, allowing people to authenticate with passkeys through the native system + UI. See [Mac OS Native Passkey Workflows](https://bitwarden.atlassian.net/wiki/spaces/EN/pages/1828356098/Mac+OS+Native+Passkey+Workflows) for demo videos.
+
+## Typescript + UI implementations
+
+We utilize the same FIDO2 implementation and interface that is already present for our browser authentication. It was designed by @coroiu with multiple ‘ui environments' in mind.
+
+Therefore, a lot of the plumbing is implemented in /autofill/services/desktop-fido2-user-interface.service.ts, which implements the interface that our fido2 authenticator/client expects to drive UI related behaviors. 
+
+We’ve also implemented a couple FIDO2 UI components to handle registration/sign in flows, but also improved the “modal mode” of the desktop app.
+
+## Modal mode
+
+When modal mode is activated, the desktop app turns into a smaller modal that is always on top and cannot be resized. This is done to improve the UX of performing a passkey operation (or SSH operation). Once the operation is completed, the app returns to normal mode and its previous position.
+
+We are not using electron modal windows, for a couple reason. It would require us to send data in yet another layer of IPC, but also because we'd need to bootstrap entire renderer/app instead of reusing the existing window.
+
+Some modal modes may hide the 'traffic buttons' (window controls) due to design requirements.
diff --git a/apps/desktop/desktop_native/macos_provider/build.sh b/apps/desktop/desktop_native/macos_provider/build.sh
index 21e2e045af4..2f7a2d03541 100755
--- a/apps/desktop/desktop_native/macos_provider/build.sh
+++ b/apps/desktop/desktop_native/macos_provider/build.sh
@@ -8,6 +8,9 @@ rm -r tmp
 mkdir -p ./tmp/target/universal-darwin/release/
 
 
+rustup target add aarch64-apple-darwin
+rustup target add x86_64-apple-darwin
+
 cargo build --package macos_provider --target aarch64-apple-darwin --release
 cargo build --package macos_provider --target x86_64-apple-darwin --release
 
diff --git a/apps/desktop/desktop_native/macos_provider/src/lib.rs b/apps/desktop/desktop_native/macos_provider/src/lib.rs
index a5a134b0bfe..8619a77a0f2 100644
--- a/apps/desktop/desktop_native/macos_provider/src/lib.rs
+++ b/apps/desktop/desktop_native/macos_provider/src/lib.rs
@@ -57,6 +57,14 @@ trait Callback: Send + Sync {
     fn error(&self, error: BitwardenError);
 }
 
+#[derive(uniffi::Enum, Debug)]
+/// Store the connection status between the macOS credential provider extension
+/// and the desktop application's IPC server.
+pub enum ConnectionStatus {
+    Connected,
+    Disconnected,
+}
+
 #[derive(uniffi::Object)]
 pub struct MacOSProviderClient {
     to_server_send: tokio::sync::mpsc::Sender<String>,
@@ -65,8 +73,24 @@ pub struct MacOSProviderClient {
     response_callbacks_counter: AtomicU32,
     #[allow(clippy::type_complexity)]
     response_callbacks_queue: Arc<Mutex<HashMap<u32, (Box<dyn Callback>, Instant)>>>,
+
+    // Flag to track connection status - atomic for thread safety without locks
+    connection_status: Arc<std::sync::atomic::AtomicBool>,
 }
 
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+/// Store native desktop status information to use for IPC communication
+/// between the application and the macOS credential provider.
+pub struct NativeStatus {
+    key: String,
+    value: String,
+}
+
+// In our callback management, 0 is a reserved sequence number indicating that a message does not
+// have a callback.
+const NO_CALLBACK_INDICATOR: u32 = 0;
+
 #[uniffi::export]
 impl MacOSProviderClient {
     // FIXME: Remove unwraps! They panic and terminate the whole application.
@@ -93,13 +117,16 @@ impl MacOSProviderClient {
 
         let client = MacOSProviderClient {
             to_server_send,
-            response_callbacks_counter: AtomicU32::new(0),
+            response_callbacks_counter: AtomicU32::new(1), /* Start at 1 since 0 is reserved for
+                                                            * "no callback" scenarios */
             response_callbacks_queue: Arc::new(Mutex::new(HashMap::new())),
+            connection_status: Arc::new(std::sync::atomic::AtomicBool::new(false)),
         };
 
         let path = desktop_core::ipc::path("af");
 
         let queue = client.response_callbacks_queue.clone();
+        let connection_status = client.connection_status.clone();
 
         std::thread::spawn(move || {
             let rt = tokio::runtime::Builder::new_current_thread()
@@ -117,9 +144,11 @@ impl MacOSProviderClient {
                     match serde_json::from_str::<SerializedMessage>(&message) {
                         Ok(SerializedMessage::Command(CommandMessage::Connected)) => {
                             info!("Connected to server");
+                            connection_status.store(true, std::sync::atomic::Ordering::Relaxed);
                         }
                         Ok(SerializedMessage::Command(CommandMessage::Disconnected)) => {
                             info!("Disconnected from server");
+                            connection_status.store(false, std::sync::atomic::Ordering::Relaxed);
                         }
                         Ok(SerializedMessage::Message {
                             sequence_number,
@@ -157,12 +186,17 @@ impl MacOSProviderClient {
         client
     }
 
+    pub fn send_native_status(&self, key: String, value: String) {
+        let status = NativeStatus { key, value };
+        self.send_message(status, None);
+    }
+
     pub fn prepare_passkey_registration(
         &self,
         request: PasskeyRegistrationRequest,
         callback: Arc<dyn PreparePasskeyRegistrationCallback>,
     ) {
-        self.send_message(request, Box::new(callback));
+        self.send_message(request, Some(Box::new(callback)));
     }
 
     pub fn prepare_passkey_assertion(
@@ -170,7 +204,7 @@ impl MacOSProviderClient {
         request: PasskeyAssertionRequest,
         callback: Arc<dyn PreparePasskeyAssertionCallback>,
     ) {
-        self.send_message(request, Box::new(callback));
+        self.send_message(request, Some(Box::new(callback)));
     }
 
     pub fn prepare_passkey_assertion_without_user_interface(
@@ -178,7 +212,18 @@ impl MacOSProviderClient {
         request: PasskeyAssertionWithoutUserInterfaceRequest,
         callback: Arc<dyn PreparePasskeyAssertionCallback>,
     ) {
-        self.send_message(request, Box::new(callback));
+        self.send_message(request, Some(Box::new(callback)));
+    }
+
+    pub fn get_connection_status(&self) -> ConnectionStatus {
+        let is_connected = self
+            .connection_status
+            .load(std::sync::atomic::Ordering::Relaxed);
+        if is_connected {
+            ConnectionStatus::Connected
+        } else {
+            ConnectionStatus::Disconnected
+        }
     }
 }
 
@@ -200,7 +245,6 @@ enum SerializedMessage {
 }
 
 impl MacOSProviderClient {
-    // FIXME: Remove unwraps! They panic and terminate the whole application.
     #[allow(clippy::unwrap_used)]
     fn add_callback(&self, callback: Box<dyn Callback>) -> u32 {
         let sequence_number = self
@@ -209,20 +253,23 @@ impl MacOSProviderClient {
 
         self.response_callbacks_queue
             .lock()
-            .unwrap()
+            .expect("response callbacks queue mutex should not be poisoned")
             .insert(sequence_number, (callback, Instant::now()));
 
         sequence_number
     }
 
-    // FIXME: Remove unwraps! They panic and terminate the whole application.
     #[allow(clippy::unwrap_used)]
     fn send_message(
         &self,
         message: impl Serialize + DeserializeOwned,
-        callback: Box<dyn Callback>,
+        callback: Option<Box<dyn Callback>>,
     ) {
-        let sequence_number = self.add_callback(callback);
+        let sequence_number = if let Some(callback) = callback {
+            self.add_callback(callback)
+        } else {
+            NO_CALLBACK_INDICATOR
+        };
 
         let message = serde_json::to_string(&SerializedMessage::Message {
             sequence_number,
@@ -232,15 +279,17 @@ impl MacOSProviderClient {
 
         if let Err(e) = self.to_server_send.blocking_send(message) {
             // Make sure we remove the callback from the queue if we can't send the message
-            if let Some((cb, _)) = self
-                .response_callbacks_queue
-                .lock()
-                .unwrap()
-                .remove(&sequence_number)
-            {
-                cb.error(BitwardenError::Internal(format!(
-                    "Error sending message: {e}"
-                )));
+            if sequence_number != NO_CALLBACK_INDICATOR {
+                if let Some((callback, _)) = self
+                    .response_callbacks_queue
+                    .lock()
+                    .expect("response callbacks queue mutex should not be poisoned")
+                    .remove(&sequence_number)
+                {
+                    callback.error(BitwardenError::Internal(format!(
+                        "Error sending message: {e}"
+                    )));
+                }
             }
         }
     }
diff --git a/apps/desktop/desktop_native/macos_provider/src/registration.rs b/apps/desktop/desktop_native/macos_provider/src/registration.rs
index 9e697b75c16..c961566a86c 100644
--- a/apps/desktop/desktop_native/macos_provider/src/registration.rs
+++ b/apps/desktop/desktop_native/macos_provider/src/registration.rs
@@ -14,6 +14,7 @@ pub struct PasskeyRegistrationRequest {
     user_verification: UserVerification,
     supported_algorithms: Vec<i32>,
     window_xy: Position,
+    excluded_credentials: Vec<Vec<u8>>,
 }
 
 #[derive(uniffi::Record, Serialize, Deserialize)]
diff --git a/apps/desktop/desktop_native/napi/index.d.ts b/apps/desktop/desktop_native/napi/index.d.ts
index 01bfa65d571..375c65edb8d 100644
--- a/apps/desktop/desktop_native/napi/index.d.ts
+++ b/apps/desktop/desktop_native/napi/index.d.ts
@@ -1,125 +1,7 @@
-/* tslint:disable */
-/* eslint-disable */
-
 /* auto-generated by NAPI-RS */
-
-export declare namespace passwords {
-  /** The error message returned when a password is not found during retrieval or deletion. */
-  export const PASSWORD_NOT_FOUND: string
-  /**
-   * Fetch the stored password from the keychain.
-   * Throws {@link Error} with message {@link PASSWORD_NOT_FOUND} if the password does not exist.
-   */
-  export function getPassword(service: string, account: string): Promise<string>
-  /**
-   * Save the password to the keychain. Adds an entry if none exists otherwise updates the
-   * existing entry.
-   */
-  export function setPassword(service: string, account: string, password: string): Promise<void>
-  /**
-   * Delete the stored password from the keychain.
-   * Throws {@link Error} with message {@link PASSWORD_NOT_FOUND} if the password does not exist.
-   */
-  export function deletePassword(service: string, account: string): Promise<void>
-  /** Checks if the os secure storage is available */
-  export function isAvailable(): Promise<boolean>
-}
-export declare namespace biometrics {
-  export function prompt(hwnd: Buffer, message: string): Promise<boolean>
-  export function available(): Promise<boolean>
-  export function setBiometricSecret(service: string, account: string, secret: string, keyMaterial: KeyMaterial | undefined | null, ivB64: string): Promise<string>
-  /**
-   * Retrieves the biometric secret for the given service and account.
-   * Throws Error with message [`passwords::PASSWORD_NOT_FOUND`] if the secret does not exist.
-   */
-  export function getBiometricSecret(service: string, account: string, keyMaterial?: KeyMaterial | undefined | null): Promise<string>
-  /**
-   * Derives key material from biometric data. Returns a string encoded with a
-   * base64 encoded key and the base64 encoded challenge used to create it
-   * separated by a `|` character.
-   *
-   * If the iv is provided, it will be used as the challenge. Otherwise a random challenge will
-   * be generated.
-   *
-   * `format!("<key_base64>|<iv_base64>")`
-   */
-  export function deriveKeyMaterial(iv?: string | undefined | null): Promise<OsDerivedKey>
-  export interface KeyMaterial {
-    osKeyPartB64: string
-    clientKeyPartB64?: string
-  }
-  export interface OsDerivedKey {
-    keyB64: string
-    ivB64: string
-  }
-}
-export declare namespace biometrics_v2 {
-  export function initBiometricSystem(): BiometricLockSystem
-  export function authenticate(biometricLockSystem: BiometricLockSystem, hwnd: Buffer, message: string): Promise<boolean>
-  export function authenticateAvailable(biometricLockSystem: BiometricLockSystem): Promise<boolean>
-  export function enrollPersistent(biometricLockSystem: BiometricLockSystem, userId: string, key: Buffer): Promise<void>
-  export function provideKey(biometricLockSystem: BiometricLockSystem, userId: string, key: Buffer): Promise<void>
-  export function unlock(biometricLockSystem: BiometricLockSystem, userId: string, hwnd: Buffer): Promise<Buffer>
-  export function unlockAvailable(biometricLockSystem: BiometricLockSystem, userId: string): Promise<boolean>
-  export function hasPersistent(biometricLockSystem: BiometricLockSystem, userId: string): Promise<boolean>
-  export function unenroll(biometricLockSystem: BiometricLockSystem, userId: string): Promise<void>
-  export class BiometricLockSystem {   }
-}
-export declare namespace clipboards {
-  export function read(): Promise<string>
-  export function write(text: string, password: boolean): Promise<void>
-}
-export declare namespace sshagent {
-  export interface PrivateKey {
-    privateKey: string
-    name: string
-    cipherId: string
-  }
-  export interface SshKey {
-    privateKey: string
-    publicKey: string
-    keyFingerprint: string
-  }
-  export interface SshUiRequest {
-    cipherId?: string
-    isList: boolean
-    processName: string
-    isForwarding: boolean
-    namespace?: string
-  }
-  export function serve(callback: (err: Error | null, arg: SshUiRequest) => any): Promise<SshAgentState>
-  export function stop(agentState: SshAgentState): void
-  export function isRunning(agentState: SshAgentState): boolean
-  export function setKeys(agentState: SshAgentState, newKeys: Array<PrivateKey>): void
-  export function lock(agentState: SshAgentState): void
-  export function clearKeys(agentState: SshAgentState): void
-  export class SshAgentState {   }
-}
-export declare namespace processisolations {
-  export function disableCoredumps(): Promise<void>
-  export function isCoreDumpingDisabled(): Promise<boolean>
-  export function isolateProcess(): Promise<void>
-}
-export declare namespace powermonitors {
-  export function onLock(callback: (err: Error | null, ) => any): Promise<void>
-  export function isLockMonitorAvailable(): Promise<boolean>
-}
-export declare namespace windows_registry {
-  export function createKey(key: string, subkey: string, value: string): Promise<void>
-  export function deleteKey(key: string, subkey: string): Promise<void>
-}
-export declare namespace ipc {
-  export interface IpcMessage {
-    clientId: number
-    kind: IpcMessageType
-    message?: string
-  }
-  export const enum IpcMessageType {
-    Connected = 0,
-    Disconnected = 1,
-    Message = 2
-  }
-  export class IpcServer {
+/* eslint-disable */
+export declare namespace autofill {
+  export class AutofillIpcServer {
     /**
      * Create and start the IPC server without blocking.
      *
@@ -127,49 +9,18 @@ export declare namespace ipc {
      * connection and must be the same for both the server and client. @param callback
      * This function will be called whenever a message is received from a client.
      */
-    static listen(name: string, callback: (error: null | Error, message: IpcMessage) => void): Promise<IpcServer>
+    static listen(name: string, registrationCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyRegistrationRequest) => void, assertionCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionRequest) => void, assertionWithoutUserInterfaceCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionWithoutUserInterfaceRequest) => void, nativeStatusCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: NativeStatus) => void): Promise<AutofillIpcServer>
     /** Return the path to the IPC server. */
     getPath(): string
     /** Stop the IPC server. */
     stop(): void
-    /**
-     * Send a message over the IPC server to all the connected clients
-     *
-     * @return The number of clients that the message was sent to. Note that the number of
-     * messages actually received may be less, as some clients could disconnect before
-     * receiving the message.
-     */
-    send(message: string): number
+    completeRegistration(clientId: number, sequenceNumber: number, response: PasskeyRegistrationResponse): number
+    completeAssertion(clientId: number, sequenceNumber: number, response: PasskeyAssertionResponse): number
+    completeError(clientId: number, sequenceNumber: number, error: string): number
   }
-}
-export declare namespace autostart {
-  export function setAutostart(autostart: boolean, params: Array<string>): Promise<void>
-}
-export declare namespace autofill {
-  export function runCommand(value: string): Promise<string>
-  export const enum UserVerification {
-    Preferred = 'preferred',
-    Required = 'required',
-    Discouraged = 'discouraged'
-  }
-  export interface Position {
-    x: number
-    y: number
-  }
-  export interface PasskeyRegistrationRequest {
-    rpId: string
-    userName: string
-    userHandle: Array<number>
-    clientDataHash: Array<number>
-    userVerification: UserVerification
-    supportedAlgorithms: Array<number>
-    windowXy: Position
-  }
-  export interface PasskeyRegistrationResponse {
-    rpId: string
-    clientDataHash: Array<number>
-    credentialId: Array<number>
-    attestationObject: Array<number>
+  export interface NativeStatus {
+    key: string
+    value: string
   }
   export interface PasskeyAssertionRequest {
     rpId: string
@@ -178,6 +29,14 @@ export declare namespace autofill {
     allowedCredentials: Array<Array<number>>
     windowXy: Position
   }
+  export interface PasskeyAssertionResponse {
+    rpId: string
+    userHandle: Array<number>
+    signature: Array<number>
+    clientDataHash: Array<number>
+    authenticatorData: Array<number>
+    credentialId: Array<number>
+  }
   export interface PasskeyAssertionWithoutUserInterfaceRequest {
     rpId: string
     credentialId: Array<number>
@@ -188,50 +47,93 @@ export declare namespace autofill {
     userVerification: UserVerification
     windowXy: Position
   }
-  export interface PasskeyAssertionResponse {
+  export interface PasskeyRegistrationRequest {
     rpId: string
+    userName: string
     userHandle: Array<number>
-    signature: Array<number>
     clientDataHash: Array<number>
-    authenticatorData: Array<number>
+    userVerification: UserVerification
+    supportedAlgorithms: Array<number>
+    windowXy: Position
+    excludedCredentials: Array<Array<number>>
+  }
+  export interface PasskeyRegistrationResponse {
+    rpId: string
+    clientDataHash: Array<number>
     credentialId: Array<number>
+    attestationObject: Array<number>
   }
-  export class IpcServer {
-    /**
-     * Create and start the IPC server without blocking.
-     *
-     * @param name The endpoint name to listen on. This name uniquely identifies the IPC
-     * connection and must be the same for both the server and client. @param callback
-     * This function will be called whenever a message is received from a client.
-     */
-    static listen(name: string, registrationCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyRegistrationRequest) => void, assertionCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionRequest) => void, assertionWithoutUserInterfaceCallback: (error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionWithoutUserInterfaceRequest) => void): Promise<IpcServer>
-    /** Return the path to the IPC server. */
-    getPath(): string
-    /** Stop the IPC server. */
-    stop(): void
-    completeRegistration(clientId: number, sequenceNumber: number, response: PasskeyRegistrationResponse): number
-    completeAssertion(clientId: number, sequenceNumber: number, response: PasskeyAssertionResponse): number
-    completeError(clientId: number, sequenceNumber: number, error: string): number
+  export interface Position {
+    x: number
+    y: number
+  }
+  export function runCommand(value: string): Promise<string>
+  export const enum UserVerification {
+    Preferred = 'preferred',
+    Required = 'required',
+    Discouraged = 'discouraged'
   }
 }
-export declare namespace passkey_authenticator {
-  export function register(): void
+
+export declare namespace autostart {
+  export function setAutostart(autostart: boolean, params: Array<string>): Promise<void>
 }
-export declare namespace logging {
-  export const enum LogLevel {
-    Trace = 0,
-    Debug = 1,
-    Info = 2,
-    Warn = 3,
-    Error = 4
+
+export declare namespace autotype {
+  export function getForegroundWindowTitle(): string
+  export function typeInput(input: Array<number>, keyboardShortcut: Array<string>): void
+}
+
+export declare namespace biometrics {
+  export function available(): Promise<boolean>
+  /**
+   * Derives key material from biometric data. Returns a string encoded with a
+   * base64 encoded key and the base64 encoded challenge used to create it
+   * separated by a `|` character.
+   *
+   * If the iv is provided, it will be used as the challenge. Otherwise a random challenge will
+   * be generated.
+   *
+   * `format!("<key_base64>|<iv_base64>")`
+   */
+  export function deriveKeyMaterial(iv?: string | undefined | null): Promise<OsDerivedKey>
+  /**
+   * Retrieves the biometric secret for the given service and account.
+   * Throws Error with message [`passwords::PASSWORD_NOT_FOUND`] if the secret does not exist.
+   */
+  export function getBiometricSecret(service: string, account: string, keyMaterial?: KeyMaterial | undefined | null): Promise<string>
+  export interface KeyMaterial {
+    osKeyPartB64: string
+    clientKeyPartB64?: string
   }
-  export function initNapiLog(jsLogFn: (err: Error | null, arg0: LogLevel, arg1: string) => any): void
+  export interface OsDerivedKey {
+    keyB64: string
+    ivB64: string
+  }
+  export function prompt(hwnd: Buffer, message: string): Promise<boolean>
+  export function setBiometricSecret(service: string, account: string, secret: string, keyMaterial: KeyMaterial | undefined | null, ivB64: string): Promise<string>
 }
+
+export declare namespace biometrics_v2 {
+  export class BiometricLockSystem {
+
+  }
+  export function authenticate(biometricLockSystem: BiometricLockSystem, hwnd: Buffer, message: string): Promise<boolean>
+  export function authenticateAvailable(biometricLockSystem: BiometricLockSystem): Promise<boolean>
+  export function enrollPersistent(biometricLockSystem: BiometricLockSystem, userId: string, key: Buffer): Promise<void>
+  export function hasPersistent(biometricLockSystem: BiometricLockSystem, userId: string): Promise<boolean>
+  export function initBiometricSystem(): BiometricLockSystem
+  export function provideKey(biometricLockSystem: BiometricLockSystem, userId: string, key: Buffer): Promise<void>
+  export function unenroll(biometricLockSystem: BiometricLockSystem, userId: string): Promise<void>
+  export function unlock(biometricLockSystem: BiometricLockSystem, userId: string, hwnd: Buffer): Promise<Buffer>
+  export function unlockAvailable(biometricLockSystem: BiometricLockSystem, userId: string): Promise<boolean>
+}
+
 export declare namespace chromium_importer {
-  export interface ProfileInfo {
-    id: string
-    name: string
-  }
+  export function getAvailableProfiles(browser: string): Array<ProfileInfo>
+  /** Returns OS aware metadata describing supported Chromium based importers as a JSON string. */
+  export function getMetadata(): Record<string, NativeImporterMetadata>
+  export function importLogins(browser: string, profileId: string): Promise<Array<LoginImportResult>>
   export interface Login {
     url: string
     username: string
@@ -252,12 +154,130 @@ export declare namespace chromium_importer {
     loaders: Array<string>
     instructions: string
   }
-  /** Returns OS aware metadata describing supported Chromium based importers as a JSON string. */
-  export function getMetadata(): Record<string, NativeImporterMetadata>
-  export function getAvailableProfiles(browser: string): Array<ProfileInfo>
-  export function importLogins(browser: string, profileId: string): Promise<Array<LoginImportResult>>
+  export interface ProfileInfo {
+    id: string
+    name: string
+  }
 }
-export declare namespace autotype {
-  export function getForegroundWindowTitle(): string
-  export function typeInput(input: Array<number>, keyboardShortcut: Array<string>): void
+
+export declare namespace clipboards {
+  export function read(): Promise<string>
+  export function write(text: string, password: boolean): Promise<void>
+}
+
+export declare namespace ipc {
+  export class NativeIpcServer {
+    /**
+     * Create and start the IPC server without blocking.
+     *
+     * @param name The endpoint name to listen on. This name uniquely identifies the IPC
+     * connection and must be the same for both the server and client. @param callback
+     * This function will be called whenever a message is received from a client.
+     */
+    static listen(name: string, callback: (error: null | Error, message: IpcMessage) => void): Promise<NativeIpcServer>
+    /** Return the path to the IPC server. */
+    getPath(): string
+    /** Stop the IPC server. */
+    stop(): void
+    /**
+     * Send a message over the IPC server to all the connected clients
+     *
+     * @return The number of clients that the message was sent to. Note that the number of
+     * messages actually received may be less, as some clients could disconnect before
+     * receiving the message.
+     */
+    send(message: string): number
+  }
+  export interface IpcMessage {
+    clientId: number
+    kind: IpcMessageType
+    message?: string
+  }
+  export const enum IpcMessageType {
+    Connected = 0,
+    Disconnected = 1,
+    Message = 2
+  }
+}
+
+export declare namespace logging {
+  export function initNapiLog(jsLogFn: ((err: Error | null, arg0: LogLevel, arg1: string) => any)): void
+  export const enum LogLevel {
+    Trace = 0,
+    Debug = 1,
+    Info = 2,
+    Warn = 3,
+    Error = 4
+  }
+}
+
+export declare namespace passkey_authenticator {
+  export function register(): void
+}
+
+export declare namespace passwords {
+  /**
+   * Delete the stored password from the keychain.
+   * Throws {@link Error} with message {@link PASSWORD_NOT_FOUND} if the password does not exist.
+   */
+  export function deletePassword(service: string, account: string): Promise<void>
+  /**
+   * Fetch the stored password from the keychain.
+   * Throws {@link Error} with message {@link PASSWORD_NOT_FOUND} if the password does not exist.
+   */
+  export function getPassword(service: string, account: string): Promise<string>
+  /** Checks if the os secure storage is available */
+  export function isAvailable(): Promise<boolean>
+  /** The error message returned when a password is not found during retrieval or deletion. */
+  export const PASSWORD_NOT_FOUND: string
+  /**
+   * Save the password to the keychain. Adds an entry if none exists otherwise updates the
+   * existing entry.
+   */
+  export function setPassword(service: string, account: string, password: string): Promise<void>
+}
+
+export declare namespace powermonitors {
+  export function isLockMonitorAvailable(): Promise<boolean>
+  export function onLock(callback: ((err: Error | null, ) => any)): Promise<void>
+}
+
+export declare namespace processisolations {
+  export function disableCoredumps(): Promise<void>
+  export function isCoreDumpingDisabled(): Promise<boolean>
+  export function isolateProcess(): Promise<void>
+}
+
+export declare namespace sshagent {
+  export class SshAgentState {
+
+  }
+  export function clearKeys(agentState: SshAgentState): void
+  export function isRunning(agentState: SshAgentState): boolean
+  export function lock(agentState: SshAgentState): void
+  export interface PrivateKey {
+    privateKey: string
+    name: string
+    cipherId: string
+  }
+  export function serve(callback: ((err: Error | null, arg: SshUiRequest) => Promise<boolean>)): Promise<SshAgentState>
+  export function setKeys(agentState: SshAgentState, newKeys: Array<PrivateKey>): void
+  export interface SshKey {
+    privateKey: string
+    publicKey: string
+    keyFingerprint: string
+  }
+  export interface SshUiRequest {
+    cipherId?: string
+    isList: boolean
+    processName: string
+    isForwarding: boolean
+    namespace?: string
+  }
+  export function stop(agentState: SshAgentState): void
+}
+
+export declare namespace windows_registry {
+  export function createKey(key: string, subkey: string, value: string): Promise<void>
+  export function deleteKey(key: string, subkey: string): Promise<void>
 }
diff --git a/apps/desktop/desktop_native/napi/index.js b/apps/desktop/desktop_native/napi/index.js
index 64819be4405..0362d9ee2bb 100644
--- a/apps/desktop/desktop_native/napi/index.js
+++ b/apps/desktop/desktop_native/napi/index.js
@@ -82,20 +82,20 @@ switch (platform) {
     switch (arch) {
       case "x64":
         nativeBinding = loadFirstAvailable(
-          ["desktop_napi.linux-x64-musl.node", "desktop_napi.linux-x64-gnu.node"],
-          "@bitwarden/desktop-napi-linux-x64-musl",
+          ["desktop_napi.linux-x64-gnu.node"],
+          "@bitwarden/desktop-napi-linux-x64-gnu",
         );
         break;
       case "arm64":
         nativeBinding = loadFirstAvailable(
-          ["desktop_napi.linux-arm64-musl.node", "desktop_napi.linux-arm64-gnu.node"],
-          "@bitwarden/desktop-napi-linux-arm64-musl",
+          ["desktop_napi.linux-arm64-gnu.node"],
+          "@bitwarden/desktop-napi-linux-arm64-gnu",
         );
         break;
       case "arm":
         nativeBinding = loadFirstAvailable(
-          ["desktop_napi.linux-arm-musl.node", "desktop_napi.linux-arm-gnu.node"],
-          "@bitwarden/desktop-napi-linux-arm-musl",
+          ["desktop_napi.linux-arm-gnu.node"],
+          "@bitwarden/desktop-napi-linux-arm-gnu",
         );
         localFileExisted = existsSync(join(__dirname, "desktop_napi.linux-arm-gnueabihf.node"));
         try {
diff --git a/apps/desktop/desktop_native/napi/package.json b/apps/desktop/desktop_native/napi/package.json
index ca17377c9f2..5401207c252 100644
--- a/apps/desktop/desktop_native/napi/package.json
+++ b/apps/desktop/desktop_native/napi/package.json
@@ -3,27 +3,23 @@
   "version": "0.1.0",
   "description": "",
   "scripts": {
-    "build": "node scripts/build.js",
+    "build": "napi build --platform --no-js",
     "test": "cargo test"
   },
   "author": "",
   "license": "GPL-3.0",
   "devDependencies": {
-    "@napi-rs/cli": "2.18.4"
+    "@napi-rs/cli": "3.2.0"
   },
   "napi": {
-    "name": "desktop_napi",
-    "triples": {
-      "defaults": true,
-      "additional": [
-        "x86_64-unknown-linux-musl",
-        "aarch64-unknown-linux-gnu",
-        "i686-pc-windows-msvc",
-        "armv7-unknown-linux-gnueabihf",
-        "aarch64-apple-darwin",
-        "aarch64-unknown-linux-musl",
-        "aarch64-pc-windows-msvc"
-      ]
-    }
+    "binaryName": "desktop_napi",
+    "targets": [
+      "aarch64-apple-darwin",
+      "aarch64-pc-windows-msvc",
+      "aarch64-unknown-linux-gnu",
+      "armv7-unknown-linux-gnueabihf",
+      "i686-pc-windows-msvc",
+      "x86_64-unknown-linux-gnu"
+    ]
   }
 }
diff --git a/apps/desktop/desktop_native/napi/scripts/build.js b/apps/desktop/desktop_native/napi/scripts/build.js
deleted file mode 100644
index a6680f5d311..00000000000
--- a/apps/desktop/desktop_native/napi/scripts/build.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-const { execSync } = require('child_process');
-
-const args = process.argv.slice(2);
-const isRelease = args.includes('--release');
-
-if (isRelease) {
-  console.log('Building release mode.');
-} else {
-  console.log('Building debug mode.');
-  process.env.RUST_LOG = 'debug';
-}
-
-execSync(`napi build --platform --js false`, { stdio: 'inherit', env: process.env });
diff --git a/apps/desktop/desktop_native/napi/src/lib.rs b/apps/desktop/desktop_native/napi/src/lib.rs
index c34e7574f68..25dfdd08336 100644
--- a/apps/desktop/desktop_native/napi/src/lib.rs
+++ b/apps/desktop/desktop_native/napi/src/lib.rs
@@ -290,7 +290,7 @@ pub mod sshagent {
 
     use napi::{
         bindgen_prelude::Promise,
-        threadsafe_function::{ErrorStrategy::CalleeHandled, ThreadsafeFunction},
+        threadsafe_function::{ThreadsafeFunction, ThreadsafeFunctionCallMode},
     };
     use tokio::{self, sync::Mutex};
     use tracing::error;
@@ -326,13 +326,15 @@ pub mod sshagent {
     #[allow(clippy::unused_async)] // FIXME: Remove unused async!
     #[napi]
     pub async fn serve(
-        callback: ThreadsafeFunction<SshUIRequest, CalleeHandled>,
+        callback: ThreadsafeFunction<SshUIRequest, Promise<bool>>,
     ) -> napi::Result<SshAgentState> {
         let (auth_request_tx, mut auth_request_rx) =
             tokio::sync::mpsc::channel::<desktop_core::ssh_agent::SshAgentUIRequest>(32);
         let (auth_response_tx, auth_response_rx) =
             tokio::sync::broadcast::channel::<(u32, bool)>(32);
         let auth_response_tx_arc = Arc::new(Mutex::new(auth_response_tx));
+        // Wrap callback in Arc so it can be shared across spawned tasks
+        let callback = Arc::new(callback);
         tokio::spawn(async move {
             let _ = auth_response_rx;
 
@@ -342,42 +344,50 @@ pub mod sshagent {
                 tokio::spawn(async move {
                     let auth_response_tx_arc = cloned_response_tx_arc;
                     let callback = cloned_callback;
-                    let promise_result: Result<Promise<bool>, napi::Error> = callback
-                        .call_async(Ok(SshUIRequest {
+                    // In NAPI v3, obtain the JS callback return as a Promise<boolean> and await it
+                    // in Rust
+                    let (tx, rx) = std::sync::mpsc::channel::<Promise<bool>>();
+                    let status = callback.call_with_return_value(
+                        Ok(SshUIRequest {
                             cipher_id: request.cipher_id,
                             is_list: request.is_list,
                             process_name: request.process_name,
                             is_forwarding: request.is_forwarding,
                             namespace: request.namespace,
-                        }))
-                        .await;
-                    match promise_result {
-                        Ok(promise_result) => match promise_result.await {
-                            Ok(result) => {
-                                let _ = auth_response_tx_arc
-                                    .lock()
-                                    .await
-                                    .send((request.request_id, result))
-                                    .expect("should be able to send auth response to agent");
-                            }
-                            Err(e) => {
-                                error!(error = %e, "Calling UI callback promise was rejected");
-                                let _ = auth_response_tx_arc
-                                    .lock()
-                                    .await
-                                    .send((request.request_id, false))
-                                    .expect("should be able to send auth response to agent");
+                        }),
+                        ThreadsafeFunctionCallMode::Blocking,
+                        move |ret: Result<Promise<bool>, napi::Error>, _env| {
+                            if let Ok(p) = ret {
+                                let _ = tx.send(p);
                             }
+                            Ok(())
                         },
-                        Err(e) => {
-                            error!(error = %e, "Calling UI callback could not create promise");
-                            let _ = auth_response_tx_arc
-                                .lock()
-                                .await
-                                .send((request.request_id, false))
-                                .expect("should be able to send auth response to agent");
+                    );
+
+                    let result = if status == napi::Status::Ok {
+                        match rx.recv() {
+                            Ok(promise) => match promise.await {
+                                Ok(v) => v,
+                                Err(e) => {
+                                    error!(error = %e, "UI callback promise rejected");
+                                    false
+                                }
+                            },
+                            Err(e) => {
+                                error!(error = %e, "Failed to receive UI callback promise");
+                                false
+                            }
                         }
-                    }
+                    } else {
+                        error!(error = ?status, "Calling UI callback failed");
+                        false
+                    };
+
+                    let _ = auth_response_tx_arc
+                        .lock()
+                        .await
+                        .send((request.request_id, result))
+                        .expect("should be able to send auth response to agent");
                 });
             }
         });
@@ -465,14 +475,12 @@ pub mod processisolations {
 #[napi]
 pub mod powermonitors {
     use napi::{
-        threadsafe_function::{
-            ErrorStrategy::CalleeHandled, ThreadsafeFunction, ThreadsafeFunctionCallMode,
-        },
+        threadsafe_function::{ThreadsafeFunction, ThreadsafeFunctionCallMode},
         tokio,
     };
 
     #[napi]
-    pub async fn on_lock(callback: ThreadsafeFunction<(), CalleeHandled>) -> napi::Result<()> {
+    pub async fn on_lock(callback: ThreadsafeFunction<()>) -> napi::Result<()> {
         let (tx, mut rx) = tokio::sync::mpsc::channel::<()>(32);
         desktop_core::powermonitor::on_lock(tx)
             .await
@@ -511,9 +519,7 @@ pub mod windows_registry {
 #[napi]
 pub mod ipc {
     use desktop_core::ipc::server::{Message, MessageType};
-    use napi::threadsafe_function::{
-        ErrorStrategy, ThreadsafeFunction, ThreadsafeFunctionCallMode,
-    };
+    use napi::threadsafe_function::{ThreadsafeFunction, ThreadsafeFunctionCallMode};
 
     #[napi(object)]
     pub struct IpcMessage {
@@ -550,12 +556,12 @@ pub mod ipc {
     }
 
     #[napi]
-    pub struct IpcServer {
+    pub struct NativeIpcServer {
         server: desktop_core::ipc::server::Server,
     }
 
     #[napi]
-    impl IpcServer {
+    impl NativeIpcServer {
         /// Create and start the IPC server without blocking.
         ///
         /// @param name The endpoint name to listen on. This name uniquely identifies the IPC
@@ -566,7 +572,7 @@ pub mod ipc {
         pub async fn listen(
             name: String,
             #[napi(ts_arg_type = "(error: null | Error, message: IpcMessage) => void")]
-            callback: ThreadsafeFunction<IpcMessage, ErrorStrategy::CalleeHandled>,
+            callback: ThreadsafeFunction<IpcMessage>,
         ) -> napi::Result<Self> {
             let (send, mut recv) = tokio::sync::mpsc::channel::<Message>(32);
             tokio::spawn(async move {
@@ -583,7 +589,7 @@ pub mod ipc {
                 ))
             })?;
 
-            Ok(IpcServer { server })
+            Ok(NativeIpcServer { server })
         }
 
         /// Return the path to the IPC server.
@@ -630,8 +636,9 @@ pub mod autostart {
 #[napi]
 pub mod autofill {
     use desktop_core::ipc::server::{Message, MessageType};
-    use napi::threadsafe_function::{
-        ErrorStrategy, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+    use napi::{
+        bindgen_prelude::FnArgs,
+        threadsafe_function::{ThreadsafeFunction, ThreadsafeFunctionCallMode},
     };
     use serde::{de::DeserializeOwned, Deserialize, Serialize};
     use tracing::error;
@@ -686,6 +693,7 @@ pub mod autofill {
         pub user_verification: UserVerification,
         pub supported_algorithms: Vec<i32>,
         pub window_xy: Position,
+        pub excluded_credentials: Vec<Vec<u8>>,
     }
 
     #[napi(object)]
@@ -724,6 +732,14 @@ pub mod autofill {
         pub window_xy: Position,
     }
 
+    #[napi(object)]
+    #[derive(Debug, Serialize, Deserialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct NativeStatus {
+        pub key: String,
+        pub value: String,
+    }
+
     #[napi(object)]
     #[derive(Serialize, Deserialize)]
     #[serde(rename_all = "camelCase")]
@@ -737,14 +753,14 @@ pub mod autofill {
     }
 
     #[napi]
-    pub struct IpcServer {
+    pub struct AutofillIpcServer {
         server: desktop_core::ipc::server::Server,
     }
 
     // FIXME: Remove unwraps! They panic and terminate the whole application.
     #[allow(clippy::unwrap_used)]
     #[napi]
-    impl IpcServer {
+    impl AutofillIpcServer {
         /// Create and start the IPC server without blocking.
         ///
         /// @param name The endpoint name to listen on. This name uniquely identifies the IPC
@@ -760,23 +776,24 @@ pub mod autofill {
                 ts_arg_type = "(error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyRegistrationRequest) => void"
             )]
             registration_callback: ThreadsafeFunction<
-                (u32, u32, PasskeyRegistrationRequest),
-                ErrorStrategy::CalleeHandled,
+                FnArgs<(u32, u32, PasskeyRegistrationRequest)>,
             >,
             #[napi(
                 ts_arg_type = "(error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionRequest) => void"
             )]
             assertion_callback: ThreadsafeFunction<
-                (u32, u32, PasskeyAssertionRequest),
-                ErrorStrategy::CalleeHandled,
+                FnArgs<(u32, u32, PasskeyAssertionRequest)>,
             >,
             #[napi(
                 ts_arg_type = "(error: null | Error, clientId: number, sequenceNumber: number, message: PasskeyAssertionWithoutUserInterfaceRequest) => void"
             )]
             assertion_without_user_interface_callback: ThreadsafeFunction<
-                (u32, u32, PasskeyAssertionWithoutUserInterfaceRequest),
-                ErrorStrategy::CalleeHandled,
+                FnArgs<(u32, u32, PasskeyAssertionWithoutUserInterfaceRequest)>,
             >,
+            #[napi(
+                ts_arg_type = "(error: null | Error, clientId: number, sequenceNumber: number, message: NativeStatus) => void"
+            )]
+            native_status_callback: ThreadsafeFunction<(u32, u32, NativeStatus)>,
         ) -> napi::Result<Self> {
             let (send, mut recv) = tokio::sync::mpsc::channel::<Message>(32);
             tokio::spawn(async move {
@@ -801,7 +818,7 @@ pub mod autofill {
                                 Ok(msg) => {
                                     let value = msg
                                         .value
-                                        .map(|value| (client_id, msg.sequence_number, value))
+                                        .map(|value| (client_id, msg.sequence_number, value).into())
                                         .map_err(|e| napi::Error::from_reason(format!("{e:?}")));
 
                                     assertion_callback
@@ -820,7 +837,7 @@ pub mod autofill {
                                 Ok(msg) => {
                                     let value = msg
                                         .value
-                                        .map(|value| (client_id, msg.sequence_number, value))
+                                        .map(|value| (client_id, msg.sequence_number, value).into())
                                         .map_err(|e| napi::Error::from_reason(format!("{e:?}")));
 
                                     assertion_without_user_interface_callback
@@ -838,7 +855,7 @@ pub mod autofill {
                                 Ok(msg) => {
                                     let value = msg
                                         .value
-                                        .map(|value| (client_id, msg.sequence_number, value))
+                                        .map(|value| (client_id, msg.sequence_number, value).into())
                                         .map_err(|e| napi::Error::from_reason(format!("{e:?}")));
                                     registration_callback
                                         .call(value, ThreadsafeFunctionCallMode::NonBlocking);
@@ -849,6 +866,21 @@ pub mod autofill {
                                 }
                             }
 
+                            match serde_json::from_str::<PasskeyMessage<NativeStatus>>(&message) {
+                                Ok(msg) => {
+                                    let value = msg
+                                        .value
+                                        .map(|value| (client_id, msg.sequence_number, value))
+                                        .map_err(|e| napi::Error::from_reason(format!("{e:?}")));
+                                    native_status_callback
+                                        .call(value, ThreadsafeFunctionCallMode::NonBlocking);
+                                    continue;
+                                }
+                                Err(error) => {
+                                    error!(%error, "Unable to deserialze native status.");
+                                }
+                            }
+
                             error!(message, "Received an unknown message2");
                         }
                     }
@@ -863,7 +895,7 @@ pub mod autofill {
                 ))
             })?;
 
-            Ok(IpcServer { server })
+            Ok(AutofillIpcServer { server })
         }
 
         /// Return the path to the IPC server.
@@ -956,19 +988,20 @@ pub mod logging {
 
     use std::{fmt::Write, sync::OnceLock};
 
-    use napi::threadsafe_function::{
-        ErrorStrategy::CalleeHandled, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+    use napi::{
+        bindgen_prelude::FnArgs,
+        threadsafe_function::{ThreadsafeFunction, ThreadsafeFunctionCallMode},
     };
     use tracing::Level;
     use tracing_subscriber::{
-        filter::EnvFilter,
+        filter::{EnvFilter, LevelFilter},
         fmt::format::{DefaultVisitor, Writer},
         layer::SubscriberExt,
         util::SubscriberInitExt,
         Layer,
     };
 
-    struct JsLogger(OnceLock<ThreadsafeFunction<(LogLevel, String), CalleeHandled>>);
+    struct JsLogger(OnceLock<ThreadsafeFunction<FnArgs<(LogLevel, String)>>>);
     static JS_LOGGER: JsLogger = JsLogger(OnceLock::new());
 
     #[napi]
@@ -1040,26 +1073,18 @@ pub mod logging {
             let msg = (event.metadata().level().into(), buffer);
 
             if let Some(logger) = JS_LOGGER.0.get() {
-                let _ = logger.call(Ok(msg), ThreadsafeFunctionCallMode::NonBlocking);
+                let _ = logger.call(Ok(msg.into()), ThreadsafeFunctionCallMode::NonBlocking);
             };
         }
     }
 
     #[napi]
-    pub fn init_napi_log(js_log_fn: ThreadsafeFunction<(LogLevel, String), CalleeHandled>) {
+    pub fn init_napi_log(js_log_fn: ThreadsafeFunction<FnArgs<(LogLevel, String)>>) {
         let _ = JS_LOGGER.0.set(js_log_fn);
 
-        // the log level hierarchy is determined by:
-        //    - if RUST_LOG is detected at runtime
-        //    - if RUST_LOG is provided at compile time
-        //    - default to INFO
         let filter = EnvFilter::builder()
-            .with_default_directive(
-                option_env!("RUST_LOG")
-                    .unwrap_or("info")
-                    .parse()
-                    .expect("should provide valid log level at compile time."),
-            )
+            // set the default log level to INFO.
+            .with_default_directive(LevelFilter::INFO.into())
             // parse directives from the RUST_LOG environment variable,
             // overriding the default directive for matching targets.
             .from_env_lossy();
@@ -1117,8 +1142,8 @@ pub mod chromium_importer {
     #[napi(object)]
     pub struct NativeImporterMetadata {
         pub id: String,
-        pub loaders: Vec<&'static str>,
-        pub instructions: &'static str,
+        pub loaders: Vec<String>,
+        pub instructions: String,
     }
 
     impl From<_LoginImportResult> for LoginImportResult {
@@ -1195,7 +1220,7 @@ pub mod chromium_importer {
 #[napi]
 pub mod autotype {
     #[napi]
-    pub fn get_foreground_window_title() -> napi::Result<String, napi::Status> {
+    pub fn get_foreground_window_title() -> napi::Result<String> {
         autotype::get_foreground_window_title().map_err(|_| {
             napi::Error::from_reason(
                 "Autotype Error: failed to get foreground window title".to_string(),
diff --git a/apps/desktop/desktop_native/objc/Cargo.toml b/apps/desktop/desktop_native/objc/Cargo.toml
index 5ef791fb586..dd808537c28 100644
--- a/apps/desktop/desktop_native/objc/Cargo.toml
+++ b/apps/desktop/desktop_native/objc/Cargo.toml
@@ -14,8 +14,8 @@ tokio = { workspace = true }
 tracing = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.build-dependencies]
-cc = "=1.2.46"
-glob = "=0.3.2"
+cc = "=1.2.49"
+glob = "=0.3.3"
 
 [lints]
 workspace = true
diff --git a/apps/desktop/desktop_native/objc/src/native/autofill/commands/sync.m b/apps/desktop/desktop_native/objc/src/native/autofill/commands/sync.m
index fc13c04591a..037a97c7590 100644
--- a/apps/desktop/desktop_native/objc/src/native/autofill/commands/sync.m
+++ b/apps/desktop/desktop_native/objc/src/native/autofill/commands/sync.m
@@ -14,40 +14,64 @@ void runSync(void* context, NSDictionary *params) {
 
   // Map credentials to ASPasswordCredential objects
   NSMutableArray *mappedCredentials = [NSMutableArray arrayWithCapacity:credentials.count];
+  
   for (NSDictionary *credential in credentials) {
-    NSString *type = credential[@"type"];
-
-    if ([type isEqualToString:@"password"]) {
-      NSString *cipherId = credential[@"cipherId"];
-      NSString *uri = credential[@"uri"];
-      NSString *username = credential[@"username"];
-
-      ASCredentialServiceIdentifier *serviceId = [[ASCredentialServiceIdentifier alloc]
-        initWithIdentifier:uri type:ASCredentialServiceIdentifierTypeURL];
-      ASPasswordCredentialIdentity *credential = [[ASPasswordCredentialIdentity alloc]
-        initWithServiceIdentifier:serviceId user:username recordIdentifier:cipherId];
-
-      [mappedCredentials addObject:credential];
-    }
-
-    if (@available(macos 14, *)) {
-      if ([type isEqualToString:@"fido2"]) {
+    @try {
+      NSString *type = credential[@"type"];
+      
+      if ([type isEqualToString:@"password"]) {
         NSString *cipherId = credential[@"cipherId"];
-        NSString *rpId = credential[@"rpId"];
-        NSString *userName = credential[@"userName"];
-        NSData *credentialId = decodeBase64URL(credential[@"credentialId"]);
-        NSData *userHandle = decodeBase64URL(credential[@"userHandle"]);
+        NSString *uri = credential[@"uri"];
+        NSString *username = credential[@"username"];
+        
+        // Skip credentials with null username since MacOS crashes if we send credentials with empty usernames
+        if ([username isKindOfClass:[NSNull class]] || username.length == 0) {
+            NSLog(@"Skipping credential, username is empty: %@", credential);
+          continue;
+        }
 
-        Class passkeyCredentialIdentityClass = NSClassFromString(@"ASPasskeyCredentialIdentity");
-        id credential = [[passkeyCredentialIdentityClass alloc]
-          initWithRelyingPartyIdentifier:rpId
-          userName:userName
-          credentialID:credentialId
-          userHandle:userHandle
-          recordIdentifier:cipherId];
+        ASCredentialServiceIdentifier *serviceId = [[ASCredentialServiceIdentifier alloc]
+          initWithIdentifier:uri type:ASCredentialServiceIdentifierTypeURL];
+        ASPasswordCredentialIdentity *passwordIdentity = [[ASPasswordCredentialIdentity alloc]
+          initWithServiceIdentifier:serviceId user:username recordIdentifier:cipherId];
 
-        [mappedCredentials addObject:credential];
+        [mappedCredentials addObject:passwordIdentity];
+      } 
+      else if (@available(macos 14, *)) {
+        // Fido2CredentialView uses `userName` (camelCase) while Login uses `username`.
+        // This is intentional. Fido2 fields are flattened from the FIDO2 spec's nested structure
+        // (user.name -> userName, rp.id -> rpId) to maintain a clear distinction between these fields.
+        if ([type isEqualToString:@"fido2"]) {
+          NSString *cipherId = credential[@"cipherId"];
+          NSString *rpId = credential[@"rpId"];
+          NSString *userName = credential[@"userName"];
+
+          // Skip credentials with null username since MacOS crashes if we send credentials with empty usernames
+          if ([userName isKindOfClass:[NSNull class]] || userName.length == 0) {
+            NSLog(@"Skipping credential, username is empty: %@", credential);
+            continue;
+          }
+          
+          NSData *credentialId = decodeBase64URL(credential[@"credentialId"]);
+          NSData *userHandle = decodeBase64URL(credential[@"userHandle"]);
+          
+          Class passkeyCredentialIdentityClass = NSClassFromString(@"ASPasskeyCredentialIdentity");
+          id passkeyIdentity = [[passkeyCredentialIdentityClass alloc]
+            initWithRelyingPartyIdentifier:rpId
+            userName:userName
+            credentialID:credentialId
+            userHandle:userHandle
+            recordIdentifier:cipherId];
+
+          [mappedCredentials addObject:passkeyIdentity];
+        }
       }
+    } @catch (NSException *exception) {
+      // Silently skip any credential that causes an exception
+      // to make sure we don't fail the entire sync
+      // There is likely some invalid data in the credential, and not something the user should/could be asked to correct.
+      NSLog(@"ERROR: Exception processing credential: %@ - %@", exception.name, exception.reason);
+      continue;
     }
   }
 
diff --git a/apps/desktop/desktop_native/objc/src/native/utils.m b/apps/desktop/desktop_native/objc/src/native/utils.m
index 040c723a8ac..8f9493a7afb 100644
--- a/apps/desktop/desktop_native/objc/src/native/utils.m
+++ b/apps/desktop/desktop_native/objc/src/native/utils.m
@@ -18,9 +18,26 @@ NSString *serializeJson(NSDictionary *dictionary, NSError *error) {
 }
 
 NSData *decodeBase64URL(NSString *base64URLString) {
+  if (base64URLString.length == 0) {
+    return nil;
+  }
+  
+  // Replace URL-safe characters with standard base64 characters
   NSString *base64String = [base64URLString stringByReplacingOccurrencesOfString:@"-" withString:@"+"];
   base64String = [base64String stringByReplacingOccurrencesOfString:@"_" withString:@"/"];
-
+  
+  // Add padding if needed
+  // Base 64 strings should be a multiple of 4 in length
+  NSUInteger paddingLength = 4 - (base64String.length % 4);
+  if (paddingLength < 4) {
+    NSMutableString *paddedString = [NSMutableString stringWithString:base64String];
+    for (NSUInteger i = 0; i < paddingLength; i++) {
+      [paddedString appendString:@"="];
+    }
+    base64String = paddedString;
+  }
+  
+  // Decode the string
   NSData *nsdataFromBase64String = [[NSData alloc]
     initWithBase64EncodedString:base64String options:0];
 
diff --git a/apps/desktop/desktop_native/rust-toolchain.toml b/apps/desktop/desktop_native/rust-toolchain.toml
index c1ab6b3240a..0992ce9d294 100644
--- a/apps/desktop/desktop_native/rust-toolchain.toml
+++ b/apps/desktop/desktop_native/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.87.0"
+channel = "1.91.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
diff --git a/apps/desktop/desktop_native/windows_plugin_authenticator/src/lib.rs b/apps/desktop/desktop_native/windows_plugin_authenticator/src/lib.rs
index 893fdf765fc..b38a1c725f2 100644
--- a/apps/desktop/desktop_native/windows_plugin_authenticator/src/lib.rs
+++ b/apps/desktop/desktop_native/windows_plugin_authenticator/src/lib.rs
@@ -153,7 +153,7 @@ fn add_authenticator() -> std::result::Result<(), String> {
     }
 }
 
-type EXPERIMENTAL_WebAuthNPluginAddAuthenticatorFnDeclaration = unsafe extern "cdecl" fn(
+type EXPERIMENTAL_WebAuthNPluginAddAuthenticatorFnDeclaration = unsafe extern "C" fn(
     pPluginAddAuthenticatorOptions: *const webauthn::ExperimentalWebAuthnPluginAddAuthenticatorOptions,
     ppPluginAddAuthenticatorResponse: *mut *mut webauthn::ExperimentalWebAuthnPluginAddAuthenticatorResponse,
 ) -> HRESULT;
diff --git a/apps/desktop/macos/autofill-extension/Base.lproj/CredentialProviderViewController.xib b/apps/desktop/macos/autofill-extension/Base.lproj/CredentialProviderViewController.xib
index 1e47cc54de2..132882c6477 100644
--- a/apps/desktop/macos/autofill-extension/Base.lproj/CredentialProviderViewController.xib
+++ b/apps/desktop/macos/autofill-extension/Base.lproj/CredentialProviderViewController.xib
@@ -8,63 +8,56 @@
     <objects>
         <customObject id="-2" userLabel="File's Owner" customClass="CredentialProviderViewController" customModule="autofill_extension" customModuleProvider="target">
             <connections>
+                <outlet property="logoImageView" destination="logoImageView" id="logoImageViewOutlet"/>
+                <outlet property="statusLabel" destination="statusLabel" id="statusLabelOutlet"/>
                 <outlet property="view" destination="1" id="2"/>
             </connections>
         </customObject>
         <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
         <customObject id="-3" userLabel="Application" customClass="NSObject"/>
         <customView hidden="YES" translatesAutoresizingMaskIntoConstraints="NO" id="1">
-            <rect key="frame" x="0.0" y="0.0" width="378" height="94"/>
+            <rect key="frame" x="0.0" y="0.0" width="400" height="120"/>
             <subviews>
-                <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="1uM-r7-H1c">
-                    <rect key="frame" x="184" y="3" width="191" height="32"/>
-                    <buttonCell key="cell" type="push" title="Return Example Password" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="2l4-PO-we5">
-                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                        <font key="font" metaFont="system"/>
-                        <string key="keyEquivalent">D</string>
-                        <modifierMask key="keyEquivalentModifierMask" command="YES"/>
-                    </buttonCell>
-                    <connections>
-                        <action selector="passwordSelected:" target="-2" id="yic-EC-GGk"/>
-                    </connections>
-                </button>
-                <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="NVE-vN-dkz">
-                    <rect key="frame" x="114" y="3" width="76" height="32"/>
-                    <buttonCell key="cell" type="push" title="Cancel" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="6Up-t3-mwm">
-                        <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                        <font key="font" metaFont="system"/>
-                        <string key="keyEquivalent" base64-UTF8="YES">
-Gw
-</string>
-                    </buttonCell>
-                    <constraints>
-                        <constraint firstAttribute="width" relation="greaterThanOrEqual" constant="60" id="cP1-hK-9ZX"/>
-                    </constraints>
-                    <connections>
-                        <action selector="cancel:" target="-2" id="Qav-AK-DGt"/>
-                    </connections>
-                </button>
-                <textField verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="aNc-0i-CWK">
-                    <rect key="frame" x="112" y="63" width="154" height="16"/>
-                    <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="left" title="autofill-extension hello" id="0xp-rC-2gr">
-                        <font key="font" metaFont="systemBold"/>
-                        <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                        <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                    </textFieldCell>
-                </textField>
+                <stackView distribution="fill" orientation="horizontal" alignment="centerY" spacing="20" horizontalStackHuggingPriority="249.99998474121094" verticalStackHuggingPriority="249.99998474121094" detachesHiddenViews="YES" translatesAutoresizingMaskIntoConstraints="NO" id="configStackView">
+                    <rect key="frame" x="89" y="35" width="223" height="50"/>
+                    <subviews>
+                        <imageView horizontalHuggingPriority="251" verticalHuggingPriority="251" translatesAutoresizingMaskIntoConstraints="NO" id="logoImageView">
+                            <rect key="frame" x="0.0" y="0.0" width="50" height="50"/>
+                            <constraints>
+                                <constraint firstAttribute="height" constant="50" id="logoImageHeight"/>
+                                <constraint firstAttribute="width" constant="50" id="logoImageWidth"/>
+                            </constraints>
+                            <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyUpOrDown" image="bitwarden-icon" id="logoImageCell"/>
+                        </imageView>
+                        <textField focusRingType="none" horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="statusLabel">
+                            <rect key="frame" x="68" y="16" width="157" height="19"/>
+                            <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="left" title="Enabling Bitwarden..." id="statusLabelCell">
+                                <font key="font" metaFont="system" size="16"/>
+                                <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                                <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            </textFieldCell>
+                        </textField>
+                    </subviews>
+                    <visibilityPriorities>
+                        <integer value="1000"/>
+                        <integer value="1000"/>
+                    </visibilityPriorities>
+                    <customSpacing>
+                        <real value="3.4028234663852886e+38"/>
+                        <real value="3.4028234663852886e+38"/>
+                    </customSpacing>
+                </stackView>
             </subviews>
             <constraints>
-                <constraint firstItem="1uM-r7-H1c" firstAttribute="leading" secondItem="NVE-vN-dkz" secondAttribute="trailing" constant="8" id="1UO-J1-LbJ"/>
-                <constraint firstItem="NVE-vN-dkz" firstAttribute="leading" relation="greaterThanOrEqual" secondItem="1" secondAttribute="leading" constant="20" symbolic="YES" id="3N9-qo-UfS"/>
-                <constraint firstAttribute="bottom" secondItem="1uM-r7-H1c" secondAttribute="bottom" constant="10" id="4wH-De-nMF"/>
-                <constraint firstItem="NVE-vN-dkz" firstAttribute="firstBaseline" secondItem="aNc-0i-CWK" secondAttribute="baseline" constant="50" id="Dpq-cK-cPE"/>
-                <constraint firstAttribute="bottom" secondItem="NVE-vN-dkz" secondAttribute="bottom" constant="10" id="USG-Gg-of3"/>
-                <constraint firstItem="1uM-r7-H1c" firstAttribute="leading" secondItem="NVE-vN-dkz" secondAttribute="trailing" constant="8" id="a8N-vS-Ew9"/>
-                <constraint firstAttribute="trailing" secondItem="1uM-r7-H1c" secondAttribute="trailing" constant="10" id="qfT-cw-QQ2"/>
-                <constraint firstAttribute="centerX" secondItem="aNc-0i-CWK" secondAttribute="centerX" id="uV3-Wn-RA3"/>
-                <constraint firstItem="aNc-0i-CWK" firstAttribute="top" secondItem="1" secondAttribute="top" constant="15" id="vpR-tf-ebx"/>
+                <constraint firstItem="configStackView" firstAttribute="centerX" secondItem="1" secondAttribute="centerX" id="stackCenterX"/>
+                <constraint firstItem="configStackView" firstAttribute="centerY" secondItem="1" secondAttribute="centerY" id="stackCenterY"/>
+                <constraint firstItem="configStackView" firstAttribute="leading" relation="greaterThanOrEqual" secondItem="1" secondAttribute="leading" constant="20" id="stackLeading"/>
+                <constraint firstAttribute="trailing" relation="greaterThanOrEqual" secondItem="configStackView" secondAttribute="trailing" constant="20" id="stackTrailing"/>
             </constraints>
-            <point key="canvasLocation" x="162" y="146"/>
+            <point key="canvasLocation" x="200" y="60"/>
         </customView>
     </objects>
+    <resources>
+        <image name="bitwarden-icon" width="64" height="64"/>
+    </resources>
 </document>
diff --git a/apps/desktop/macos/autofill-extension/CredentialProviderViewController.swift b/apps/desktop/macos/autofill-extension/CredentialProviderViewController.swift
index 5568b2e75db..3de9468c8ab 100644
--- a/apps/desktop/macos/autofill-extension/CredentialProviderViewController.swift
+++ b/apps/desktop/macos/autofill-extension/CredentialProviderViewController.swift
@@ -11,63 +11,138 @@ import os
 class CredentialProviderViewController: ASCredentialProviderViewController {
     let logger: Logger
     
-    // There is something a bit strange about the initialization/deinitialization in this class.
-    // Sometimes deinit won't be called after a request has successfully finished,
-    // which would leave this class hanging in memory and the IPC connection open.
-    //
-    // If instead I make this a static, the deinit gets called correctly after each request.
-    // I think we still might want a static regardless, to be able to reuse the connection if possible.
-    let client: MacOsProviderClient = {
-        let logger = Logger(subsystem: "com.bitwarden.desktop.autofill-extension", category: "credential-provider")
+    @IBOutlet weak var statusLabel: NSTextField!
+    @IBOutlet weak var logoImageView: NSImageView!
+    
+    // The IPC client to communicate with the Bitwarden desktop app
+    private var client: MacOsProviderClient?
+    
+    // Timer for checking connection status
+    private var connectionMonitorTimer: Timer?
+    private var lastConnectionStatus: ConnectionStatus = .disconnected
+
+    // We changed the getClient method to be async, here's why:
+    // This is so that we can check if the app is running, and launch it, without blocking the main thread
+    // Blocking the main thread caused MacOS layouting to 'fail' or at least be very delayed, which caused our getWindowPositioning code to sent 0,0.
+    // We also properly retry the IPC connection which sometimes would take some time to be up and running, depending on CPU load, phase of jupiters moon, etc.
+    private func getClient() async -> MacOsProviderClient {
+        if let client = self.client {
+            return client
+        }
         
+        let logger = Logger(subsystem: "com.bitwarden.desktop.autofill-extension", category: "credential-provider")
+
         // Check if the Electron app is running
         let workspace = NSWorkspace.shared
         let isRunning = workspace.runningApplications.contains { app in
             app.bundleIdentifier == "com.bitwarden.desktop"
         }
-        
+
         if !isRunning {
-           logger.log("[autofill-extension] Bitwarden Desktop not running, attempting to launch")
-            
-           // Try to launch the app
+            logger.log("[autofill-extension] Bitwarden Desktop not running, attempting to launch")
+
+            // Launch the app and wait for it to be ready
             if let appURL = workspace.urlForApplication(withBundleIdentifier: "com.bitwarden.desktop") {
-                let semaphore = DispatchSemaphore(value: 0)
-                
-                workspace.openApplication(at: appURL,
-                                          configuration: NSWorkspace.OpenConfiguration()) { app, error in
-                    if let error = error {
-                        logger.error("[autofill-extension] Failed to launch Bitwarden Desktop: \(error.localizedDescription)")
-                    } else if let app = app {
-                        logger.log("[autofill-extension] Successfully launched Bitwarden Desktop")
-                    } else {
-                        logger.error("[autofill-extension] Failed to launch Bitwarden Desktop: unknown error")
+                await withCheckedContinuation { continuation in
+                    workspace.openApplication(at: appURL, configuration: NSWorkspace.OpenConfiguration()) { app, error in
+                        if let error = error {
+                            logger.error("[autofill-extension] Failed to launch Bitwarden Desktop: \(error.localizedDescription)")
+                        } else {
+                            logger.log("[autofill-extension] Successfully launched Bitwarden Desktop")
+                        }
+                        continuation.resume()
                     }
-                    semaphore.signal()
                 }
-                
-                // Wait for launch completion with timeout
-                _ = semaphore.wait(timeout: .now() + 5.0)
-                
-                // Add a small delay to allow for initialization
-                Thread.sleep(forTimeInterval: 1.0)
-            } else {
-                logger.error("[autofill-extension] Could not find Bitwarden Desktop app")
             }
-        } else {
-            logger.log("[autofill-extension] Bitwarden Desktop is running")    
+        }
+
+        logger.log("[autofill-extension] Connecting to Bitwarden over IPC")
+        
+        // Retry connecting to the Bitwarden IPC with an increasing delay
+        let maxRetries = 20
+        let delayMs = 500
+        var newClient: MacOsProviderClient?
+        
+        for attempt in 1...maxRetries {
+            logger.log("[autofill-extension] Connection attempt \(attempt)")
+            
+            // Create a new client instance for each retry
+            newClient = MacOsProviderClient.connect()
+            try? await Task.sleep(nanoseconds: UInt64(100 * attempt + (delayMs * 1_000_000))) // Convert ms to nanoseconds
+            let connectionStatus = newClient!.getConnectionStatus()
+            
+            logger.log("[autofill-extension] Connection attempt \(attempt), status: \(connectionStatus == .connected ? "connected" : "disconnected")")
+            
+            if connectionStatus == .connected {
+                logger.log("[autofill-extension] Successfully connected to Bitwarden (attempt \(attempt))")
+                break
+            } else {
+                if attempt < maxRetries {
+                    logger.log("[autofill-extension] Retrying connection")
+                } else {
+                    logger.error("[autofill-extension] Failed to connect after \(maxRetries) attempts, final status: \(connectionStatus == .connected ? "connected" : "disconnected")")
+                }
+            }
         }
         
-        logger.log("[autofill-extension] Connecting to Bitwarden over IPC")    
-
-        return MacOsProviderClient.connect()
-    }()
+        self.client = newClient
+        return newClient!
+    }    
+    
+    // Setup the connection monitoring timer
+    private func setupConnectionMonitoring() {
+        // Check connection status every 1 second
+        connectionMonitorTimer = Timer.scheduledTimer(withTimeInterval: 1.0, repeats: true) { [weak self] _ in
+            self?.checkConnectionStatus()
+        }
+        
+        // Make sure timer runs even when UI is busy
+        RunLoop.current.add(connectionMonitorTimer!, forMode: .common)
+        
+        // Initial check
+        checkConnectionStatus()
+    }
+    
+    // Check the connection status by calling into Rust
+    // If the connection is has changed and is now disconnected, cancel the request
+    private func checkConnectionStatus() {
+        // Only check connection status if the client has been initialized.
+        // Initialization is done asynchronously, so we might be called before it's ready
+        // In that case we just skip this check and wait for the next timer tick and re-check
+        guard let client = self.client else {
+            return
+        }
+        
+        // Get the current connection status from Rust
+        let currentStatus = client.getConnectionStatus()
+        
+        // Only post notification if state changed
+        if currentStatus != lastConnectionStatus {
+            if(currentStatus == .connected) {
+                logger.log("[autofill-extension] Connection status changed: Connected")
+            } else {
+                logger.log("[autofill-extension] Connection status changed: Disconnected")
+            }
+            
+            // Save the new status
+            lastConnectionStatus = currentStatus
+            
+            // If we just disconnected, try to cancel the request
+            if currentStatus == .disconnected {
+                self.extensionContext.cancelRequest(withError: BitwardenError.Internal("Bitwarden desktop app disconnected"))
+            }
+        }
+    }
     
     init() {
         logger = Logger(subsystem: "com.bitwarden.desktop.autofill-extension", category: "credential-provider")
         
         logger.log("[autofill-extension] initializing extension")
         
-        super.init(nibName: nil, bundle: nil)
+        super.init(nibName: "CredentialProviderViewController", bundle: nil)
+        
+        // Setup connection monitoring now that self is available
+        setupConnectionMonitoring()
     }
     
     required init?(coder: NSCoder) {
@@ -76,45 +151,109 @@ class CredentialProviderViewController: ASCredentialProviderViewController {
     
     deinit {
         logger.log("[autofill-extension] deinitializing extension")
-    }
-    
-    
-    @IBAction func cancel(_ sender: AnyObject?) {
-        self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: ASExtensionError.userCanceled.rawValue))
-    }
-    
-    @IBAction func passwordSelected(_ sender: AnyObject?) {
-        let passwordCredential = ASPasswordCredential(user: "j_appleseed", password: "apple1234")
-        self.extensionContext.completeRequest(withSelectedCredential: passwordCredential, completionHandler: nil)
-    }
-    
-    private func getWindowPosition() -> Position {
-        let frame = self.view.window?.frame ?? .zero
-        let screenHeight = NSScreen.main?.frame.height ?? 0      
         
-        // frame.width and frame.height is always 0. Estimating works OK for now.
-        let estimatedWidth:CGFloat = 400;
-        let estimatedHeight:CGFloat = 200;
-        let centerX = Int32(round(frame.origin.x + estimatedWidth/2))
-        let centerY = Int32(round(screenHeight - (frame.origin.y + estimatedHeight/2)))
-        
-        return Position(x: centerX, y:centerY)
+        // Stop the connection monitor timer
+        connectionMonitorTimer?.invalidate()
+        connectionMonitorTimer = nil
     }
     
-    override func loadView() {
-        let view = NSView()
-        // Hide the native window since we only need the IPC connection
-        view.isHidden = true    
-        self.view = view
+    private func getWindowPosition() async -> Position {
+        let screenHeight = NSScreen.main?.frame.height ?? 1440
+        
+        logger.log("[autofill-extension] position: Getting window position")
+        
+        // To whomever is reading this. Sorry. But MacOS couldn't give us an accurate window positioning, possibly due to animations
+        // So I added some retry logic, as well as a fall back to the mouse position which is likely at the sort of the right place.
+        // In my testing we often succed after 4-7 attempts.
+        // Wait for window frame to stabilize (animation to complete)
+        var lastFrame: CGRect = .zero
+        var stableCount = 0
+        let requiredStableChecks = 3
+        let maxAttempts = 20
+        var attempts = 0
+        
+        while stableCount < requiredStableChecks && attempts < maxAttempts {
+            let currentFrame: CGRect = self.view.window?.frame ?? .zero
+            
+            if currentFrame.equalTo(lastFrame) && !currentFrame.equalTo(.zero) {
+                stableCount += 1
+            } else {
+                stableCount = 0
+                lastFrame = currentFrame
+            }
+            
+            try? await Task.sleep(nanoseconds: 16_666_666) // ~60fps (16.67ms)
+            attempts += 1
+        }
+        
+        let finalWindowFrame = self.view.window?.frame ?? .zero
+        logger.log("[autofill-extension] position: Final window frame: \(NSStringFromRect(finalWindowFrame))")
+        
+        // Use stabilized window frame if available, otherwise fallback to mouse position
+        if finalWindowFrame.origin.x != 0 || finalWindowFrame.origin.y != 0 {
+            let centerX = Int32(round(finalWindowFrame.origin.x))
+            let centerY = Int32(round(screenHeight - finalWindowFrame.origin.y))
+            logger.log("[autofill-extension] position: Using window position: x=\(centerX), y=\(centerY)")
+            return Position(x: centerX, y: centerY)
+        } else {
+            // Fallback to mouse position
+            let mouseLocation = NSEvent.mouseLocation
+            let mouseX = Int32(round(mouseLocation.x))
+            let mouseY = Int32(round(screenHeight - mouseLocation.y))
+            logger.log("[autofill-extension] position: Using mouse position fallback: x=\(mouseX), y=\(mouseY)")
+            return Position(x: mouseX, y: mouseY)
+        }
     }
-       
+    
+    override func viewDidLoad() {
+        super.viewDidLoad()
+        
+        // Initially hide the view
+        self.view.isHidden = true
+    }
+    
+    override func prepareInterfaceForExtensionConfiguration() {
+        // Show the configuration UI
+        self.view.isHidden = false
+        
+        // Set the localized message
+        statusLabel.stringValue = NSLocalizedString("autofillConfigurationMessage", comment: "Message shown when Bitwarden is enabled in system settings")
+        
+        // Send the native status request asynchronously
+        Task {
+            let client = await getClient()
+            client.sendNativeStatus(key: "request-sync", value: "")
+        }
+        
+        // Complete the configuration after 2 seconds
+        DispatchQueue.main.asyncAfter(deadline: .now() + 2.0) { [weak self] in
+            self?.extensionContext.completeExtensionConfigurationRequest()
+        }
+    }
+    
+    /*
+     In order to implement this method, we need to query the state of the vault to be unlocked and have one and only one matching credential so that it doesn't need to show ui.
+     If we do show UI, it's going to fail and disconnect after the platform timeout which is 3s.
+     For now we just claim to always need UI displayed.
+     */
     override func provideCredentialWithoutUserInteraction(for credentialRequest: any ASCredentialRequest) {
+       let error = ASExtensionError(.userInteractionRequired)
+       self.extensionContext.cancelRequest(withError: error)
+       return
+    }
+    
+    /*
+     Implement this method if provideCredentialWithoutUserInteraction(for:) can fail with
+     ASExtensionError.userInteractionRequired. In this case, the system may present your extension's
+     UI and call this method. Show appropriate UI for authenticating the user then provide the password
+     by completing the extension request with the associated ASPasswordCredential.
+     */
+    override func prepareInterfaceToProvideCredential(for credentialRequest: ASCredentialRequest) {
         let timeoutTimer = createTimer()
-
         if let request = credentialRequest as? ASPasskeyCredentialRequest {
             if let passkeyIdentity = request.credentialIdentity as? ASPasskeyCredentialIdentity {
-                
-                logger.log("[autofill-extension] provideCredentialWithoutUserInteraction2(passkey) called \(request)")
+
+                logger.log("[autofill-extension] prepareInterfaceToProvideCredential (passkey) called \(request)")
                 
                 class CallbackImpl: PreparePasskeyAssertionCallback {
                     let ctx: ASCredentialProviderExtensionContext
@@ -154,18 +293,25 @@ class CredentialProviderViewController: ASCredentialProviderViewController {
                     UserVerification.discouraged
                 }
                 
-                let req = PasskeyAssertionWithoutUserInterfaceRequest(
-                    rpId: passkeyIdentity.relyingPartyIdentifier,
-                    credentialId: passkeyIdentity.credentialID,
-                    userName: passkeyIdentity.userName,
-                    userHandle: passkeyIdentity.userHandle,
-                    recordIdentifier: passkeyIdentity.recordIdentifier,
-                    clientDataHash: request.clientDataHash,
-                    userVerification: userVerification,
-                    windowXy: self.getWindowPosition()
-                )
-                
-                self.client.preparePasskeyAssertionWithoutUserInterface(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+                /*
+                    We're still using the old request type here, because we're sending the same data, we're expecting a single credential to be used
+                */
+                Task {
+                    let windowPosition = await self.getWindowPosition()
+                    let req = PasskeyAssertionWithoutUserInterfaceRequest(
+                        rpId: passkeyIdentity.relyingPartyIdentifier,
+                        credentialId: passkeyIdentity.credentialID,
+                        userName: passkeyIdentity.userName,
+                        userHandle: passkeyIdentity.userHandle,
+                        recordIdentifier: passkeyIdentity.recordIdentifier,
+                        clientDataHash: request.clientDataHash,
+                        userVerification: userVerification,
+                        windowXy: windowPosition
+                    )
+                    
+                    let client = await getClient()
+                    client.preparePasskeyAssertionWithoutUserInterface(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+                }
                 return
             }
         }
@@ -176,16 +322,6 @@ class CredentialProviderViewController: ASCredentialProviderViewController {
         self.extensionContext.cancelRequest(withError: BitwardenError.Internal("Invalid authentication request"))
     }
     
-    /*
-     Implement this method if provideCredentialWithoutUserInteraction(for:) can fail with
-     ASExtensionError.userInteractionRequired. In this case, the system may present your extension's
-     UI and call this method. Show appropriate UI for authenticating the user then provide the password
-     by completing the extension request with the associated ASPasswordCredential.
-     
-     override func prepareInterfaceToProvideCredential(for credentialIdentity: ASPasswordCredentialIdentity) {
-     }
-     */
-
     private func createTimer() -> DispatchWorkItem {
         // Create a timer for 600 second timeout
         let timeoutTimer = DispatchWorkItem { [weak self] in
@@ -246,18 +382,32 @@ class CredentialProviderViewController: ASCredentialProviderViewController {
                     UserVerification.discouraged
                 }
                 
-                let req = PasskeyRegistrationRequest(
-                    rpId: passkeyIdentity.relyingPartyIdentifier,
-                    userName: passkeyIdentity.userName,
-                    userHandle: passkeyIdentity.userHandle,
-                    clientDataHash: request.clientDataHash,
-                    userVerification: userVerification,
-                    supportedAlgorithms: request.supportedAlgorithms.map{ Int32($0.rawValue) },
-                    windowXy: self.getWindowPosition()
-                )
+                // Convert excluded credentials to an array of credential IDs
+                var excludedCredentialIds: [Data] = []
+                if #available(macOSApplicationExtension 15.0, *) {
+                    if let excludedCreds = request.excludedCredentials {
+                        excludedCredentialIds = excludedCreds.map { $0.credentialID }
+                    }
+                }
+                
                 logger.log("[autofill-extension] prepareInterface(passkey) calling preparePasskeyRegistration")                
                 
-                self.client.preparePasskeyRegistration(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+                Task {
+                    let windowPosition = await self.getWindowPosition()
+                    let req = PasskeyRegistrationRequest(
+                        rpId: passkeyIdentity.relyingPartyIdentifier,
+                        userName: passkeyIdentity.userName,
+                        userHandle: passkeyIdentity.userHandle,
+                        clientDataHash: request.clientDataHash,
+                        userVerification: userVerification,
+                        supportedAlgorithms: request.supportedAlgorithms.map{ Int32($0.rawValue) },
+                        windowXy: windowPosition,
+                        excludedCredentials: excludedCredentialIds
+                    )
+                    
+                    let client = await getClient()
+                    client.preparePasskeyRegistration(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+                }
                 return
             }
         }
@@ -310,18 +460,22 @@ class CredentialProviderViewController: ASCredentialProviderViewController {
             UserVerification.discouraged
         }
         
-        let req = PasskeyAssertionRequest(
-            rpId: requestParameters.relyingPartyIdentifier,
-            clientDataHash: requestParameters.clientDataHash,
-            userVerification: userVerification,
-            allowedCredentials: requestParameters.allowedCredentials,
-            windowXy: self.getWindowPosition()
-            //extensionInput: requestParameters.extensionInput,
-        )
-        
         let timeoutTimer = createTimer()
         
-        self.client.preparePasskeyAssertion(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+        Task {
+            let windowPosition = await self.getWindowPosition()
+            let req = PasskeyAssertionRequest(
+                rpId: requestParameters.relyingPartyIdentifier,
+                clientDataHash: requestParameters.clientDataHash,
+                userVerification: userVerification,
+                allowedCredentials: requestParameters.allowedCredentials,
+                windowXy: windowPosition
+                //extensionInput: requestParameters.extensionInput, // We don't support extensions yet
+            )
+            
+            let client = await getClient()
+            client.preparePasskeyAssertion(request: req, callback: CallbackImpl(self.extensionContext, self.logger, timeoutTimer))
+        }
         return
     }    
 }
diff --git a/apps/desktop/macos/autofill-extension/Info.plist b/apps/desktop/macos/autofill-extension/Info.plist
index 539cfa35b9d..7de0d4d152b 100644
--- a/apps/desktop/macos/autofill-extension/Info.plist
+++ b/apps/desktop/macos/autofill-extension/Info.plist
@@ -10,9 +10,9 @@
 			<dict>
 				<key>ProvidesPasskeys</key>
 				<true/>
+				<key>ShowsConfigurationUI</key>
+				<true/>
 			</dict>
-			<key>ASCredentialProviderExtensionShowsConfigurationUI</key>
-			<false/>
 		</dict>
 		<key>NSExtensionPointIdentifier</key>
 		<string>com.apple.authentication-services-credential-provider-ui</string>
diff --git a/apps/desktop/macos/autofill-extension/autofill_extension.entitlements b/apps/desktop/macos/autofill-extension/autofill_extension.entitlements
index 86c7195768e..d5c7b8a2cc8 100644
--- a/apps/desktop/macos/autofill-extension/autofill_extension.entitlements
+++ b/apps/desktop/macos/autofill-extension/autofill_extension.entitlements
@@ -2,11 +2,9 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-    <key>com.apple.developer.authentication-services.autofill-credential-provider</key>
-    <true/>
-    <key>com.apple.security.app-sandbox</key>
-    <true/>
-    <key>com.apple.security.application-groups</key>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.application-groups</key>
 	<array>
 		<string>LTZ2PFU5D6.com.bitwarden.desktop</string>
 	</array>
diff --git a/apps/desktop/macos/autofill-extension/bitwarden-icon.png b/apps/desktop/macos/autofill-extension/bitwarden-icon.png
new file mode 100644
index 00000000000..9a05bc7bbdd
Binary files /dev/null and b/apps/desktop/macos/autofill-extension/bitwarden-icon.png differ
diff --git a/apps/desktop/macos/autofill-extension/en.lproj/Localizable.strings b/apps/desktop/macos/autofill-extension/en.lproj/Localizable.strings
new file mode 100644
index 00000000000..95730dff286
--- /dev/null
+++ b/apps/desktop/macos/autofill-extension/en.lproj/Localizable.strings
@@ -0,0 +1,2 @@
+/* Message shown during passkey configuration */
+"autofillConfigurationMessage" = "Enabling Bitwarden...";
diff --git a/apps/desktop/macos/desktop.xcodeproj/project.pbxproj b/apps/desktop/macos/desktop.xcodeproj/project.pbxproj
index ff257097f26..ed19fc9ef5d 100644
--- a/apps/desktop/macos/desktop.xcodeproj/project.pbxproj
+++ b/apps/desktop/macos/desktop.xcodeproj/project.pbxproj
@@ -9,6 +9,8 @@
 /* Begin PBXBuildFile section */
 		3368DB392C654B8100896B75 /* BitwardenMacosProviderFFI.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = 3368DB382C654B8100896B75 /* BitwardenMacosProviderFFI.xcframework */; };
 		3368DB3B2C654F3800896B75 /* BitwardenMacosProvider.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3368DB3A2C654F3800896B75 /* BitwardenMacosProvider.swift */; };
+		9AE299092DF9D82E00AAE454 /* bitwarden-icon.png in Resources */ = {isa = PBXBuildFile; fileRef = 9AE299082DF9D82E00AAE454 /* bitwarden-icon.png */; };
+		9AE299122DFB57A200AAE454 /* Localizable.strings in Resources */ = {isa = PBXBuildFile; fileRef = 9AE2990D2DFB57A200AAE454 /* Localizable.strings */; };
 		E1DF713F2B342F6900F29026 /* AuthenticationServices.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E1DF713E2B342F6900F29026 /* AuthenticationServices.framework */; };
 		E1DF71422B342F6900F29026 /* CredentialProviderViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = E1DF71412B342F6900F29026 /* CredentialProviderViewController.swift */; };
 		E1DF71452B342F6900F29026 /* CredentialProviderViewController.xib in Resources */ = {isa = PBXBuildFile; fileRef = E1DF71432B342F6900F29026 /* CredentialProviderViewController.xib */; };
@@ -18,6 +20,8 @@
 		3368DB382C654B8100896B75 /* BitwardenMacosProviderFFI.xcframework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.xcframework; name = BitwardenMacosProviderFFI.xcframework; path = ../desktop_native/macos_provider/BitwardenMacosProviderFFI.xcframework; sourceTree = "<group>"; };
 		3368DB3A2C654F3800896B75 /* BitwardenMacosProvider.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = BitwardenMacosProvider.swift; sourceTree = "<group>"; };
 		968ED08A2C52A47200FFFEE6 /* ReleaseAppStore.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = ReleaseAppStore.xcconfig; sourceTree = "<group>"; };
+		9AE299082DF9D82E00AAE454 /* bitwarden-icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "bitwarden-icon.png"; sourceTree = "<group>"; };
+		9AE2990C2DFB57A200AAE454 /* en */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = en; path = Localizable.strings; sourceTree = "<group>"; };
 		D83832AB2D67B9AE003FB9F8 /* Debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Debug.xcconfig; sourceTree = "<group>"; };
 		D83832AD2D67B9D0003FB9F8 /* ReleaseDeveloper.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = ReleaseDeveloper.xcconfig; sourceTree = "<group>"; };
 		E1DF713C2B342F6900F29026 /* autofill-extension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "autofill-extension.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -41,6 +45,14 @@
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		9AE2990E2DFB57A200AAE454 /* en.lproj */ = {
+			isa = PBXGroup;
+			children = (
+				9AE2990D2DFB57A200AAE454 /* Localizable.strings */,
+			);
+			path = en.lproj;
+			sourceTree = "<group>";
+		};
 		E1DF711D2B342E2800F29026 = {
 			isa = PBXGroup;
 			children = (
@@ -73,6 +85,8 @@
 		E1DF71402B342F6900F29026 /* autofill-extension */ = {
 			isa = PBXGroup;
 			children = (
+				9AE2990E2DFB57A200AAE454 /* en.lproj */,
+				9AE299082DF9D82E00AAE454 /* bitwarden-icon.png */,
 				3368DB3A2C654F3800896B75 /* BitwardenMacosProvider.swift */,
 				E1DF71412B342F6900F29026 /* CredentialProviderViewController.swift */,
 				E1DF71432B342F6900F29026 /* CredentialProviderViewController.xib */,
@@ -124,6 +138,7 @@
 			knownRegions = (
 				en,
 				Base,
+				sv,
 			);
 			mainGroup = E1DF711D2B342E2800F29026;
 			productRefGroup = E1DF71272B342E2800F29026 /* Products */;
@@ -141,6 +156,8 @@
 			buildActionMask = 2147483647;
 			files = (
 				E1DF71452B342F6900F29026 /* CredentialProviderViewController.xib in Resources */,
+				9AE299122DFB57A200AAE454 /* Localizable.strings in Resources */,
+				9AE299092DF9D82E00AAE454 /* bitwarden-icon.png in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -159,6 +176,14 @@
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXVariantGroup section */
+		9AE2990D2DFB57A200AAE454 /* Localizable.strings */ = {
+			isa = PBXVariantGroup;
+			children = (
+				9AE2990C2DFB57A200AAE454 /* en */,
+			);
+			name = Localizable.strings;
+			sourceTree = "<group>";
+		};
 		E1DF71432B342F6900F29026 /* CredentialProviderViewController.xib */ = {
 			isa = PBXVariantGroup;
 			children = (
diff --git a/apps/desktop/native-messaging-test-runner/package-lock.json b/apps/desktop/native-messaging-test-runner/package-lock.json
index 9ad1ffb3ec0..1f4a56de18a 100644
--- a/apps/desktop/native-messaging-test-runner/package-lock.json
+++ b/apps/desktop/native-messaging-test-runner/package-lock.json
@@ -19,7 +19,7 @@
         "yargs": "18.0.0"
       },
       "devDependencies": {
-        "@types/node": "22.19.1",
+        "@types/node": "22.19.2",
         "typescript": "5.4.2"
       }
     },
@@ -117,9 +117,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.19.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
-      "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "version": "22.19.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
+      "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
diff --git a/apps/desktop/native-messaging-test-runner/package.json b/apps/desktop/native-messaging-test-runner/package.json
index 21a6ba3626a..83e9f01afed 100644
--- a/apps/desktop/native-messaging-test-runner/package.json
+++ b/apps/desktop/native-messaging-test-runner/package.json
@@ -24,7 +24,7 @@
     "yargs": "18.0.0"
   },
   "devDependencies": {
-    "@types/node": "22.19.1",
+    "@types/node": "22.19.2",
     "typescript": "5.4.2"
   },
   "_moduleAliases": {
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index bb8118cb7eb..5e85d34cebc 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -18,6 +18,7 @@
   "scripts": {
     "postinstall": "electron-rebuild",
     "start": "cross-env ELECTRON_IS_DEV=0 ELECTRON_NO_UPDATER=1 electron ./build",
+    "build-native-macos": "cd desktop_native && ./macos_provider/build.sh && node build.js cross-platform",
     "build-native": "cd desktop_native && node build.js",
     "build": "concurrently -n Main,Rend,Prel -c yellow,cyan \"npm run build:main\" \"npm run build:renderer\" \"npm run build:preload\"",
     "build:dev": "concurrently -n Main,Rend,Prel -c yellow,cyan \"npm run build:main:dev\" \"npm run build:renderer:dev\" \"npm run build:preload:dev\"",
@@ -44,10 +45,9 @@
     "pack:mac": "npm run clean:dist && electron-builder --mac --universal -p never",
     "pack:mac:with-extension": "npm run clean:dist && npm run build:macos-extension:mac && electron-builder --mac --universal -p never",
     "pack:mac:arm64": "npm run clean:dist && electron-builder --mac --arm64 -p never",
-    "pack:mac:mas": "npm run clean:dist && electron-builder --mac mas --universal -p never",
-    "pack:mac:mas:with-extension": "npm run clean:dist && npm run build:macos-extension:mas && electron-builder --mac mas --universal -p never",
-    "pack:mac:masdev": "npm run clean:dist && electron-builder --mac mas-dev --universal -p never",
-    "pack:mac:masdev:with-extension": "npm run clean:dist && npm run build:macos-extension:masdev && electron-builder --mac mas-dev --universal -p never",
+    "pack:mac:mas": "npm run clean:dist && npm run build:macos-extension:mas && electron-builder --mac mas --universal -p never",
+    "pack:mac:masdev": "npm run clean:dist && npm run build:macos-extension:masdev && electron-builder --mac mas-dev --universal -p never",
+    "pack:local:mac": "npm run clean:dist && npm run build:macos-extension:masdev && electron-builder --mac mas-dev --universal -p never -c.mac.provisioningProfile=\"\" -c.mas.provisioningProfile=\"\"",
     "pack:win": "npm run clean:dist && electron-builder --win --x64 --arm64 --ia32 -p never -c.win.signtoolOptions.certificateSubjectName=\"8bit Solutions LLC\"",
     "pack:win:beta": "npm run clean:dist && electron-builder --config electron-builder.beta.json --win --x64 --arm64 --ia32 -p never -c.win.signtoolOptions.certificateSubjectName=\"8bit Solutions LLC\"",
     "pack:win:ci": "npm run clean:dist && electron-builder --win --x64 --arm64 --ia32 -p never",
@@ -55,11 +55,8 @@
     "dist:lin": "npm run build && npm run pack:lin",
     "dist:lin:arm64": "npm run build && npm run pack:lin:arm64",
     "dist:mac": "npm run build && npm run pack:mac",
-    "dist:mac:with-extension": "npm run build && npm run pack:mac:with-extension",
     "dist:mac:mas": "npm run build && npm run pack:mac:mas",
-    "dist:mac:mas:with-extension": "npm run build && npm run pack:mac:mas:with-extension",
-    "dist:mac:masdev": "npm run build:dev && npm run pack:mac:masdev",
-    "dist:mac:masdev:with-extension": "npm run build:dev && npm run pack:mac:masdev:with-extension",
+    "dist:mac:masdev": "npm run build && npm run pack:mac:masdev",
     "dist:win": "npm run build && npm run pack:win",
     "dist:win:ci": "npm run build && npm run pack:win:ci",
     "publish:lin": "npm run build && npm run clean:dist && electron-builder --linux --x64 -p always",
diff --git a/apps/desktop/resources/entitlements.mac.plist b/apps/desktop/resources/entitlements.mac.plist
index fe49256d71c..7763b84624d 100644
--- a/apps/desktop/resources/entitlements.mac.plist
+++ b/apps/desktop/resources/entitlements.mac.plist
@@ -6,8 +6,6 @@
 	<string>LTZ2PFU5D6.com.bitwarden.desktop</string>
 	<key>com.apple.developer.team-identifier</key>
 	<string>LTZ2PFU5D6</string>
-	<key>com.apple.developer.authentication-services.autofill-credential-provider</key>
-	<true/>
 	<key>com.apple.security.cs.allow-jit</key>
 	<true/>
 </dict>
diff --git a/apps/desktop/resources/entitlements.mas.inherit.plist b/apps/desktop/resources/entitlements.mas.inherit.plist
index fca5f02d52d..7194d9409fc 100644
--- a/apps/desktop/resources/entitlements.mas.inherit.plist
+++ b/apps/desktop/resources/entitlements.mas.inherit.plist
@@ -4,9 +4,9 @@
 <dict>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
-	<key>com.apple.security.inherit</key>
-	<true/>
 	<key>com.apple.security.cs.allow-jit</key>
 	<true/>
+	<key>com.apple.security.inherit</key>
+	<true/>
 </dict>
 </plist>
diff --git a/apps/desktop/resources/entitlements.mas.plist b/apps/desktop/resources/entitlements.mas.plist
index 3ebd56f0fd7..226e9827e37 100644
--- a/apps/desktop/resources/entitlements.mas.plist
+++ b/apps/desktop/resources/entitlements.mas.plist
@@ -6,19 +6,19 @@
 	<string>LTZ2PFU5D6.com.bitwarden.desktop</string>
 	<key>com.apple.developer.team-identifier</key>
 	<string>LTZ2PFU5D6</string>
-	<key>com.apple.developer.authentication-services.autofill-credential-provider</key>
-	<true/>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
 		<string>LTZ2PFU5D6.com.bitwarden.desktop</string>
 	</array>
-	<key>com.apple.security.network.client</key>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.device.usb</key>
 	<true/>
 	<key>com.apple.security.files.user-selected.read-write</key>
 	<true/>
-	<key>com.apple.security.device.usb</key>
+	<key>com.apple.security.network.client</key>
 	<true/>
 	<key>com.apple.security.temporary-exception.files.home-relative-path.read-write</key>
 	<array>
@@ -32,10 +32,9 @@
 		<string>/Library/Application Support/Microsoft Edge Beta/NativeMessagingHosts/</string>
 		<string>/Library/Application Support/Microsoft Edge Dev/NativeMessagingHosts/</string>
 		<string>/Library/Application Support/Microsoft Edge Canary/NativeMessagingHosts/</string>
-        <string>/Library/Application Support/Vivaldi/NativeMessagingHosts/</string>
+		<string>/Library/Application Support/Vivaldi/NativeMessagingHosts/</string>
 		<string>/Library/Application Support/Zen/NativeMessagingHosts/</string>
+		<string>/Library/Application Support/net.imput.helium</string>
 	</array>
-	<key>com.apple.security.cs.allow-jit</key>
-	<true/>
 </dict>
 </plist>
diff --git a/apps/desktop/scripts/after-sign.js b/apps/desktop/scripts/after-sign.js
index 7c9ad381dc2..4275ec7d051 100644
--- a/apps/desktop/scripts/after-sign.js
+++ b/apps/desktop/scripts/after-sign.js
@@ -16,7 +16,7 @@ async function run(context) {
   const appPath = `${context.appOutDir}/${appName}.app`;
   const macBuild = context.electronPlatformName === "darwin";
   const copySafariExtension = ["darwin", "mas"].includes(context.electronPlatformName);
-  const copyAutofillExtension = ["darwin", "mas"].includes(context.electronPlatformName);
+  const copyAutofillExtension = ["darwin"].includes(context.electronPlatformName); // Disabled for mas builds
 
   let shouldResign = false;
 
diff --git a/apps/desktop/scripts/nx-serve.js b/apps/desktop/scripts/nx-serve.js
index b92a045f8e8..235691f9ce8 100644
--- a/apps/desktop/scripts/nx-serve.js
+++ b/apps/desktop/scripts/nx-serve.js
@@ -37,6 +37,6 @@ concurrently(
   {
     prefix: "name",
     outputStream: process.stdout,
-    killOthers: ["success", "failure"],
+    killOthersOn: ["success", "failure"],
   },
 );
diff --git a/apps/desktop/scripts/start.js b/apps/desktop/scripts/start.js
index 0e11ebd9083..4ffbe2eebeb 100644
--- a/apps/desktop/scripts/start.js
+++ b/apps/desktop/scripts/start.js
@@ -34,6 +34,6 @@ concurrently(
   {
     prefix: "name",
     outputStream: process.stdout,
-    killOthers: ["success", "failure"],
+    killOthersOn: ["success", "failure"],
   },
 );
diff --git a/apps/desktop/src/app/accounts/settings.component.html b/apps/desktop/src/app/accounts/settings.component.html
index 8abd84ee39c..d5042918d2f 100644
--- a/apps/desktop/src/app/accounts/settings.component.html
+++ b/apps/desktop/src/app/accounts/settings.component.html
@@ -44,12 +44,12 @@
                     <h2 bitTypography="h6">{{ "vaultTimeoutHeader" | i18n }}</h2>
                   </bit-section-header>
 
-                  <bit-session-timeout-input
+                  <bit-session-timeout-input-legacy
                     [vaultTimeoutOptions]="vaultTimeoutOptions"
                     [formControl]="form.controls.vaultTimeout"
                     ngDefaultControl
                   >
-                  </bit-session-timeout-input>
+                  </bit-session-timeout-input-legacy>
 
                   <bit-form-field disableMargin>
                     <bit-label for="vaultTimeoutAction">{{
diff --git a/apps/desktop/src/app/accounts/settings.component.ts b/apps/desktop/src/app/accounts/settings.component.ts
index 68863312ffe..e3022428421 100644
--- a/apps/desktop/src/app/accounts/settings.component.ts
+++ b/apps/desktop/src/app/accounts/settings.component.ts
@@ -55,7 +55,7 @@ import {
 } from "@bitwarden/components";
 import { KeyService, BiometricStateService, BiometricsStatus } from "@bitwarden/key-management";
 import {
-  SessionTimeoutInputComponent,
+  SessionTimeoutInputLegacyComponent,
   SessionTimeoutSettingsComponent,
 } from "@bitwarden/key-management-ui";
 import { PermitCipherDetailsPopoverComponent } from "@bitwarden/vault";
@@ -97,7 +97,7 @@ import { NativeMessagingManifestService } from "../services/native-messaging-man
     SectionHeaderComponent,
     SelectModule,
     TypographyModule,
-    SessionTimeoutInputComponent,
+    SessionTimeoutInputLegacyComponent,
     SessionTimeoutSettingsComponent,
     PermitCipherDetailsPopoverComponent,
     PremiumBadgeComponent,
diff --git a/apps/desktop/src/app/app-routing.module.ts b/apps/desktop/src/app/app-routing.module.ts
index f822a9ae4d9..42f9d7ae779 100644
--- a/apps/desktop/src/app/app-routing.module.ts
+++ b/apps/desktop/src/app/app-routing.module.ts
@@ -43,7 +43,11 @@ import {
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { PremiumUpgradePromptService } from "@bitwarden/common/vault/abstractions/premium-upgrade-prompt.service";
 import { AnonLayoutWrapperComponent, AnonLayoutWrapperData } from "@bitwarden/components";
-import { LockComponent, ConfirmKeyConnectorDomainComponent } from "@bitwarden/key-management-ui";
+import {
+  LockComponent,
+  ConfirmKeyConnectorDomainComponent,
+  RemovePasswordComponent,
+} from "@bitwarden/key-management-ui";
 import {
   VaultFilterServiceAbstraction,
   VaultFilterService,
@@ -52,12 +56,13 @@ import {
 } from "@bitwarden/vault";
 
 import { maxAccountsGuardFn } from "../auth/guards/max-accounts.guard";
-import { RemovePasswordComponent } from "../key-management/key-connector/remove-password.component";
-import { DesktopPremiumUpgradePromptService } from "../services/desktop-premium-upgrade-prompt.service";
+import { reactiveUnlockVaultGuard } from "../autofill/guards/reactive-vault-guard";
+import { Fido2CreateComponent } from "../autofill/modal/credentials/fido2-create.component";
+import { Fido2ExcludedCiphersComponent } from "../autofill/modal/credentials/fido2-excluded-ciphers.component";
+import { Fido2VaultComponent } from "../autofill/modal/credentials/fido2-vault.component";
 import { VaultV2Component } from "../vault/app/vault/vault-v2.component";
 import { VaultComponent } from "../vault/app/vault-v3/vault.component";
 
-import { Fido2PlaceholderComponent } from "./components/fido2placeholder.component";
 import { DesktopLayoutComponent } from "./layout/desktop-layout.component";
 import { SendComponent } from "./tools/send/send.component";
 import { SendV2Component } from "./tools/send-v2/send-v2.component";
@@ -123,17 +128,16 @@ const routes: Routes = [
     canActivate: [authGuard],
   },
   {
-    path: "remove-password",
-    component: RemovePasswordComponent,
-    canActivate: [authGuard],
+    path: "fido2-assertion",
+    component: Fido2VaultComponent,
   },
   {
-    path: "passkeys",
-    component: Fido2PlaceholderComponent,
+    path: "fido2-creation",
+    component: Fido2CreateComponent,
   },
   {
-    path: "passkeys",
-    component: Fido2PlaceholderComponent,
+    path: "fido2-excluded",
+    component: Fido2ExcludedCiphersComponent,
   },
   {
     path: "",
@@ -279,7 +283,7 @@ const routes: Routes = [
       },
       {
         path: "lock",
-        canActivate: [lockGuard()],
+        canActivate: [lockGuard(), reactiveUnlockVaultGuard],
         data: {
           pageIcon: LockIcon,
           pageTitle: {
@@ -328,13 +332,24 @@ const routes: Routes = [
           pageIcon: LockIcon,
         } satisfies AnonLayoutWrapperData,
       },
+      {
+        path: "remove-password",
+        component: RemovePasswordComponent,
+        canActivate: [authGuard],
+        data: {
+          pageTitle: {
+            key: "verifyYourOrganization",
+          },
+          pageIcon: LockIcon,
+        } satisfies RouteDataProperties & AnonLayoutWrapperData,
+      },
       {
         path: "confirm-key-connector-domain",
         component: ConfirmKeyConnectorDomainComponent,
         canActivate: [],
         data: {
           pageTitle: {
-            key: "confirmKeyConnectorDomain",
+            key: "verifyYourOrganization",
           },
           pageIcon: DomainIcon,
         } satisfies RouteDataProperties & AnonLayoutWrapperData,
diff --git a/apps/desktop/src/app/app.component.ts b/apps/desktop/src/app/app.component.ts
index 6243ba1e538..836328142b5 100644
--- a/apps/desktop/src/app/app.component.ts
+++ b/apps/desktop/src/app/app.component.ts
@@ -104,7 +104,7 @@ const SyncInterval = 6 * 60 * 60 * 1000; // 6 hours
     <ng-template #exportVault></ng-template>
     <ng-template #appGenerator></ng-template>
     <ng-template #loginApproval></ng-template>
-    <app-header></app-header>
+    <app-header *ngIf="showHeader$ | async"></app-header>
 
     <div id="container">
       <div class="loading" *ngIf="loading">
@@ -141,6 +141,7 @@ export class AppComponent implements OnInit, OnDestroy {
   @ViewChild("loginApproval", { read: ViewContainerRef, static: true })
   loginApprovalModalRef: ViewContainerRef;
 
+  showHeader$ = this.accountService.showHeader$;
   loading = false;
 
   private lastActivity: Date = null;
diff --git a/apps/desktop/src/app/app.module.ts b/apps/desktop/src/app/app.module.ts
index 4f53e587994..31131c6202a 100644
--- a/apps/desktop/src/app/app.module.ts
+++ b/apps/desktop/src/app/app.module.ts
@@ -15,7 +15,6 @@ import { DeleteAccountComponent } from "../auth/delete-account.component";
 import { LoginModule } from "../auth/login/login.module";
 import { SshAgentService } from "../autofill/services/ssh-agent.service";
 import { PremiumComponent } from "../billing/app/accounts/premium.component";
-import { RemovePasswordComponent } from "../key-management/key-connector/remove-password.component";
 import { VaultFilterModule } from "../vault/app/vault/vault-filter/vault-filter.module";
 import { VaultV2Component } from "../vault/app/vault/vault-v2.component";
 
@@ -50,7 +49,6 @@ import { SharedModule } from "./shared/shared.module";
     ColorPasswordCountPipe,
     HeaderComponent,
     PremiumComponent,
-    RemovePasswordComponent,
     SearchComponent,
   ],
   providers: [SshAgentService],
diff --git a/apps/desktop/src/app/components/fido2placeholder.component.ts b/apps/desktop/src/app/components/fido2placeholder.component.ts
deleted file mode 100644
index f1f52dae439..00000000000
--- a/apps/desktop/src/app/components/fido2placeholder.component.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { CommonModule } from "@angular/common";
-import { Component, OnDestroy, OnInit } from "@angular/core";
-import { Router } from "@angular/router";
-import { BehaviorSubject, Observable } from "rxjs";
-
-import {
-  DesktopFido2UserInterfaceService,
-  DesktopFido2UserInterfaceSession,
-} from "../../autofill/services/desktop-fido2-user-interface.service";
-import { DesktopSettingsService } from "../../platform/services/desktop-settings.service";
-
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
-@Component({
-  standalone: true,
-  imports: [CommonModule],
-  template: `
-    <div
-      style="background:white; display:flex; justify-content: center; align-items: center; flex-direction: column"
-    >
-      <h1 style="color: black">Select your passkey</h1>
-
-      <div *ngFor="let item of cipherIds$ | async">
-        <button
-          style="color:black; padding: 10px 20px; border: 1px solid blue; margin: 10px"
-          bitButton
-          type="button"
-          buttonType="secondary"
-          (click)="chooseCipher(item)"
-        >
-          {{ item }}
-        </button>
-      </div>
-
-      <br />
-      <button
-        style="color:black; padding: 10px 20px; border: 1px solid black; margin: 10px"
-        bitButton
-        type="button"
-        buttonType="secondary"
-        (click)="confirmPasskey()"
-      >
-        Confirm passkey
-      </button>
-      <button
-        style="color:black; padding: 10px 20px; border: 1px solid black; margin: 10px"
-        bitButton
-        type="button"
-        buttonType="secondary"
-        (click)="closeModal()"
-      >
-        Close
-      </button>
-    </div>
-  `,
-})
-export class Fido2PlaceholderComponent implements OnInit, OnDestroy {
-  session?: DesktopFido2UserInterfaceSession = null;
-  private cipherIdsSubject = new BehaviorSubject<string[]>([]);
-  cipherIds$: Observable<string[]>;
-
-  constructor(
-    private readonly desktopSettingsService: DesktopSettingsService,
-    private readonly fido2UserInterfaceService: DesktopFido2UserInterfaceService,
-    private readonly router: Router,
-  ) {}
-
-  ngOnInit() {
-    this.session = this.fido2UserInterfaceService.getCurrentSession();
-    this.cipherIds$ = this.session?.availableCipherIds$;
-  }
-
-  async chooseCipher(cipherId: string) {
-    // For now: Set UV to true
-    this.session?.confirmChosenCipher(cipherId, true);
-
-    await this.router.navigate(["/"]);
-    await this.desktopSettingsService.setModalMode(false);
-  }
-
-  ngOnDestroy() {
-    this.cipherIdsSubject.complete(); // Clean up the BehaviorSubject
-  }
-
-  async confirmPasskey() {
-    try {
-      // Retrieve the current UI session to control the flow
-      if (!this.session) {
-        // todo: handle error
-        throw new Error("No session found");
-      }
-
-      // If we want to we could submit information to the session in order to create the credential
-      // const cipher = await session.createCredential({
-      //   userHandle: "userHandle2",
-      //   userName: "username2",
-      //   credentialName: "zxsd2",
-      //   rpId: "webauthn.io",
-      //   userVerification: true,
-      // });
-
-      this.session.notifyConfirmNewCredential(true);
-
-      // Not sure this clean up should happen here or in session.
-      // The session currently toggles modal on and send us here
-      // But if this route is somehow opened outside of session we want to make sure we clean up?
-      await this.router.navigate(["/"]);
-      await this.desktopSettingsService.setModalMode(false);
-    } catch {
-      // TODO: Handle error appropriately
-    }
-  }
-
-  async closeModal() {
-    await this.router.navigate(["/"]);
-    await this.desktopSettingsService.setModalMode(false);
-
-    this.session.notifyConfirmNewCredential(false);
-    // little bit hacky:
-    this.session.confirmChosenCipher(null);
-  }
-}
diff --git a/apps/desktop/src/app/layout/desktop-layout.component.html b/apps/desktop/src/app/layout/desktop-layout.component.html
index dd4c77f1021..b0edb64f723 100644
--- a/apps/desktop/src/app/layout/desktop-layout.component.html
+++ b/apps/desktop/src/app/layout/desktop-layout.component.html
@@ -1,9 +1,9 @@
-<bit-layout>
+<bit-layout class="!tw-h-full">
   <app-side-nav slot="side-nav">
     <bit-nav-logo [openIcon]="logo" route="." [label]="'passwordManager' | i18n"></bit-nav-logo>
 
     <app-vault-filter></app-vault-filter>
-    <bit-nav-item icon="bwi-send" [text]="'send' | i18n" route="new-sends"></bit-nav-item>
+    <app-send-filters-nav></app-send-filters-nav>
   </app-side-nav>
 
   <router-outlet></router-outlet>
diff --git a/apps/desktop/src/app/layout/desktop-layout.component.spec.ts b/apps/desktop/src/app/layout/desktop-layout.component.spec.ts
index cc2f7e58dfb..74cddd02495 100644
--- a/apps/desktop/src/app/layout/desktop-layout.component.spec.ts
+++ b/apps/desktop/src/app/layout/desktop-layout.component.spec.ts
@@ -1,3 +1,4 @@
+import { ChangeDetectionStrategy, Component } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { RouterModule } from "@angular/router";
 import { mock } from "jest-mock-extended";
@@ -5,8 +6,18 @@ import { mock } from "jest-mock-extended";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { NavigationModule } from "@bitwarden/components";
 
+import { SendFiltersNavComponent } from "../tools/send-v2/send-filters-nav.component";
+
 import { DesktopLayoutComponent } from "./desktop-layout.component";
 
+// Mock the child component to isolate DesktopLayoutComponent testing
+@Component({
+  selector: "app-send-filters-nav",
+  template: "",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+class MockSendFiltersNavComponent {}
+
 Object.defineProperty(window, "matchMedia", {
   writable: true,
   value: jest.fn().mockImplementation((query) => ({
@@ -34,7 +45,12 @@ describe("DesktopLayoutComponent", () => {
           useValue: mock<I18nService>(),
         },
       ],
-    }).compileComponents();
+    })
+      .overrideComponent(DesktopLayoutComponent, {
+        remove: { imports: [SendFiltersNavComponent] },
+        add: { imports: [MockSendFiltersNavComponent] },
+      })
+      .compileComponents();
 
     fixture = TestBed.createComponent(DesktopLayoutComponent);
     component = fixture.componentInstance;
@@ -58,4 +74,11 @@ describe("DesktopLayoutComponent", () => {
 
     expect(ngContent).toBeTruthy();
   });
+
+  it("renders send filters navigation component", () => {
+    const compiled = fixture.nativeElement;
+    const sendFiltersNav = compiled.querySelector("app-send-filters-nav");
+
+    expect(sendFiltersNav).toBeTruthy();
+  });
 });
diff --git a/apps/desktop/src/app/layout/desktop-layout.component.ts b/apps/desktop/src/app/layout/desktop-layout.component.ts
index 798b8a629a3..9d94a21007a 100644
--- a/apps/desktop/src/app/layout/desktop-layout.component.ts
+++ b/apps/desktop/src/app/layout/desktop-layout.component.ts
@@ -6,6 +6,7 @@ import { LayoutComponent, NavigationModule } from "@bitwarden/components";
 import { I18nPipe } from "@bitwarden/ui-common";
 
 import { VaultFilterComponent } from "../../vault/app/vault-v3/vault-filter/vault-filter.component";
+import { SendFiltersNavComponent } from "../tools/send-v2/send-filters-nav.component";
 
 import { DesktopSideNavComponent } from "./desktop-side-nav.component";
 
@@ -20,6 +21,7 @@ import { DesktopSideNavComponent } from "./desktop-side-nav.component";
     NavigationModule,
     DesktopSideNavComponent,
     VaultFilterComponent,
+    SendFiltersNavComponent,
   ],
   templateUrl: "./desktop-layout.component.html",
 })
diff --git a/apps/desktop/src/app/services/services.module.ts b/apps/desktop/src/app/services/services.module.ts
index 03d6eb5c908..e4dd144fa20 100644
--- a/apps/desktop/src/app/services/services.module.ts
+++ b/apps/desktop/src/app/services/services.module.ts
@@ -51,6 +51,7 @@ import {
 } from "@bitwarden/common/auth/abstractions/auth.service";
 import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
+import { TokenService } from "@bitwarden/common/auth/abstractions/token.service";
 import { AutofillSettingsServiceAbstraction } from "@bitwarden/common/autofill/services/autofill-settings.service";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions";
 import { ClientType } from "@bitwarden/common/enums";
@@ -62,6 +63,7 @@ import { WebCryptoFunctionService } from "@bitwarden/common/key-management/crypt
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { DefaultProcessReloadService } from "@bitwarden/common/key-management/services/default-process-reload.service";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
 import {
   VaultTimeoutSettingsService,
   VaultTimeoutStringType,
@@ -101,6 +103,7 @@ import { GlobalStateProvider, StateProvider } from "@bitwarden/common/platform/s
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { CipherService as CipherServiceAbstraction } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { DialogService, ToastService } from "@bitwarden/components";
+import { GeneratorServicesModule } from "@bitwarden/generator-components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
 import {
   KdfConfigService,
@@ -128,7 +131,7 @@ import { DesktopBiometricsService } from "../../key-management/biometrics/deskto
 import { RendererBiometricsService } from "../../key-management/biometrics/renderer-biometrics.service";
 import { ElectronKeyService } from "../../key-management/electron-key.service";
 import { DesktopLockComponentService } from "../../key-management/lock/services/desktop-lock-component.service";
-import { DesktopSessionTimeoutSettingsComponentService } from "../../key-management/session-timeout/services/desktop-session-timeout-settings-component.service";
+import { DesktopSessionTimeoutTypeService } from "../../key-management/session-timeout/services/desktop-session-timeout-type.service";
 import { flagEnabled } from "../../platform/flags";
 import { DesktopSettingsService } from "../../platform/services/desktop-settings.service";
 import { ElectronLogRendererService } from "../../platform/services/electron-log.renderer.service";
@@ -165,12 +168,12 @@ const safeProviders: SafeProvider[] = [
   safeProvider({
     provide: BiometricsService,
     useClass: RendererBiometricsService,
-    deps: [],
+    deps: [TokenService],
   }),
   safeProvider({
     provide: DesktopBiometricsService,
     useClass: RendererBiometricsService,
-    deps: [],
+    deps: [TokenService],
   }),
   safeProvider(NativeMessagingService),
   safeProvider(BiometricMessageHandlerService),
@@ -344,6 +347,7 @@ const safeProviders: SafeProvider[] = [
       ConfigService,
       Fido2AuthenticatorServiceAbstraction,
       AccountService,
+      AuthService,
       PlatformUtilsService,
     ],
   }),
@@ -484,15 +488,20 @@ const safeProviders: SafeProvider[] = [
     useClass: DesktopAutotypeDefaultSettingPolicy,
     deps: [AccountServiceAbstraction, AuthServiceAbstraction, InternalPolicyService, ConfigService],
   }),
+  safeProvider({
+    provide: SessionTimeoutTypeService,
+    useClass: DesktopSessionTimeoutTypeService,
+    deps: [],
+  }),
   safeProvider({
     provide: SessionTimeoutSettingsComponentService,
-    useClass: DesktopSessionTimeoutSettingsComponentService,
-    deps: [I18nServiceAbstraction],
+    useClass: SessionTimeoutSettingsComponentService,
+    deps: [I18nServiceAbstraction, SessionTimeoutTypeService, PolicyServiceAbstraction],
   }),
 ];
 
 @NgModule({
-  imports: [JslibServicesModule],
+  imports: [JslibServicesModule, GeneratorServicesModule],
   declarations: [],
   // Do not register your dependency here! Add it to the typesafeProviders array using the helper function
   providers: safeProviders,
diff --git a/apps/desktop/src/app/tools/import/import-desktop.component.html b/apps/desktop/src/app/tools/import/import-desktop.component.html
index 796d61e1b69..3ee2384691b 100644
--- a/apps/desktop/src/app/tools/import/import-desktop.component.html
+++ b/apps/desktop/src/app/tools/import/import-desktop.component.html
@@ -1,13 +1,21 @@
 <bit-dialog #dialog dialogSize="large" background="alt">
   <span bitDialogTitle>{{ "importData" | i18n }}</span>
   <ng-container bitDialogContent>
-    <tools-import
-      (formLoading)="this.loading = $event"
-      (formDisabled)="this.disabled = $event"
-      (onSuccessfulImport)="this.onSuccessfulImport($event)"
-      [onImportFromBrowser]="this.onImportFromBrowser"
-      [onLoadProfilesFromBrowser]="this.onLoadProfilesFromBrowser"
-    ></tools-import>
+    <div class="tw-relative">
+      <tools-import
+        (formLoading)="this.loading = $event"
+        (formDisabled)="this.disabled = $event"
+        (onSuccessfulImport)="this.onSuccessfulImport($event)"
+        [onImportFromBrowser]="this.onImportFromBrowser"
+        [onLoadProfilesFromBrowser]="this.onLoadProfilesFromBrowser"
+        [class.tw-invisible]="loading"
+      ></tools-import>
+      @if (loading) {
+        <div class="tw-absolute tw-inset-0 tw-flex tw-items-center tw-justify-center">
+          <i class="bwi bwi-spinner bwi-spin bwi-3x tw-text-primary-600" aria-hidden="true"></i>
+        </div>
+      }
+    </div>
   </ng-container>
   <ng-container bitDialogFooter>
     <button
diff --git a/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.html b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.html
new file mode 100644
index 00000000000..64c52b50a49
--- /dev/null
+++ b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.html
@@ -0,0 +1,25 @@
+<bit-nav-group
+  icon="bwi-send"
+  [text]="'send' | i18n"
+  route="new-sends"
+  (click)="selectTypeAndNavigate()"
+>
+  <bit-nav-item
+    icon="bwi-send"
+    [text]="'allSends' | i18n"
+    (click)="selectTypeAndNavigate(null); $event.stopPropagation()"
+    [forceActiveStyles]="activeSendType() === null"
+  ></bit-nav-item>
+  <bit-nav-item
+    icon="bwi-file-text"
+    [text]="'sendTypeText' | i18n"
+    (click)="selectTypeAndNavigate(SendType.Text); $event.stopPropagation()"
+    [forceActiveStyles]="activeSendType() === SendType.Text"
+  ></bit-nav-item>
+  <bit-nav-item
+    icon="bwi-file"
+    [text]="'sendTypeFile' | i18n"
+    (click)="selectTypeAndNavigate(SendType.File); $event.stopPropagation()"
+    [forceActiveStyles]="activeSendType() === SendType.File"
+  ></bit-nav-item>
+</bit-nav-group>
diff --git a/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.spec.ts b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.spec.ts
new file mode 100644
index 00000000000..95ba5c53e36
--- /dev/null
+++ b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.spec.ts
@@ -0,0 +1,204 @@
+import { ChangeDetectionStrategy, Component } from "@angular/core";
+import { ComponentFixture, TestBed } from "@angular/core/testing";
+import { Router, provideRouter } from "@angular/router";
+import { RouterTestingHarness } from "@angular/router/testing";
+import { BehaviorSubject } from "rxjs";
+
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { NavigationModule } from "@bitwarden/components";
+import { SendListFiltersService } from "@bitwarden/send-ui";
+
+import { SendFiltersNavComponent } from "./send-filters-nav.component";
+
+@Component({ template: "", changeDetection: ChangeDetectionStrategy.OnPush })
+class DummyComponent {}
+
+Object.defineProperty(window, "matchMedia", {
+  writable: true,
+  value: jest.fn().mockImplementation((query) => ({
+    matches: true,
+    media: query,
+    onchange: null,
+    addListener: jest.fn(),
+    removeListener: jest.fn(),
+    addEventListener: jest.fn(),
+    removeEventListener: jest.fn(),
+    dispatchEvent: jest.fn(),
+  })),
+});
+
+describe("SendFiltersNavComponent", () => {
+  let component: SendFiltersNavComponent;
+  let fixture: ComponentFixture<SendFiltersNavComponent>;
+  let harness: RouterTestingHarness;
+  let filterFormValueSubject: BehaviorSubject<{ sendType: SendType | null }>;
+  let mockSendListFiltersService: Partial<SendListFiltersService>;
+
+  beforeEach(async () => {
+    filterFormValueSubject = new BehaviorSubject<{ sendType: SendType | null }>({
+      sendType: null,
+    });
+
+    mockSendListFiltersService = {
+      filterForm: {
+        value: { sendType: null },
+        valueChanges: filterFormValueSubject.asObservable(),
+        patchValue: jest.fn((value) => {
+          mockSendListFiltersService.filterForm.value = {
+            ...mockSendListFiltersService.filterForm.value,
+            ...value,
+          };
+          filterFormValueSubject.next(mockSendListFiltersService.filterForm.value);
+        }),
+      } as any,
+      filters$: filterFormValueSubject.asObservable(),
+    };
+
+    await TestBed.configureTestingModule({
+      imports: [SendFiltersNavComponent, NavigationModule],
+      providers: [
+        provideRouter([
+          { path: "vault", component: DummyComponent },
+          { path: "new-sends", component: DummyComponent },
+        ]),
+        {
+          provide: SendListFiltersService,
+          useValue: mockSendListFiltersService,
+        },
+        {
+          provide: I18nService,
+          useValue: {
+            t: jest.fn((key) => key),
+          },
+        },
+      ],
+    }).compileComponents();
+
+    // Create harness and navigate to initial route
+    harness = await RouterTestingHarness.create("/vault");
+
+    // Create the component fixture separately (not a routed component)
+    fixture = TestBed.createComponent(SendFiltersNavComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it("creates component", () => {
+    expect(component).toBeTruthy();
+  });
+
+  it("renders bit-nav-group with Send icon and text", () => {
+    const compiled = fixture.nativeElement;
+    const navGroup = compiled.querySelector("bit-nav-group");
+
+    expect(navGroup).toBeTruthy();
+    expect(navGroup.getAttribute("icon")).toBe("bwi-send");
+  });
+
+  it("component exposes SendType enum for template", () => {
+    expect(component["SendType"]).toBe(SendType);
+  });
+
+  describe("isSendRouteActive", () => {
+    it("returns true when on /new-sends route", async () => {
+      await harness.navigateByUrl("/new-sends");
+      fixture.detectChanges();
+
+      expect(component["isSendRouteActive"]()).toBe(true);
+    });
+
+    it("returns false when not on /new-sends route", () => {
+      expect(component["isSendRouteActive"]()).toBe(false);
+    });
+  });
+
+  describe("activeSendType", () => {
+    it("returns the active send type when on send route and filter type is set", async () => {
+      await harness.navigateByUrl("/new-sends");
+      mockSendListFiltersService.filterForm.value = { sendType: SendType.Text };
+      filterFormValueSubject.next({ sendType: SendType.Text });
+      fixture.detectChanges();
+
+      expect(component["activeSendType"]()).toBe(SendType.Text);
+    });
+
+    it("returns undefined when not on send route", () => {
+      mockSendListFiltersService.filterForm.value = { sendType: SendType.Text };
+      filterFormValueSubject.next({ sendType: SendType.Text });
+      fixture.detectChanges();
+
+      expect(component["activeSendType"]()).toBeUndefined();
+    });
+
+    it("returns null when on send route but no type is selected", async () => {
+      await harness.navigateByUrl("/new-sends");
+      mockSendListFiltersService.filterForm.value = { sendType: null };
+      filterFormValueSubject.next({ sendType: null });
+      fixture.detectChanges();
+
+      expect(component["activeSendType"]()).toBeNull();
+    });
+  });
+
+  describe("selectTypeAndNavigate", () => {
+    it("clears the sendType filter when called with no parameter", async () => {
+      await component["selectTypeAndNavigate"]();
+
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: null,
+      });
+    });
+
+    it("updates filter form with Text type", async () => {
+      await component["selectTypeAndNavigate"](SendType.Text);
+
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: SendType.Text,
+      });
+    });
+
+    it("updates filter form with File type", async () => {
+      await component["selectTypeAndNavigate"](SendType.File);
+
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: SendType.File,
+      });
+    });
+
+    it("navigates to /new-sends when not on send route", async () => {
+      expect(harness.routeNativeElement?.textContent).toBeDefined();
+
+      await component["selectTypeAndNavigate"](SendType.Text);
+
+      const currentUrl = TestBed.inject(Router).url;
+      expect(currentUrl).toBe("/new-sends");
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: SendType.Text,
+      });
+    });
+
+    it("does not navigate when already on send route (component is reactive)", async () => {
+      await harness.navigateByUrl("/new-sends");
+      const router = TestBed.inject(Router);
+      const navigateSpy = jest.spyOn(router, "navigate");
+
+      await component["selectTypeAndNavigate"](SendType.Text);
+
+      expect(navigateSpy).not.toHaveBeenCalled();
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: SendType.Text,
+      });
+    });
+
+    it("navigates when clearing filter from different route", async () => {
+      await component["selectTypeAndNavigate"](); // No parameter = clear filter
+
+      const currentUrl = TestBed.inject(Router).url;
+      expect(currentUrl).toBe("/new-sends");
+      expect(mockSendListFiltersService.filterForm.patchValue).toHaveBeenCalledWith({
+        sendType: null,
+      });
+    });
+  });
+});
diff --git a/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.ts b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.ts
new file mode 100644
index 00000000000..28004f475e5
--- /dev/null
+++ b/apps/desktop/src/app/tools/send-v2/send-filters-nav.component.ts
@@ -0,0 +1,54 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, computed, inject } from "@angular/core";
+import { toSignal } from "@angular/core/rxjs-interop";
+import { NavigationEnd, Router } from "@angular/router";
+import { filter, map, startWith } from "rxjs";
+
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { NavigationModule } from "@bitwarden/components";
+import { SendListFiltersService } from "@bitwarden/send-ui";
+import { I18nPipe } from "@bitwarden/ui-common";
+
+/**
+ * Navigation component that renders Send filter options in the sidebar.
+ * Fully reactive using signals - no manual subscriptions or method-based computed values.
+ * - Parent "Send" nav-group clears filter (shows all sends)
+ * - Child "Text"/"File" items set filter to specific type
+ * - Active states computed reactively from filter signal + route signal
+ */
+@Component({
+  selector: "app-send-filters-nav",
+  templateUrl: "./send-filters-nav.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [CommonModule, NavigationModule, I18nPipe],
+})
+export class SendFiltersNavComponent {
+  protected readonly SendType = SendType;
+  private readonly filtersService = inject(SendListFiltersService);
+  private readonly router = inject(Router);
+  private readonly currentFilter = toSignal(this.filtersService.filters$);
+
+  // Track whether current route is the send route
+  private readonly isSendRouteActive = toSignal(
+    this.router.events.pipe(
+      filter((event) => event instanceof NavigationEnd),
+      map((event) => (event as NavigationEnd).urlAfterRedirects.includes("/new-sends")),
+      startWith(this.router.url.includes("/new-sends")),
+    ),
+    { initialValue: this.router.url.includes("/new-sends") },
+  );
+
+  // Computed: Active send type (null when on send route with no filter, undefined when not on send route)
+  protected readonly activeSendType = computed(() => {
+    return this.isSendRouteActive() ? this.currentFilter()?.sendType : undefined;
+  });
+
+  // Update send filter and navigate to /new-sends (only if not already there - send-v2 component reacts to filter changes)
+  protected async selectTypeAndNavigate(type?: SendType): Promise<void> {
+    this.filtersService.filterForm.patchValue({ sendType: type !== undefined ? type : null });
+
+    if (!this.router.url.includes("/new-sends")) {
+      await this.router.navigate(["/new-sends"]);
+    }
+  }
+}
diff --git a/apps/desktop/src/app/tools/send-v2/send-v2.component.html b/apps/desktop/src/app/tools/send-v2/send-v2.component.html
new file mode 100644
index 00000000000..20cac15138a
--- /dev/null
+++ b/apps/desktop/src/app/tools/send-v2/send-v2.component.html
@@ -0,0 +1,110 @@
+<div id="sends" class="vault">
+  <div id="items" class="items">
+    <div class="content">
+      <div class="list full-height" *ngIf="filteredSends && filteredSends.length">
+        <button
+          type="button"
+          *ngFor="let s of filteredSends"
+          appStopClick
+          (click)="selectSend(s.id)"
+          title="{{ 'viewItem' | i18n }}"
+          (contextmenu)="viewSendMenu(s)"
+          [ngClass]="{ active: s.id === sendId }"
+          [attr.aria-pressed]="s.id === sendId"
+          class="flex-list-item"
+        >
+          <span class="item-icon" aria-hidden="true">
+            <i class="bwi bwi-fw bwi-lg" [ngClass]="s.type == 0 ? 'bwi-file-text' : 'bwi-file'"></i>
+          </span>
+          <span class="item-content">
+            <span class="item-title">
+              {{ s.name }}
+              <span class="title-badges">
+                <ng-container *ngIf="s.disabled">
+                  <i
+                    class="bwi bwi-exclamation-triangle"
+                    appStopProp
+                    title="{{ 'disabled' | i18n }}"
+                    aria-hidden="true"
+                  ></i>
+                  <span class="sr-only">{{ "disabled" | i18n }}</span>
+                </ng-container>
+                <ng-container *ngIf="s.password">
+                  <i
+                    class="bwi bwi-key"
+                    appStopProp
+                    title="{{ 'password' | i18n }}"
+                    aria-hidden="true"
+                  ></i>
+                  <span class="sr-only">{{ "password" | i18n }}</span>
+                </ng-container>
+                <ng-container *ngIf="s.maxAccessCountReached">
+                  <i
+                    class="bwi bwi-exclamation-triangle"
+                    appStopProp
+                    title="{{ 'maxAccessCountReached' | i18n }}"
+                    aria-hidden="true"
+                  ></i>
+                  <span class="sr-only">{{ "maxAccessCountReached" | i18n }}</span>
+                </ng-container>
+                <ng-container *ngIf="s.expired">
+                  <i
+                    class="bwi bwi-clock"
+                    appStopProp
+                    title="{{ 'expired' | i18n }}"
+                    aria-hidden="true"
+                  ></i>
+                  <span class="sr-only">{{ "expired" | i18n }}</span>
+                </ng-container>
+                <ng-container *ngIf="s.pendingDelete">
+                  <i
+                    class="bwi bwi-trash"
+                    appStopProp
+                    title="{{ 'pendingDeletion' | i18n }}"
+                    aria-hidden="true"
+                  ></i>
+                  <span class="sr-only">{{ "pendingDeletion" | i18n }}</span>
+                </ng-container>
+              </span>
+            </span>
+            <span class="item-details">{{ s.deletionDate | date }}</span>
+          </span>
+        </button>
+      </div>
+      <div class="no-items" *ngIf="!filteredSends || !filteredSends.length">
+        <i class="bwi bwi-spinner bwi-spin bwi-3x" *ngIf="!loaded" aria-hidden="true"></i>
+        <ng-container *ngIf="loaded">
+          <img class="no-items-image" aria-hidden="true" />
+          <p>{{ "noItemsInList" | i18n }}</p>
+        </ng-container>
+      </div>
+      <div class="footer">
+        <button
+          type="button"
+          (click)="addSend()"
+          class="block primary"
+          appA11yTitle="{{ 'addItem' | i18n }}"
+        >
+          <i class="bwi bwi-plus bwi-lg" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+  <app-send-add-edit
+    id="addEdit"
+    class="details"
+    *ngIf="action == 'add' || action == 'edit'"
+    [sendId]="sendId"
+    [type]="selectedSendType"
+    (onSavedSend)="savedSend($event)"
+    (onCancelled)="cancel($event)"
+    (onDeletedSend)="deletedSend($event)"
+  ></app-send-add-edit>
+  <div class="logo" *ngIf="!action">
+    <div class="content">
+      <div class="inner-content">
+        <img class="logo-image" alt="Bitwarden" aria-hidden="true" />
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/apps/desktop/src/app/tools/send-v2/send-v2.component.spec.ts b/apps/desktop/src/app/tools/send-v2/send-v2.component.spec.ts
index 8055bc07667..8657f3e375e 100644
--- a/apps/desktop/src/app/tools/send-v2/send-v2.component.spec.ts
+++ b/apps/desktop/src/app/tools/send-v2/send-v2.component.spec.ts
@@ -1,22 +1,386 @@
+// FIXME: Update this file to be type safe and remove this and next line
+// @ts-strict-ignore
+import { ChangeDetectorRef } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
+import { FormBuilder } from "@angular/forms";
+import { mock, MockProxy } from "jest-mock-extended";
+import { BehaviorSubject, of } from "rxjs";
+
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { SendView } from "@bitwarden/common/tools/send/models/view/send.view";
+import { SendApiService } from "@bitwarden/common/tools/send/services/send-api.service.abstraction";
+import { SendService } from "@bitwarden/common/tools/send/services/send.service.abstraction";
+import { SearchService } from "@bitwarden/common/vault/abstractions/search.service";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { SendListFiltersService } from "@bitwarden/send-ui";
+
+import * as utils from "../../../utils";
+import { SearchBarService } from "../../layout/search/search-bar.service";
+import { AddEditComponent } from "../send/add-edit.component";
 
 import { SendV2Component } from "./send-v2.component";
 
+// Mock the invokeMenu utility function
+jest.mock("../../../utils", () => ({
+  invokeMenu: jest.fn(),
+}));
+
 describe("SendV2Component", () => {
   let component: SendV2Component;
   let fixture: ComponentFixture<SendV2Component>;
+  let sendService: MockProxy<SendService>;
+  let searchBarService: MockProxy<SearchBarService>;
+  let broadcasterService: MockProxy<BroadcasterService>;
+  let accountService: MockProxy<AccountService>;
+  let policyService: MockProxy<PolicyService>;
+  let sendListFiltersService: SendListFiltersService;
+  let changeDetectorRef: MockProxy<ChangeDetectorRef>;
 
   beforeEach(async () => {
+    sendService = mock<SendService>();
+    searchBarService = mock<SearchBarService>();
+    broadcasterService = mock<BroadcasterService>();
+    accountService = mock<AccountService>();
+    policyService = mock<PolicyService>();
+    changeDetectorRef = mock<ChangeDetectorRef>();
+
+    // Create real SendListFiltersService with mocked dependencies
+    const formBuilder = new FormBuilder();
+    const i18nService = mock<I18nService>();
+    i18nService.t.mockImplementation((key: string) => key);
+    sendListFiltersService = new SendListFiltersService(i18nService, formBuilder);
+
+    // Mock sendViews$ observable
+    sendService.sendViews$ = of([]);
+    searchBarService.searchText$ = new BehaviorSubject<string>("");
+
+    // Mock activeAccount$ observable for parent class ngOnInit
+    accountService.activeAccount$ = of({ id: "test-user-id" } as any);
+    policyService.policyAppliesToUser$ = jest.fn().mockReturnValue(of(false));
+
+    // Mock SearchService methods needed by base component
+    const mockSearchService = mock<SearchService>();
+    mockSearchService.isSearchable.mockResolvedValue(false);
+
     await TestBed.configureTestingModule({
       imports: [SendV2Component],
+      providers: [
+        { provide: SendService, useValue: sendService },
+        { provide: I18nService, useValue: mock<I18nService>() },
+        { provide: PlatformUtilsService, useValue: mock<PlatformUtilsService>() },
+        { provide: EnvironmentService, useValue: mock<EnvironmentService>() },
+        { provide: BroadcasterService, useValue: broadcasterService },
+        { provide: SearchService, useValue: mockSearchService },
+        { provide: PolicyService, useValue: policyService },
+        { provide: SearchBarService, useValue: searchBarService },
+        { provide: LogService, useValue: mock<LogService>() },
+        { provide: SendApiService, useValue: mock<SendApiService>() },
+        { provide: DialogService, useValue: mock<DialogService>() },
+        { provide: ToastService, useValue: mock<ToastService>() },
+        { provide: AccountService, useValue: accountService },
+        { provide: SendListFiltersService, useValue: sendListFiltersService },
+        { provide: ChangeDetectorRef, useValue: changeDetectorRef },
+      ],
     }).compileComponents();
 
     fixture = TestBed.createComponent(SendV2Component);
     component = fixture.componentInstance;
-    fixture.detectChanges();
   });
 
   it("creates component", () => {
     expect(component).toBeTruthy();
   });
+
+  it("initializes with correct default action", () => {
+    expect(component.action).toBe("");
+  });
+
+  it("subscribes to broadcaster service on init", async () => {
+    await component.ngOnInit();
+    expect(broadcasterService.subscribe).toHaveBeenCalledWith(
+      "SendV2Component",
+      expect.any(Function),
+    );
+  });
+
+  it("unsubscribes from broadcaster service on destroy", () => {
+    component.ngOnDestroy();
+    expect(broadcasterService.unsubscribe).toHaveBeenCalledWith("SendV2Component");
+  });
+
+  it("enables search bar on init", async () => {
+    await component.ngOnInit();
+    expect(searchBarService.setEnabled).toHaveBeenCalledWith(true);
+  });
+
+  it("disables search bar on destroy", () => {
+    component.ngOnDestroy();
+    expect(searchBarService.setEnabled).toHaveBeenCalledWith(false);
+  });
+
+  describe("addSend", () => {
+    it("sets action to Add", async () => {
+      await component.addSend();
+      expect(component.action).toBe("add");
+    });
+
+    it("calls resetAndLoad on addEditComponent when component exists", async () => {
+      const mockAddEdit = mock<AddEditComponent>();
+      component.addEditComponent = mockAddEdit;
+
+      await component.addSend();
+
+      expect(mockAddEdit.resetAndLoad).toHaveBeenCalled();
+    });
+
+    it("does not throw when addEditComponent is null", async () => {
+      component.addEditComponent = null;
+      await expect(component.addSend()).resolves.not.toThrow();
+    });
+  });
+
+  describe("cancel", () => {
+    it("resets action to None", () => {
+      component.action = "edit";
+      component.sendId = "test-id";
+
+      component.cancel(new SendView());
+
+      expect(component.action).toBe("");
+      expect(component.sendId).toBeNull();
+    });
+  });
+
+  describe("deletedSend", () => {
+    it("refreshes the list and resets action and sendId", async () => {
+      component.action = "edit";
+      component.sendId = "test-id";
+      jest.spyOn(component, "refresh").mockResolvedValue();
+
+      const mockSend = new SendView();
+      await component.deletedSend(mockSend);
+
+      expect(component.refresh).toHaveBeenCalled();
+      expect(component.action).toBe("");
+      expect(component.sendId).toBeNull();
+    });
+  });
+
+  describe("savedSend", () => {
+    it("refreshes the list and selects the saved send", async () => {
+      jest.spyOn(component, "refresh").mockResolvedValue();
+      jest.spyOn(component, "selectSend").mockResolvedValue();
+
+      const mockSend = new SendView();
+      mockSend.id = "saved-send-id";
+
+      await component.savedSend(mockSend);
+
+      expect(component.refresh).toHaveBeenCalled();
+      expect(component.selectSend).toHaveBeenCalledWith("saved-send-id");
+    });
+  });
+
+  describe("selectSend", () => {
+    it("sets action to Edit and updates sendId", async () => {
+      await component.selectSend("new-send-id");
+
+      expect(component.action).toBe("edit");
+      expect(component.sendId).toBe("new-send-id");
+    });
+
+    it("updates addEditComponent when it exists", async () => {
+      const mockAddEdit = mock<AddEditComponent>();
+      component.addEditComponent = mockAddEdit;
+
+      await component.selectSend("test-send-id");
+
+      expect(mockAddEdit.sendId).toBe("test-send-id");
+      expect(mockAddEdit.refresh).toHaveBeenCalled();
+    });
+
+    it("does not reload if same send is already selected in edit mode", async () => {
+      const mockAddEdit = mock<AddEditComponent>();
+      component.addEditComponent = mockAddEdit;
+      component.sendId = "same-id";
+      component.action = "edit";
+
+      await component.selectSend("same-id");
+
+      expect(mockAddEdit.refresh).not.toHaveBeenCalled();
+    });
+
+    it("reloads if selecting different send", async () => {
+      const mockAddEdit = mock<AddEditComponent>();
+      component.addEditComponent = mockAddEdit;
+      component.sendId = "old-id";
+      component.action = "edit";
+
+      await component.selectSend("new-id");
+
+      expect(mockAddEdit.refresh).toHaveBeenCalled();
+    });
+  });
+
+  describe("selectedSendType", () => {
+    it("returns the type of the currently selected send", () => {
+      const mockSend1 = new SendView();
+      mockSend1.id = "send-1";
+      mockSend1.type = SendType.Text;
+
+      const mockSend2 = new SendView();
+      mockSend2.id = "send-2";
+      mockSend2.type = SendType.File;
+
+      component.sends = [mockSend1, mockSend2];
+      component.sendId = "send-2";
+
+      expect(component.selectedSendType).toBe(SendType.File);
+    });
+
+    it("returns undefined when no send is selected", () => {
+      component.sends = [];
+      component.sendId = "non-existent";
+
+      expect(component.selectedSendType).toBeUndefined();
+    });
+
+    it("returns undefined when sendId is null", () => {
+      const mockSend = new SendView();
+      mockSend.id = "send-1";
+      mockSend.type = SendType.Text;
+
+      component.sends = [mockSend];
+      component.sendId = null;
+
+      expect(component.selectedSendType).toBeUndefined();
+    });
+  });
+
+  describe("viewSendMenu", () => {
+    let mockSend: SendView;
+
+    beforeEach(() => {
+      mockSend = new SendView();
+      mockSend.id = "test-send";
+      mockSend.name = "Test Send";
+      jest.clearAllMocks();
+    });
+
+    it("creates menu with copy link option", () => {
+      jest.spyOn(component, "copy").mockResolvedValue();
+
+      component.viewSendMenu(mockSend);
+
+      expect(utils.invokeMenu).toHaveBeenCalled();
+      const menuItems = (utils.invokeMenu as jest.Mock).mock.calls[0][0];
+      expect(menuItems.length).toBeGreaterThanOrEqual(2); // At minimum: copy link + delete
+    });
+
+    it("includes remove password option when send has password and is not disabled", () => {
+      mockSend.password = "test-password";
+      mockSend.disabled = false;
+      jest.spyOn(component, "removePassword").mockResolvedValue(true);
+
+      component.viewSendMenu(mockSend);
+
+      expect(utils.invokeMenu).toHaveBeenCalled();
+      const menuItems = (utils.invokeMenu as jest.Mock).mock.calls[0][0];
+      expect(menuItems.length).toBe(3); // copy link + remove password + delete
+    });
+
+    it("excludes remove password option when send has no password", () => {
+      mockSend.password = null;
+      mockSend.disabled = false;
+
+      component.viewSendMenu(mockSend);
+
+      expect(utils.invokeMenu).toHaveBeenCalled();
+      const menuItems = (utils.invokeMenu as jest.Mock).mock.calls[0][0];
+      expect(menuItems.length).toBe(2); // copy link + delete (no remove password)
+    });
+
+    it("excludes remove password option when send is disabled", () => {
+      mockSend.password = "test-password";
+      mockSend.disabled = true;
+
+      component.viewSendMenu(mockSend);
+
+      expect(utils.invokeMenu).toHaveBeenCalled();
+      const menuItems = (utils.invokeMenu as jest.Mock).mock.calls[0][0];
+      expect(menuItems.length).toBe(2); // copy link + delete (no remove password)
+    });
+
+    it("always includes delete option", () => {
+      jest.spyOn(component, "delete").mockResolvedValue(true);
+      jest.spyOn(component, "deletedSend").mockResolvedValue();
+
+      component.viewSendMenu(mockSend);
+
+      expect(utils.invokeMenu).toHaveBeenCalled();
+      const menuItems = (utils.invokeMenu as jest.Mock).mock.calls[0][0];
+      // Delete is always the last item in the menu
+      expect(menuItems.length).toBeGreaterThan(0);
+      expect(menuItems[menuItems.length - 1]).toHaveProperty("label");
+      expect(menuItems[menuItems.length - 1]).toHaveProperty("click");
+    });
+  });
+
+  describe("search bar subscription", () => {
+    it("updates searchText when search bar text changes", () => {
+      const searchSubject = new BehaviorSubject<string>("initial");
+      searchBarService.searchText$ = searchSubject;
+
+      // Create new component to trigger constructor subscription
+      fixture = TestBed.createComponent(SendV2Component);
+      component = fixture.componentInstance;
+
+      searchSubject.next("new search text");
+
+      expect(component.searchText).toBe("new search text");
+    });
+  });
+
+  describe("load", () => {
+    it("sets loading states correctly", async () => {
+      jest.spyOn(component, "search").mockResolvedValue();
+
+      expect(component.loaded).toBeFalsy();
+
+      await component.load();
+
+      expect(component.loading).toBe(false);
+      expect(component.loaded).toBe(true);
+    });
+
+    it("sets up sendViews$ subscription", async () => {
+      const mockSends = [new SendView(), new SendView()];
+      sendService.sendViews$ = of(mockSends);
+      jest.spyOn(component, "search").mockResolvedValue();
+
+      await component.load();
+
+      // Give observable time to emit
+      await new Promise((resolve) => setTimeout(resolve, 10));
+
+      expect(component.sends).toEqual(mockSends);
+    });
+
+    it("calls onSuccessfulLoad when it is set", async () => {
+      jest.spyOn(component, "search").mockResolvedValue();
+      const mockCallback = jest.fn().mockResolvedValue(undefined);
+      component.onSuccessfulLoad = mockCallback;
+
+      await component.load();
+
+      expect(mockCallback).toHaveBeenCalled();
+    });
+  });
 });
diff --git a/apps/desktop/src/app/tools/send-v2/send-v2.component.ts b/apps/desktop/src/app/tools/send-v2/send-v2.component.ts
index 4840cd4cce8..eb0856b76af 100644
--- a/apps/desktop/src/app/tools/send-v2/send-v2.component.ts
+++ b/apps/desktop/src/app/tools/send-v2/send-v2.component.ts
@@ -1,9 +1,261 @@
-import { Component, ChangeDetectionStrategy } from "@angular/core";
+// FIXME: Update this file to be type safe and remove this and next line
+// @ts-strict-ignore
+import { CommonModule } from "@angular/common";
+import { Component, OnInit, OnDestroy, ViewChild, NgZone, ChangeDetectorRef } from "@angular/core";
+import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
+import { FormsModule } from "@angular/forms";
+import { mergeMap, Subscription } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { SendComponent as BaseSendComponent } from "@bitwarden/angular/tools/send/send.component";
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { SendView } from "@bitwarden/common/tools/send/models/view/send.view";
+import { SendApiService } from "@bitwarden/common/tools/send/services/send-api.service.abstraction";
+import { SendService } from "@bitwarden/common/tools/send/services/send.service.abstraction";
+import { SearchService } from "@bitwarden/common/vault/abstractions/search.service";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { SendListFiltersService } from "@bitwarden/send-ui";
+
+import { invokeMenu, RendererMenuItem } from "../../../utils";
+import { SearchBarService } from "../../layout/search/search-bar.service";
+import { AddEditComponent } from "../send/add-edit.component";
+
+const Action = Object.freeze({
+  /** No action is currently active. */
+  None: "",
+  /** The user is adding a new Send. */
+  Add: "add",
+  /** The user is editing an existing Send. */
+  Edit: "edit",
+} as const);
+
+type Action = (typeof Action)[keyof typeof Action];
+
+const BroadcasterSubscriptionId = "SendV2Component";
+
+// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
+// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-send-v2",
-  imports: [],
-  template: "<p>Sends V2 Component</p>",
-  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [CommonModule, JslibModule, FormsModule, AddEditComponent],
+  templateUrl: "./send-v2.component.html",
 })
-export class SendV2Component {}
+export class SendV2Component extends BaseSendComponent implements OnInit, OnDestroy {
+  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
+  // eslint-disable-next-line @angular-eslint/prefer-signals
+  @ViewChild(AddEditComponent) addEditComponent: AddEditComponent;
+
+  // The ID of the currently selected Send item being viewed or edited
+  sendId: string;
+
+  // Tracks the current UI state: viewing list (None), adding new Send (Add), or editing existing Send (Edit)
+  action: Action = Action.None;
+
+  // Subscription for sendViews$ cleanup
+  private sendViewsSubscription: Subscription;
+
+  constructor(
+    sendService: SendService,
+    i18nService: I18nService,
+    platformUtilsService: PlatformUtilsService,
+    environmentService: EnvironmentService,
+    private broadcasterService: BroadcasterService,
+    ngZone: NgZone,
+    searchService: SearchService,
+    policyService: PolicyService,
+    private searchBarService: SearchBarService,
+    logService: LogService,
+    sendApiService: SendApiService,
+    dialogService: DialogService,
+    toastService: ToastService,
+    accountService: AccountService,
+    private cdr: ChangeDetectorRef,
+    private sendListFiltersService: SendListFiltersService,
+  ) {
+    super(
+      sendService,
+      i18nService,
+      platformUtilsService,
+      environmentService,
+      ngZone,
+      searchService,
+      policyService,
+      logService,
+      sendApiService,
+      dialogService,
+      toastService,
+      accountService,
+    );
+
+    // Listen to search bar changes and update the Send list filter
+    this.searchBarService.searchText$.pipe(takeUntilDestroyed()).subscribe((searchText) => {
+      this.searchText = searchText;
+      this.searchTextChanged();
+    });
+
+    // Listen to filter changes from sidebar navigation
+    this.sendListFiltersService.filterForm.valueChanges
+      .pipe(takeUntilDestroyed())
+      .subscribe((filters) => {
+        this.applySendTypeFilter(filters);
+      });
+  }
+
+  // Initialize the component: enable search bar, subscribe to sync events, and load Send items
+  async ngOnInit() {
+    this.searchBarService.setEnabled(true);
+    this.searchBarService.setPlaceholderText(this.i18nService.t("searchSends"));
+
+    await super.ngOnInit();
+
+    // Read current filter synchronously to avoid race condition on navigation
+    const currentFilter = this.sendListFiltersService.filterForm.value;
+    this.applySendTypeFilter(currentFilter);
+
+    // Listen for sync completion events to refresh the Send list
+    this.broadcasterService.subscribe(BroadcasterSubscriptionId, (message: any) => {
+      // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
+      // eslint-disable-next-line @typescript-eslint/no-floating-promises
+      this.ngZone.run(async () => {
+        switch (message.command) {
+          case "syncCompleted":
+            await this.load();
+            break;
+        }
+      });
+    });
+    await this.load();
+  }
+
+  // Apply send type filter to display: centralized logic for initial load and filter changes
+  private applySendTypeFilter(filters: Partial<{ sendType: SendType | null }>): void {
+    if (filters.sendType === null || filters.sendType === undefined) {
+      this.selectAll();
+    } else {
+      this.selectType(filters.sendType);
+    }
+  }
+
+  // Clean up subscriptions and disable search bar when component is destroyed
+  ngOnDestroy() {
+    this.sendViewsSubscription?.unsubscribe();
+    this.broadcasterService.unsubscribe(BroadcasterSubscriptionId);
+    this.searchBarService.setEnabled(false);
+  }
+
+  // Load Send items from the service and display them in the list.
+  // Subscribes to sendViews$ observable to get updates when Sends change.
+  // Manually triggers change detection to ensure UI updates immediately.
+  // Note: The filter parameter is ignored in this implementation for desktop-specific behavior.
+  async load(filter: (send: SendView) => boolean = null) {
+    this.loading = true;
+
+    // Recreate subscription on each load (required for sync refresh)
+    // Manual cleanup in ngOnDestroy is intentional - load() is called multiple times
+    this.sendViewsSubscription?.unsubscribe();
+
+    this.sendViewsSubscription = this.sendService.sendViews$
+      .pipe(
+        mergeMap(async (sends) => {
+          this.sends = sends;
+          await this.search(null);
+          // Trigger change detection after data updates
+          this.cdr.detectChanges();
+        }),
+      )
+      // eslint-disable-next-line rxjs-angular/prefer-takeuntil
+      .subscribe();
+    if (this.onSuccessfulLoad != null) {
+      await this.onSuccessfulLoad();
+    }
+    this.loading = false;
+    this.loaded = true;
+  }
+
+  // Open the add Send form to create a new Send item
+  async addSend() {
+    this.action = Action.Add;
+    if (this.addEditComponent != null) {
+      await this.addEditComponent.resetAndLoad();
+    }
+  }
+
+  // Close the add/edit form and return to the list view
+  cancel(s: SendView) {
+    this.action = Action.None;
+    this.sendId = null;
+  }
+
+  // Handle when a Send is deleted: refresh the list and close the edit form
+  async deletedSend(s: SendView) {
+    await this.refresh();
+    this.action = Action.None;
+    this.sendId = null;
+  }
+
+  // Handle when a Send is saved: refresh the list and re-select the saved Send
+  async savedSend(s: SendView) {
+    await this.refresh();
+    // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    this.selectSend(s.id);
+  }
+
+  // Select a Send from the list and open it in the edit form.
+  // If the same Send is already selected and in edit mode, do nothing to avoid unnecessary reloads.
+  async selectSend(sendId: string) {
+    if (sendId === this.sendId && this.action === Action.Edit) {
+      return;
+    }
+    this.action = Action.Edit;
+    this.sendId = sendId;
+    if (this.addEditComponent != null) {
+      this.addEditComponent.sendId = sendId;
+      await this.addEditComponent.refresh();
+    }
+  }
+
+  // Get the type (text or file) of the currently selected Send for the edit form
+  get selectedSendType() {
+    return this.sends.find((s) => s.id === this.sendId)?.type;
+  }
+
+  // Show the right-click context menu for a Send with options to copy link, remove password, or delete
+  viewSendMenu(send: SendView) {
+    const menu: RendererMenuItem[] = [];
+    menu.push({
+      label: this.i18nService.t("copyLink"),
+      click: () => this.copy(send),
+    });
+    if (send.password && !send.disabled) {
+      menu.push({
+        label: this.i18nService.t("removePassword"),
+        click: async () => {
+          await this.removePassword(send);
+          if (this.sendId === send.id) {
+            this.sendId = null;
+            // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
+            // eslint-disable-next-line @typescript-eslint/no-floating-promises
+            this.selectSend(send.id);
+          }
+        },
+      });
+    }
+    menu.push({
+      label: this.i18nService.t("delete"),
+      click: async () => {
+        await this.delete(send);
+        await this.deletedSend(send);
+      },
+    });
+
+    invokeMenu(menu);
+  }
+}
diff --git a/apps/desktop/src/app/tools/send/add-edit.component.html b/apps/desktop/src/app/tools/send/add-edit.component.html
index 0bf2e1778e0..639c80c9060 100644
--- a/apps/desktop/src/app/tools/send/add-edit.component.html
+++ b/apps/desktop/src/app/tools/send/add-edit.component.html
@@ -46,7 +46,9 @@
           </div>
           <div class="box-content-row" appBoxRow *ngIf="editMode && type === sendType.File">
             <label for="file">{{ "file" | i18n }}</label>
-            <div class="row-main">{{ send.file.fileName }} ({{ send.file.sizeName }})</div>
+            <div class="row-main tw-text-wrap tw-break-all">
+              {{ send.file.fileName }} ({{ send.file.sizeName }})
+            </div>
           </div>
           <div class="box-content-row" appBoxRow *ngIf="type === sendType.Text">
             <label for="text">{{ "text" | i18n }}</label>
diff --git a/apps/desktop/src/auth/login/desktop-login-component.service.spec.ts b/apps/desktop/src/auth/login/desktop-login-component.service.spec.ts
index c88627250c9..414bbaca56f 100644
--- a/apps/desktop/src/auth/login/desktop-login-component.service.spec.ts
+++ b/apps/desktop/src/auth/login/desktop-login-component.service.spec.ts
@@ -136,6 +136,7 @@ describe("DesktopLoginComponentService", () => {
             codeChallenge,
             state,
             email,
+            undefined,
           );
         } else {
           expect(ssoLoginService.setSsoState).toHaveBeenCalledWith(state);
@@ -145,4 +146,55 @@ describe("DesktopLoginComponentService", () => {
       });
     });
   });
+
+  describe("redirectToSsoLoginWithOrganizationSsoIdentifier", () => {
+    // Array of all permutations of isAppImage and isDev
+    const permutations = [
+      [true, false], // Case 1: isAppImage true
+      [false, true], // Case 2: isDev true
+      [true, true], // Case 3: all true
+      [false, false], // Case 4: all false
+    ];
+
+    permutations.forEach(([isAppImage, isDev]) => {
+      it("calls redirectToSso with orgSsoIdentifier", async () => {
+        (global as any).ipc.platform.isAppImage = isAppImage;
+        (global as any).ipc.platform.isDev = isDev;
+
+        const email = "test@bitwarden.com";
+        const state = "testState";
+        const codeVerifier = "testCodeVerifier";
+        const codeChallenge = "testCodeChallenge";
+        const orgSsoIdentifier = "orgSsoId";
+
+        passwordGenerationService.generatePassword.mockResolvedValueOnce(state);
+        passwordGenerationService.generatePassword.mockResolvedValueOnce(codeVerifier);
+        jest.spyOn(Utils, "fromBufferToUrlB64").mockReturnValue(codeChallenge);
+
+        await service.redirectToSsoLoginWithOrganizationSsoIdentifier(email, orgSsoIdentifier);
+
+        if (isAppImage || isDev) {
+          expect(ipc.platform.localhostCallbackService.openSsoPrompt).toHaveBeenCalledWith(
+            codeChallenge,
+            state,
+            email,
+            orgSsoIdentifier,
+          );
+        } else {
+          expect(ssoUrlService.buildSsoUrl).toHaveBeenCalledWith(
+            expect.any(String),
+            expect.any(String),
+            expect.any(String),
+            expect.any(String),
+            expect.any(String),
+            email,
+            orgSsoIdentifier,
+          );
+          expect(ssoLoginService.setSsoState).toHaveBeenCalledWith(state);
+          expect(ssoLoginService.setCodeVerifier).toHaveBeenCalledWith(codeVerifier);
+          expect(platformUtilsService.launchUri).toHaveBeenCalled();
+        }
+      });
+    });
+  });
 });
diff --git a/apps/desktop/src/auth/login/desktop-login-component.service.ts b/apps/desktop/src/auth/login/desktop-login-component.service.ts
index d7e7ba0178b..6ef39eaa018 100644
--- a/apps/desktop/src/auth/login/desktop-login-component.service.ts
+++ b/apps/desktop/src/auth/login/desktop-login-component.service.ts
@@ -48,11 +48,12 @@ export class DesktopLoginComponentService
     email: string,
     state: string,
     codeChallenge: string,
+    orgSsoIdentifier?: string,
   ): Promise<void> {
     // For platforms that cannot support a protocol-based (e.g. bitwarden://) callback, we use a localhost callback
     // Otherwise, we launch the SSO component in a browser window and wait for the callback
     if (ipc.platform.isAppImage || ipc.platform.isDev) {
-      await this.initiateSsoThroughLocalhostCallback(email, state, codeChallenge);
+      await this.initiateSsoThroughLocalhostCallback(email, state, codeChallenge, orgSsoIdentifier);
     } else {
       const env = await firstValueFrom(this.environmentService.environment$);
       const webVaultUrl = env.getWebVaultUrl();
@@ -66,6 +67,7 @@ export class DesktopLoginComponentService
         state,
         codeChallenge,
         email,
+        orgSsoIdentifier,
       );
 
       this.platformUtilsService.launchUri(ssoWebAppUrl);
@@ -76,9 +78,15 @@ export class DesktopLoginComponentService
     email: string,
     state: string,
     challenge: string,
+    orgSsoIdentifier?: string,
   ): Promise<void> {
     try {
-      await ipc.platform.localhostCallbackService.openSsoPrompt(challenge, state, email);
+      await ipc.platform.localhostCallbackService.openSsoPrompt(
+        challenge,
+        state,
+        email,
+        orgSsoIdentifier,
+      );
       // FIXME: Remove when updating file. Eslint update
       // eslint-disable-next-line @typescript-eslint/no-unused-vars
     } catch (err) {
diff --git a/apps/desktop/src/autofill/guards/reactive-vault-guard.ts b/apps/desktop/src/autofill/guards/reactive-vault-guard.ts
new file mode 100644
index 00000000000..d16787ef46a
--- /dev/null
+++ b/apps/desktop/src/autofill/guards/reactive-vault-guard.ts
@@ -0,0 +1,42 @@
+import { inject } from "@angular/core";
+import { CanActivateFn, Router } from "@angular/router";
+import { combineLatest, map, switchMap, distinctUntilChanged } from "rxjs";
+
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+
+import { DesktopSettingsService } from "../../platform/services/desktop-settings.service";
+
+/**
+ * Reactive route guard that redirects to the unlocked vault.
+ * Redirects to vault when unlocked in main window.
+ */
+export const reactiveUnlockVaultGuard: CanActivateFn = () => {
+  const router = inject(Router);
+  const authService = inject(AuthService);
+  const accountService = inject(AccountService);
+  const desktopSettingsService = inject(DesktopSettingsService);
+
+  return combineLatest([accountService.activeAccount$, desktopSettingsService.modalMode$]).pipe(
+    switchMap(([account, modalMode]) => {
+      if (!account) {
+        return [true];
+      }
+
+      // Monitor  when the vault has been unlocked.
+      return authService.authStatusFor$(account.id).pipe(
+        distinctUntilChanged(),
+        map((authStatus) => {
+          // If vault is unlocked and we're not in modal mode, redirect to vault
+          if (authStatus === AuthenticationStatus.Unlocked && !modalMode?.isModalModeActive) {
+            return router.createUrlTree(["/vault"]);
+          }
+
+          // Otherwise keep user on the lock screen
+          return true;
+        }),
+      );
+    }),
+  );
+};
diff --git a/apps/desktop/src/autofill/main/main-ssh-agent.service.ts b/apps/desktop/src/autofill/main/main-ssh-agent.service.ts
index 595ef778bcf..31196e4cf98 100644
--- a/apps/desktop/src/autofill/main/main-ssh-agent.service.ts
+++ b/apps/desktop/src/autofill/main/main-ssh-agent.service.ts
@@ -37,7 +37,7 @@ export class MainSshAgentService {
   init() {
     // handle sign request passing to UI
     sshagent
-      .serve(async (err: Error, sshUiRequest: sshagent.SshUiRequest) => {
+      .serve(async (err: Error | null, sshUiRequest: sshagent.SshUiRequest): Promise<boolean> => {
         // clear all old (> SIGN_TIMEOUT) requests
         this.requestResponses = this.requestResponses.filter(
           (response) => response.timestamp > new Date(Date.now() - this.SIGN_TIMEOUT),
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-create.component.html b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.html
new file mode 100644
index 00000000000..67fc76aa317
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.html
@@ -0,0 +1,66 @@
+<div class="tw-flex tw-flex-col tw-h-full tw-bg-background-alt">
+  <bit-section
+    disableMargin
+    class="tw-sticky tw-top-0 tw-z-10 tw-border-0 tw-border-b tw-border-solid tw-border-secondary-300"
+  >
+    <bit-section-header class="tw-app-region-drag tw-bg-background">
+      <div class="tw-flex tw-items-center">
+        <bit-icon [icon]="Icons.BitwardenShield" class="tw-w-10 tw-mt-2 tw-ml-2"></bit-icon>
+
+        <h2 bitTypography="h4" class="tw-font-semibold tw-text-lg">
+          {{ "savePasskeyQuestion" | i18n }}
+        </h2>
+      </div>
+
+      <button
+        type="button"
+        bitIconButton="bwi-close"
+        slot="end"
+        class="tw-app-region-no-drag tw-mb-4 tw-mr-2"
+        (click)="closeModal()"
+        [label]="'close' | i18n"
+      >
+        {{ "close" | i18n }}
+      </button>
+    </bit-section-header>
+  </bit-section>
+
+  <bit-section class="tw-bg-background-alt tw-p-4 tw-flex tw-flex-col">
+    <div *ngIf="(ciphers$ | async)?.length === 0; else hasCiphers">
+      <div class="tw-flex tw-items-center tw-flex-col tw-p-12 tw-gap-4">
+        <bit-icon [icon]="Icons.NoResults" class="tw-text-main"></bit-icon>
+        <div class="tw-flex tw-flex-col tw-gap-2">
+          {{ "noMatchingLoginsForSite" | i18n }}
+        </div>
+        <button bitButton type="button" buttonType="primary" (click)="confirmPasskey()">
+          {{ "savePasskeyNewLogin" | i18n }}
+        </button>
+      </div>
+    </div>
+    <ng-template #hasCiphers>
+      <bit-item *ngFor="let c of ciphers$ | async" class="">
+        <button type="button" bit-item-content (click)="addCredentialToCipher(c)">
+          <app-vault-icon [cipher]="c" slot="start"></app-vault-icon>
+          <button bitLink [title]="c.name" type="button">
+            {{ c.name }}
+          </button>
+          <span slot="secondary">{{ c.subTitle }}</span>
+          <span bitBadge slot="end">{{ "save" | i18n }}</span>
+        </button>
+      </bit-item>
+      <bit-item class="">
+        <button
+          bitLink
+          linkType="primary"
+          type="button"
+          bit-item-content
+          (click)="confirmPasskey()"
+        >
+          <a bitLink linkType="primary" class="tw-font-medium tw-text-base">
+            {{ "saveNewPasskey" | i18n }}
+          </a>
+        </button>
+      </bit-item>
+    </ng-template>
+  </bit-section>
+</div>
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-create.component.spec.ts b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.spec.ts
new file mode 100644
index 00000000000..778215895ee
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.spec.ts
@@ -0,0 +1,238 @@
+import { TestBed } from "@angular/core/testing";
+import { Router } from "@angular/router";
+import { mock, MockProxy } from "jest-mock-extended";
+import { BehaviorSubject, of } from "rxjs";
+
+import { AccountService, Account } from "@bitwarden/common/auth/abstractions/account.service";
+import { DomainSettingsService } from "@bitwarden/common/autofill/services/domain-settings.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { UserId } from "@bitwarden/common/types/guid";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherRepromptType, CipherType } from "@bitwarden/common/vault/enums";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { DialogService } from "@bitwarden/components";
+import { PasswordRepromptService } from "@bitwarden/vault";
+
+import { DesktopAutofillService } from "../../../autofill/services/desktop-autofill.service";
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+import { Fido2CreateComponent } from "./fido2-create.component";
+
+describe("Fido2CreateComponent", () => {
+  let component: Fido2CreateComponent;
+  let mockDesktopSettingsService: MockProxy<DesktopSettingsService>;
+  let mockFido2UserInterfaceService: MockProxy<DesktopFido2UserInterfaceService>;
+  let mockAccountService: MockProxy<AccountService>;
+  let mockCipherService: MockProxy<CipherService>;
+  let mockDesktopAutofillService: MockProxy<DesktopAutofillService>;
+  let mockDialogService: MockProxy<DialogService>;
+  let mockDomainSettingsService: MockProxy<DomainSettingsService>;
+  let mockLogService: MockProxy<LogService>;
+  let mockPasswordRepromptService: MockProxy<PasswordRepromptService>;
+  let mockRouter: MockProxy<Router>;
+  let mockSession: MockProxy<DesktopFido2UserInterfaceSession>;
+  let mockI18nService: MockProxy<I18nService>;
+
+  const activeAccountSubject = new BehaviorSubject<Account | null>({
+    id: "test-user-id" as UserId,
+    email: "test@example.com",
+    emailVerified: true,
+    name: "Test User",
+  });
+
+  beforeEach(async () => {
+    mockDesktopSettingsService = mock<DesktopSettingsService>();
+    mockFido2UserInterfaceService = mock<DesktopFido2UserInterfaceService>();
+    mockAccountService = mock<AccountService>();
+    mockCipherService = mock<CipherService>();
+    mockDesktopAutofillService = mock<DesktopAutofillService>();
+    mockDialogService = mock<DialogService>();
+    mockDomainSettingsService = mock<DomainSettingsService>();
+    mockLogService = mock<LogService>();
+    mockPasswordRepromptService = mock<PasswordRepromptService>();
+    mockRouter = mock<Router>();
+    mockSession = mock<DesktopFido2UserInterfaceSession>();
+    mockI18nService = mock<I18nService>();
+
+    mockFido2UserInterfaceService.getCurrentSession.mockReturnValue(mockSession);
+    mockAccountService.activeAccount$ = activeAccountSubject;
+
+    await TestBed.configureTestingModule({
+      providers: [
+        Fido2CreateComponent,
+        { provide: DesktopSettingsService, useValue: mockDesktopSettingsService },
+        { provide: DesktopFido2UserInterfaceService, useValue: mockFido2UserInterfaceService },
+        { provide: AccountService, useValue: mockAccountService },
+        { provide: CipherService, useValue: mockCipherService },
+        { provide: DesktopAutofillService, useValue: mockDesktopAutofillService },
+        { provide: DialogService, useValue: mockDialogService },
+        { provide: DomainSettingsService, useValue: mockDomainSettingsService },
+        { provide: LogService, useValue: mockLogService },
+        { provide: PasswordRepromptService, useValue: mockPasswordRepromptService },
+        { provide: Router, useValue: mockRouter },
+        { provide: I18nService, useValue: mockI18nService },
+      ],
+    }).compileComponents();
+
+    component = TestBed.inject(Fido2CreateComponent);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function createMockCiphers(): CipherView[] {
+    const cipher1 = new CipherView();
+    cipher1.id = "cipher-1";
+    cipher1.name = "Test Cipher 1";
+    cipher1.type = CipherType.Login;
+    cipher1.login = {
+      username: "test1@example.com",
+      uris: [{ uri: "https://example.com", match: null }],
+      matchesUri: jest.fn().mockReturnValue(true),
+      get hasFido2Credentials() {
+        return false;
+      },
+    } as any;
+    cipher1.reprompt = CipherRepromptType.None;
+    cipher1.deletedDate = null;
+
+    return [cipher1];
+  }
+
+  describe("ngOnInit", () => {
+    beforeEach(() => {
+      mockSession.getRpId.mockResolvedValue("example.com");
+      Object.defineProperty(mockDesktopAutofillService, "lastRegistrationRequest", {
+        get: jest.fn().mockReturnValue({
+          userHandle: new Uint8Array([1, 2, 3]),
+        }),
+        configurable: true,
+      });
+      mockDomainSettingsService.getUrlEquivalentDomains.mockReturnValue(of(new Set<string>()));
+    });
+
+    it("should initialize session and set show header to false", async () => {
+      const mockCiphers = createMockCiphers();
+      mockCipherService.getAllDecrypted.mockResolvedValue(mockCiphers);
+
+      await component.ngOnInit();
+
+      expect(mockFido2UserInterfaceService.getCurrentSession).toHaveBeenCalled();
+      expect(component.session).toBe(mockSession);
+    });
+
+    it("should show error dialog when no active session found", async () => {
+      mockFido2UserInterfaceService.getCurrentSession.mockReturnValue(null);
+      mockDialogService.openSimpleDialog.mockResolvedValue(false);
+
+      await component.ngOnInit();
+
+      expect(mockDialogService.openSimpleDialog).toHaveBeenCalledWith({
+        title: { key: "unableToSavePasskey" },
+        content: { key: "closeThisBitwardenWindow" },
+        type: "danger",
+        acceptButtonText: { key: "closeThisWindow" },
+        acceptAction: expect.any(Function),
+        cancelButtonText: null,
+      });
+    });
+  });
+
+  describe("addCredentialToCipher", () => {
+    beforeEach(() => {
+      component.session = mockSession;
+    });
+
+    it("should add passkey to cipher", async () => {
+      const cipher = createMockCiphers()[0];
+
+      await component.addCredentialToCipher(cipher);
+
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(true, cipher);
+    });
+
+    it("should not add passkey when password reprompt is cancelled", async () => {
+      const cipher = createMockCiphers()[0];
+      cipher.reprompt = CipherRepromptType.Password;
+      mockPasswordRepromptService.showPasswordPrompt.mockResolvedValue(false);
+
+      await component.addCredentialToCipher(cipher);
+
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(false, cipher);
+    });
+
+    it("should call openSimpleDialog when cipher already has a fido2 credential", async () => {
+      const cipher = createMockCiphers()[0];
+      Object.defineProperty(cipher.login, "hasFido2Credentials", {
+        get: jest.fn().mockReturnValue(true),
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(true);
+
+      await component.addCredentialToCipher(cipher);
+
+      expect(mockDialogService.openSimpleDialog).toHaveBeenCalledWith({
+        title: { key: "overwritePasskey" },
+        content: { key: "alreadyContainsPasskey" },
+        type: "warning",
+      });
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(true, cipher);
+    });
+
+    it("should not add passkey when user cancels overwrite dialog", async () => {
+      const cipher = createMockCiphers()[0];
+      Object.defineProperty(cipher.login, "hasFido2Credentials", {
+        get: jest.fn().mockReturnValue(true),
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(false);
+
+      await component.addCredentialToCipher(cipher);
+
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(false, cipher);
+    });
+  });
+
+  describe("confirmPasskey", () => {
+    beforeEach(() => {
+      component.session = mockSession;
+    });
+
+    it("should confirm passkey creation successfully", async () => {
+      await component.confirmPasskey();
+
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(true);
+    });
+
+    it("should call openSimpleDialog when session is null", async () => {
+      component.session = null;
+      mockDialogService.openSimpleDialog.mockResolvedValue(false);
+
+      await component.confirmPasskey();
+
+      expect(mockDialogService.openSimpleDialog).toHaveBeenCalledWith({
+        title: { key: "unableToSavePasskey" },
+        content: { key: "closeThisBitwardenWindow" },
+        type: "danger",
+        acceptButtonText: { key: "closeThisWindow" },
+        acceptAction: expect.any(Function),
+        cancelButtonText: null,
+      });
+    });
+  });
+
+  describe("closeModal", () => {
+    it("should close modal and notify session", async () => {
+      component.session = mockSession;
+
+      await component.closeModal();
+
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(false);
+      expect(mockSession.confirmChosenCipher).toHaveBeenCalledWith(null);
+    });
+  });
+});
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-create.component.ts b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.ts
new file mode 100644
index 00000000000..67237bedccd
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-create.component.ts
@@ -0,0 +1,219 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, OnInit, OnDestroy } from "@angular/core";
+import { RouterModule, Router } from "@angular/router";
+import { combineLatest, map, Observable, Subject, switchMap } from "rxjs";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { BitwardenShield, NoResults } from "@bitwarden/assets/svg";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { DomainSettingsService } from "@bitwarden/common/autofill/services/domain-settings.service";
+import { Fido2Utils } from "@bitwarden/common/platform/services/fido2/fido2-utils";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherType } from "@bitwarden/common/vault/enums/cipher-type";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import {
+  DialogService,
+  BadgeModule,
+  ButtonModule,
+  DialogModule,
+  IconModule,
+  ItemModule,
+  SectionComponent,
+  TableModule,
+  SectionHeaderComponent,
+  BitIconButtonComponent,
+  SimpleDialogOptions,
+} from "@bitwarden/components";
+import { PasswordRepromptService } from "@bitwarden/vault";
+
+import { DesktopAutofillService } from "../../../autofill/services/desktop-autofill.service";
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+@Component({
+  standalone: true,
+  imports: [
+    CommonModule,
+    RouterModule,
+    SectionHeaderComponent,
+    BitIconButtonComponent,
+    TableModule,
+    JslibModule,
+    IconModule,
+    ButtonModule,
+    DialogModule,
+    SectionComponent,
+    ItemModule,
+    BadgeModule,
+  ],
+  templateUrl: "fido2-create.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class Fido2CreateComponent implements OnInit, OnDestroy {
+  session?: DesktopFido2UserInterfaceSession = null;
+  ciphers$: Observable<CipherView[]>;
+  private destroy$ = new Subject<void>();
+  readonly Icons = { BitwardenShield, NoResults };
+
+  private get DIALOG_MESSAGES() {
+    return {
+      unexpectedErrorShort: {
+        title: { key: "unexpectedErrorShort" },
+        content: { key: "closeThisBitwardenWindow" },
+        type: "danger",
+        acceptButtonText: { key: "closeThisWindow" },
+        cancelButtonText: null as null,
+        acceptAction: async () => this.dialogService.closeAll(),
+      },
+      unableToSavePasskey: {
+        title: { key: "unableToSavePasskey" },
+        content: { key: "closeThisBitwardenWindow" },
+        type: "danger",
+        acceptButtonText: { key: "closeThisWindow" },
+        cancelButtonText: null as null,
+        acceptAction: async () => this.dialogService.closeAll(),
+      },
+      overwritePasskey: {
+        title: { key: "overwritePasskey" },
+        content: { key: "alreadyContainsPasskey" },
+        type: "warning",
+      },
+    } as const satisfies Record<string, SimpleDialogOptions>;
+  }
+
+  constructor(
+    private readonly desktopSettingsService: DesktopSettingsService,
+    private readonly fido2UserInterfaceService: DesktopFido2UserInterfaceService,
+    private readonly accountService: AccountService,
+    private readonly cipherService: CipherService,
+    private readonly desktopAutofillService: DesktopAutofillService,
+    private readonly dialogService: DialogService,
+    private readonly domainSettingsService: DomainSettingsService,
+    private readonly passwordRepromptService: PasswordRepromptService,
+    private readonly router: Router,
+  ) {}
+
+  async ngOnInit(): Promise<void> {
+    this.session = this.fido2UserInterfaceService.getCurrentSession();
+
+    if (this.session) {
+      const rpid = await this.session.getRpId();
+      this.initializeCiphersObservable(rpid);
+    } else {
+      await this.showErrorDialog(this.DIALOG_MESSAGES.unableToSavePasskey);
+    }
+  }
+
+  async ngOnDestroy(): Promise<void> {
+    this.destroy$.next();
+    this.destroy$.complete();
+    await this.closeModal();
+  }
+
+  async addCredentialToCipher(cipher: CipherView): Promise<void> {
+    const isConfirmed = await this.validateCipherAccess(cipher);
+
+    try {
+      if (!this.session) {
+        throw new Error("Missing session");
+      }
+
+      this.session.notifyConfirmCreateCredential(isConfirmed, cipher);
+    } catch {
+      await this.showErrorDialog(this.DIALOG_MESSAGES.unableToSavePasskey);
+      return;
+    }
+
+    await this.closeModal();
+  }
+
+  async confirmPasskey(): Promise<void> {
+    try {
+      if (!this.session) {
+        throw new Error("Missing session");
+      }
+
+      this.session.notifyConfirmCreateCredential(true);
+    } catch {
+      await this.showErrorDialog(this.DIALOG_MESSAGES.unableToSavePasskey);
+    }
+
+    await this.closeModal();
+  }
+
+  async closeModal(): Promise<void> {
+    await this.desktopSettingsService.setModalMode(false);
+    await this.accountService.setShowHeader(true);
+
+    if (this.session) {
+      this.session.notifyConfirmCreateCredential(false);
+      this.session.confirmChosenCipher(null);
+    }
+
+    await this.router.navigate(["/"]);
+  }
+
+  private initializeCiphersObservable(rpid: string): void {
+    const lastRegistrationRequest = this.desktopAutofillService.lastRegistrationRequest;
+
+    if (!lastRegistrationRequest || !rpid) {
+      return;
+    }
+
+    const userHandle = Fido2Utils.bufferToString(
+      new Uint8Array(lastRegistrationRequest.userHandle),
+    );
+
+    this.ciphers$ = combineLatest([
+      this.accountService.activeAccount$.pipe(map((a) => a?.id)),
+      this.domainSettingsService.getUrlEquivalentDomains(rpid),
+    ]).pipe(
+      switchMap(async ([activeUserId, equivalentDomains]) => {
+        if (!activeUserId) {
+          return [];
+        }
+
+        try {
+          const allCiphers = await this.cipherService.getAllDecrypted(activeUserId);
+          return allCiphers.filter(
+            (cipher) =>
+              cipher != null &&
+              cipher.type == CipherType.Login &&
+              cipher.login?.matchesUri(rpid, equivalentDomains) &&
+              Fido2Utils.cipherHasNoOtherPasskeys(cipher, userHandle) &&
+              !cipher.deletedDate,
+          );
+        } catch {
+          await this.showErrorDialog(this.DIALOG_MESSAGES.unexpectedErrorShort);
+          return [];
+        }
+      }),
+    );
+  }
+
+  private async validateCipherAccess(cipher: CipherView): Promise<boolean> {
+    if (cipher.login.hasFido2Credentials) {
+      const overwriteConfirmed = await this.dialogService.openSimpleDialog(
+        this.DIALOG_MESSAGES.overwritePasskey,
+      );
+
+      if (!overwriteConfirmed) {
+        return false;
+      }
+    }
+
+    if (cipher.reprompt) {
+      return this.passwordRepromptService.showPasswordPrompt();
+    }
+
+    return true;
+  }
+
+  private async showErrorDialog(config: SimpleDialogOptions): Promise<void> {
+    await this.dialogService.openSimpleDialog(config);
+    await this.closeModal();
+  }
+}
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.html b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.html
new file mode 100644
index 00000000000..792934deedc
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.html
@@ -0,0 +1,44 @@
+<div class="tw-flex tw-flex-col tw-h-full">
+  <bit-section
+    disableMargin
+    class="tw-border-0 tw-border-b tw-border-solid tw-border-secondary-300"
+  >
+    <bit-section-header class="tw-app-region-drag tw-bg-background">
+      <div class="tw-flex tw-items-center">
+        <bit-icon [icon]="Icons.BitwardenShield" class="tw-w-10 tw-mt-2 tw-ml-2"></bit-icon>
+
+        <h2 bitTypography="h4" class="tw-font-semibold tw-text-lg">
+          {{ "savePasskeyQuestion" | i18n }}
+        </h2>
+      </div>
+
+      <button
+        type="button"
+        bitIconButton="bwi-close"
+        slot="end"
+        class="tw-app-region-no-drag tw-mb-4 tw-mr-2"
+        (click)="closeModal()"
+        [label]="'close' | i18n"
+      >
+        {{ "close" | i18n }}
+      </button>
+    </bit-section-header>
+  </bit-section>
+
+  <div class="tw-h-full tw-items-start">
+    <bit-section
+      class="tw-flex tw-bg-background-alt tw-flex-col tw-justify-start tw-items-center tw-gap-2 tw-h-full tw-px-5"
+    >
+      <div class="tw-flex tw-items-center tw-flex-col tw-p-12 tw-gap-4">
+        <bit-icon [icon]="Icons.NoResults" class="tw-text-main"></bit-icon>
+        <div class="tw-flex tw-flex-col tw-gap-2">
+          <b>{{ "passkeyAlreadyExists" | i18n }}</b>
+          {{ "applicationDoesNotSupportDuplicates" | i18n }}
+        </div>
+        <button bitButton type="button" buttonType="primary" (click)="closeModal()">
+          {{ "close" | i18n }}
+        </button>
+      </div>
+    </bit-section>
+  </div>
+</div>
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.spec.ts b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.spec.ts
new file mode 100644
index 00000000000..6a465136458
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.spec.ts
@@ -0,0 +1,78 @@
+import { NO_ERRORS_SCHEMA } from "@angular/core";
+import { ComponentFixture, TestBed } from "@angular/core/testing";
+import { Router } from "@angular/router";
+import { mock, MockProxy } from "jest-mock-extended";
+
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+import { Fido2ExcludedCiphersComponent } from "./fido2-excluded-ciphers.component";
+
+describe("Fido2ExcludedCiphersComponent", () => {
+  let component: Fido2ExcludedCiphersComponent;
+  let fixture: ComponentFixture<Fido2ExcludedCiphersComponent>;
+  let mockDesktopSettingsService: MockProxy<DesktopSettingsService>;
+  let mockFido2UserInterfaceService: MockProxy<DesktopFido2UserInterfaceService>;
+  let mockAccountService: MockProxy<AccountService>;
+  let mockRouter: MockProxy<Router>;
+  let mockSession: MockProxy<DesktopFido2UserInterfaceSession>;
+  let mockI18nService: MockProxy<I18nService>;
+
+  beforeEach(async () => {
+    mockDesktopSettingsService = mock<DesktopSettingsService>();
+    mockFido2UserInterfaceService = mock<DesktopFido2UserInterfaceService>();
+    mockAccountService = mock<AccountService>();
+    mockRouter = mock<Router>();
+    mockSession = mock<DesktopFido2UserInterfaceSession>();
+    mockI18nService = mock<I18nService>();
+
+    mockFido2UserInterfaceService.getCurrentSession.mockReturnValue(mockSession);
+
+    await TestBed.configureTestingModule({
+      imports: [Fido2ExcludedCiphersComponent],
+      providers: [
+        { provide: DesktopSettingsService, useValue: mockDesktopSettingsService },
+        { provide: DesktopFido2UserInterfaceService, useValue: mockFido2UserInterfaceService },
+        { provide: AccountService, useValue: mockAccountService },
+        { provide: Router, useValue: mockRouter },
+        { provide: I18nService, useValue: mockI18nService },
+      ],
+      schemas: [NO_ERRORS_SCHEMA],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(Fido2ExcludedCiphersComponent);
+    component = fixture.componentInstance;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("ngOnInit", () => {
+    it("should initialize session", async () => {
+      await component.ngOnInit();
+
+      expect(mockFido2UserInterfaceService.getCurrentSession).toHaveBeenCalled();
+      expect(component.session).toBe(mockSession);
+    });
+  });
+
+  describe("closeModal", () => {
+    it("should close modal and notify session when session exists", async () => {
+      component.session = mockSession;
+
+      await component.closeModal();
+
+      expect(mockDesktopSettingsService.setModalMode).toHaveBeenCalledWith(false);
+      expect(mockAccountService.setShowHeader).toHaveBeenCalledWith(true);
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(false);
+      expect(mockRouter.navigate).toHaveBeenCalledWith(["/"]);
+    });
+  });
+});
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.ts b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.ts
new file mode 100644
index 00000000000..049771c2252
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-excluded-ciphers.component.ts
@@ -0,0 +1,78 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, OnInit, OnDestroy } from "@angular/core";
+import { RouterModule, Router } from "@angular/router";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { BitwardenShield, NoResults } from "@bitwarden/assets/svg";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import {
+  BadgeModule,
+  ButtonModule,
+  DialogModule,
+  IconModule,
+  ItemModule,
+  SectionComponent,
+  TableModule,
+  SectionHeaderComponent,
+  BitIconButtonComponent,
+} from "@bitwarden/components";
+
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+@Component({
+  standalone: true,
+  imports: [
+    CommonModule,
+    RouterModule,
+    SectionHeaderComponent,
+    BitIconButtonComponent,
+    TableModule,
+    JslibModule,
+    IconModule,
+    ButtonModule,
+    DialogModule,
+    SectionComponent,
+    ItemModule,
+    BadgeModule,
+  ],
+  templateUrl: "fido2-excluded-ciphers.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class Fido2ExcludedCiphersComponent implements OnInit, OnDestroy {
+  session?: DesktopFido2UserInterfaceSession = null;
+  readonly Icons = { BitwardenShield, NoResults };
+
+  constructor(
+    private readonly desktopSettingsService: DesktopSettingsService,
+    private readonly fido2UserInterfaceService: DesktopFido2UserInterfaceService,
+    private readonly accountService: AccountService,
+    private readonly router: Router,
+  ) {}
+
+  async ngOnInit(): Promise<void> {
+    this.session = this.fido2UserInterfaceService.getCurrentSession();
+  }
+
+  async ngOnDestroy(): Promise<void> {
+    await this.closeModal();
+  }
+
+  async closeModal(): Promise<void> {
+    // Clean up modal state
+    await this.desktopSettingsService.setModalMode(false);
+    await this.accountService.setShowHeader(true);
+
+    // Clean up session state
+    if (this.session) {
+      this.session.notifyConfirmCreateCredential(false);
+      this.session.confirmChosenCipher(null);
+    }
+
+    // Navigate away
+    await this.router.navigate(["/"]);
+  }
+}
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.html b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.html
new file mode 100644
index 00000000000..ed04993d09f
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.html
@@ -0,0 +1,37 @@
+<div class="tw-flex tw-flex-col tw-h-full">
+  <bit-section
+    disableMargin
+    class="tw-sticky tw-top-0 tw-z-10 tw-border-0 tw-border-b tw-border-solid tw-border-secondary-300"
+  >
+    <bit-section-header class="tw-app-region-drag tw-bg-background">
+      <div class="tw-flex tw-items-center">
+        <bit-icon [icon]="Icons.BitwardenShield" class="tw-w-10 tw-mt-2 tw-ml-2"></bit-icon>
+
+        <h2 bitTypography="h4" class="tw-font-semibold tw-text-lg">{{ "passkeyLogin" | i18n }}</h2>
+      </div>
+      <button
+        type="button"
+        bitIconButton="bwi-close"
+        slot="end"
+        class="tw-app-region-no-drag tw-mb-4 tw-mr-2"
+        (click)="closeModal()"
+        [label]="'close' | i18n"
+      >
+        {{ "close" | i18n }}
+      </button>
+    </bit-section-header>
+  </bit-section>
+
+  <bit-section class="tw-bg-background-alt tw-p-4 tw-flex tw-flex-col tw-grow">
+    <bit-item *ngFor="let c of ciphers$ | async" class="">
+      <button type="button" bit-item-content (click)="chooseCipher(c)">
+        <app-vault-icon [cipher]="c" slot="start"></app-vault-icon>
+        <button bitLink [title]="c.name" type="button">
+          {{ c.name }}
+        </button>
+        <span slot="secondary">{{ c.subTitle }}</span>
+        <span bitBadge slot="end">{{ "select" | i18n }}</span>
+      </button>
+    </bit-item>
+  </bit-section>
+</div>
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.spec.ts b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.spec.ts
new file mode 100644
index 00000000000..70ef4461f6a
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.spec.ts
@@ -0,0 +1,196 @@
+import { NO_ERRORS_SCHEMA } from "@angular/core";
+import { ComponentFixture, TestBed } from "@angular/core/testing";
+import { Router } from "@angular/router";
+import { mock, MockProxy } from "jest-mock-extended";
+import { of } from "rxjs";
+
+import { AccountService, Account } from "@bitwarden/common/auth/abstractions/account.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherRepromptType, CipherType } from "@bitwarden/common/vault/enums";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { PasswordRepromptService } from "@bitwarden/vault";
+
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+import { Fido2VaultComponent } from "./fido2-vault.component";
+
+describe("Fido2VaultComponent", () => {
+  let component: Fido2VaultComponent;
+  let fixture: ComponentFixture<Fido2VaultComponent>;
+  let mockDesktopSettingsService: MockProxy<DesktopSettingsService>;
+  let mockFido2UserInterfaceService: MockProxy<DesktopFido2UserInterfaceService>;
+  let mockCipherService: MockProxy<CipherService>;
+  let mockAccountService: MockProxy<AccountService>;
+  let mockLogService: MockProxy<LogService>;
+  let mockPasswordRepromptService: MockProxy<PasswordRepromptService>;
+  let mockRouter: MockProxy<Router>;
+  let mockSession: MockProxy<DesktopFido2UserInterfaceSession>;
+  let mockI18nService: MockProxy<I18nService>;
+
+  const mockActiveAccount = { id: "test-user-id", email: "test@example.com" };
+  const mockCipherIds = ["cipher-1", "cipher-2", "cipher-3"];
+
+  beforeEach(async () => {
+    mockDesktopSettingsService = mock<DesktopSettingsService>();
+    mockFido2UserInterfaceService = mock<DesktopFido2UserInterfaceService>();
+    mockCipherService = mock<CipherService>();
+    mockAccountService = mock<AccountService>();
+    mockLogService = mock<LogService>();
+    mockPasswordRepromptService = mock<PasswordRepromptService>();
+    mockRouter = mock<Router>();
+    mockSession = mock<DesktopFido2UserInterfaceSession>();
+    mockI18nService = mock<I18nService>();
+
+    mockAccountService.activeAccount$ = of(mockActiveAccount as Account);
+    mockFido2UserInterfaceService.getCurrentSession.mockReturnValue(mockSession);
+    mockSession.availableCipherIds$ = of(mockCipherIds);
+    mockCipherService.cipherListViews$ = jest.fn().mockReturnValue(of([]));
+
+    await TestBed.configureTestingModule({
+      imports: [Fido2VaultComponent],
+      providers: [
+        { provide: DesktopSettingsService, useValue: mockDesktopSettingsService },
+        { provide: DesktopFido2UserInterfaceService, useValue: mockFido2UserInterfaceService },
+        { provide: CipherService, useValue: mockCipherService },
+        { provide: AccountService, useValue: mockAccountService },
+        { provide: LogService, useValue: mockLogService },
+        { provide: PasswordRepromptService, useValue: mockPasswordRepromptService },
+        { provide: Router, useValue: mockRouter },
+        { provide: I18nService, useValue: mockI18nService },
+      ],
+      schemas: [NO_ERRORS_SCHEMA],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(Fido2VaultComponent);
+    component = fixture.componentInstance;
+  });
+
+  const mockCiphers: any[] = [
+    {
+      id: "cipher-1",
+      name: "Test Cipher 1",
+      type: CipherType.Login,
+      login: {
+        username: "test1@example.com",
+      },
+      reprompt: CipherRepromptType.None,
+      deletedDate: null,
+    },
+    {
+      id: "cipher-2",
+      name: "Test Cipher 2",
+      type: CipherType.Login,
+      login: {
+        username: "test2@example.com",
+      },
+      reprompt: CipherRepromptType.None,
+      deletedDate: null,
+    },
+    {
+      id: "cipher-3",
+      name: "Test Cipher 3",
+      type: CipherType.Login,
+      login: {
+        username: "test3@example.com",
+      },
+      reprompt: CipherRepromptType.Password,
+      deletedDate: null,
+    },
+  ];
+
+  describe("ngOnInit", () => {
+    it("should initialize session and load ciphers successfully", async () => {
+      mockCipherService.cipherListViews$ = jest.fn().mockReturnValue(of(mockCiphers));
+
+      await component.ngOnInit();
+
+      expect(mockFido2UserInterfaceService.getCurrentSession).toHaveBeenCalled();
+      expect(component.session).toBe(mockSession);
+      expect(component.cipherIds$).toBe(mockSession.availableCipherIds$);
+      expect(mockCipherService.cipherListViews$).toHaveBeenCalledWith(mockActiveAccount.id);
+    });
+
+    it("should handle when no active session found", async () => {
+      mockFido2UserInterfaceService.getCurrentSession.mockReturnValue(null);
+
+      await component.ngOnInit();
+
+      expect(component.session).toBeNull();
+    });
+
+    it("should filter out deleted ciphers", async () => {
+      const ciphersWithDeleted = [
+        ...mockCiphers.slice(0, 1),
+        { ...mockCiphers[1], deletedDate: new Date() },
+        ...mockCiphers.slice(2),
+      ];
+      mockCipherService.cipherListViews$ = jest.fn().mockReturnValue(of(ciphersWithDeleted));
+
+      await component.ngOnInit();
+      await new Promise((resolve) => setTimeout(resolve, 0));
+
+      let ciphersResult: CipherView[] = [];
+      component.ciphers$.subscribe((ciphers) => {
+        ciphersResult = ciphers;
+      });
+
+      expect(ciphersResult).toHaveLength(2);
+      expect(ciphersResult.every((cipher) => !cipher.deletedDate)).toBe(true);
+    });
+  });
+
+  describe("chooseCipher", () => {
+    const cipher = mockCiphers[0];
+
+    beforeEach(() => {
+      component.session = mockSession;
+    });
+
+    it("should choose cipher when access is validated", async () => {
+      cipher.reprompt = CipherRepromptType.None;
+
+      await component.chooseCipher(cipher);
+
+      expect(mockSession.confirmChosenCipher).toHaveBeenCalledWith(cipher.id, true);
+      expect(mockRouter.navigate).toHaveBeenCalledWith(["/"]);
+    });
+
+    it("should prompt for password when cipher requires reprompt", async () => {
+      cipher.reprompt = CipherRepromptType.Password;
+      mockPasswordRepromptService.showPasswordPrompt.mockResolvedValue(true);
+
+      await component.chooseCipher(cipher);
+
+      expect(mockPasswordRepromptService.showPasswordPrompt).toHaveBeenCalled();
+      expect(mockSession.confirmChosenCipher).toHaveBeenCalledWith(cipher.id, true);
+    });
+
+    it("should not choose cipher when password reprompt is cancelled", async () => {
+      cipher.reprompt = CipherRepromptType.Password;
+      mockPasswordRepromptService.showPasswordPrompt.mockResolvedValue(false);
+
+      await component.chooseCipher(cipher);
+
+      expect(mockPasswordRepromptService.showPasswordPrompt).toHaveBeenCalled();
+      expect(mockSession.confirmChosenCipher).toHaveBeenCalledWith(cipher.id, false);
+    });
+  });
+
+  describe("closeModal", () => {
+    it("should close modal and notify session", async () => {
+      component.session = mockSession;
+
+      await component.closeModal();
+
+      expect(mockRouter.navigate).toHaveBeenCalledWith(["/"]);
+      expect(mockSession.notifyConfirmCreateCredential).toHaveBeenCalledWith(false);
+      expect(mockSession.confirmChosenCipher).toHaveBeenCalledWith(null);
+    });
+  });
+});
diff --git a/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.ts b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.ts
new file mode 100644
index 00000000000..897e825c53e
--- /dev/null
+++ b/apps/desktop/src/autofill/modal/credentials/fido2-vault.component.ts
@@ -0,0 +1,161 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, OnInit, OnDestroy } from "@angular/core";
+import { RouterModule, Router } from "@angular/router";
+import {
+  firstValueFrom,
+  map,
+  combineLatest,
+  of,
+  BehaviorSubject,
+  Observable,
+  Subject,
+  takeUntil,
+} from "rxjs";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { BitwardenShield } from "@bitwarden/assets/svg";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherRepromptType } from "@bitwarden/common/vault/enums";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import {
+  BadgeModule,
+  ButtonModule,
+  DialogModule,
+  DialogService,
+  IconModule,
+  ItemModule,
+  SectionComponent,
+  TableModule,
+  BitIconButtonComponent,
+  SectionHeaderComponent,
+} from "@bitwarden/components";
+import { PasswordRepromptService } from "@bitwarden/vault";
+
+import { DesktopSettingsService } from "../../../platform/services/desktop-settings.service";
+import {
+  DesktopFido2UserInterfaceService,
+  DesktopFido2UserInterfaceSession,
+} from "../../services/desktop-fido2-user-interface.service";
+
+@Component({
+  standalone: true,
+  imports: [
+    CommonModule,
+    RouterModule,
+    SectionHeaderComponent,
+    BitIconButtonComponent,
+    TableModule,
+    JslibModule,
+    IconModule,
+    ButtonModule,
+    DialogModule,
+    SectionComponent,
+    ItemModule,
+    BadgeModule,
+  ],
+  templateUrl: "fido2-vault.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class Fido2VaultComponent implements OnInit, OnDestroy {
+  session?: DesktopFido2UserInterfaceSession = null;
+  private destroy$ = new Subject<void>();
+  private ciphersSubject = new BehaviorSubject<CipherView[]>([]);
+  ciphers$: Observable<CipherView[]> = this.ciphersSubject.asObservable();
+  cipherIds$: Observable<string[]> | undefined;
+  readonly Icons = { BitwardenShield };
+
+  constructor(
+    private readonly desktopSettingsService: DesktopSettingsService,
+    private readonly fido2UserInterfaceService: DesktopFido2UserInterfaceService,
+    private readonly cipherService: CipherService,
+    private readonly accountService: AccountService,
+    private readonly dialogService: DialogService,
+    private readonly logService: LogService,
+    private readonly passwordRepromptService: PasswordRepromptService,
+    private readonly router: Router,
+  ) {}
+
+  async ngOnInit(): Promise<void> {
+    this.session = this.fido2UserInterfaceService.getCurrentSession();
+    this.cipherIds$ = this.session?.availableCipherIds$;
+    await this.loadCiphers();
+  }
+
+  async ngOnDestroy(): Promise<void> {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+
+  async chooseCipher(cipher: CipherView): Promise<void> {
+    if (!this.session) {
+      await this.dialogService.openSimpleDialog({
+        title: { key: "unexpectedErrorShort" },
+        content: { key: "closeThisBitwardenWindow" },
+        type: "danger",
+        acceptButtonText: { key: "closeThisWindow" },
+        cancelButtonText: null,
+      });
+      await this.closeModal();
+
+      return;
+    }
+
+    const isConfirmed = await this.validateCipherAccess(cipher);
+    this.session.confirmChosenCipher(cipher.id, isConfirmed);
+
+    await this.closeModal();
+  }
+
+  async closeModal(): Promise<void> {
+    await this.desktopSettingsService.setModalMode(false);
+    await this.accountService.setShowHeader(true);
+
+    if (this.session) {
+      this.session.notifyConfirmCreateCredential(false);
+      this.session.confirmChosenCipher(null);
+    }
+
+    await this.router.navigate(["/"]);
+  }
+
+  private async loadCiphers(): Promise<void> {
+    const activeUserId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((a) => a?.id)),
+    );
+
+    if (!activeUserId) {
+      return;
+    }
+
+    // Combine cipher list with optional cipher IDs filter
+    combineLatest([this.cipherService.cipherListViews$(activeUserId), this.cipherIds$ || of(null)])
+      .pipe(
+        map(([ciphers, cipherIds]) => {
+          // Filter out deleted ciphers
+          const activeCiphers = ciphers.filter((cipher) => !cipher.deletedDate);
+
+          // If specific IDs provided, filter by them
+          if (cipherIds?.length > 0) {
+            return activeCiphers.filter((cipher) => cipherIds.includes(cipher.id as string));
+          }
+
+          return activeCiphers;
+        }),
+        takeUntil(this.destroy$),
+      )
+      .subscribe({
+        next: (ciphers) => this.ciphersSubject.next(ciphers as CipherView[]),
+        error: (error: unknown) => this.logService.error("Failed to load ciphers", error),
+      });
+  }
+
+  private async validateCipherAccess(cipher: CipherView): Promise<boolean> {
+    if (cipher.reprompt !== CipherRepromptType.None) {
+      return this.passwordRepromptService.showPasswordPrompt();
+    }
+
+    return true;
+  }
+}
diff --git a/apps/desktop/src/autofill/preload.ts b/apps/desktop/src/autofill/preload.ts
index e839ac223b7..6a7a8459ea9 100644
--- a/apps/desktop/src/autofill/preload.ts
+++ b/apps/desktop/src/autofill/preload.ts
@@ -12,6 +12,8 @@ export default {
   runCommand: <C extends Command>(params: RunCommandParams<C>): Promise<RunCommandResult<C>> =>
     ipcRenderer.invoke("autofill.runCommand", params),
 
+  listenerReady: () => ipcRenderer.send("autofill.listenerReady"),
+
   listenPasskeyRegistration: (
     fn: (
       clientId: number,
@@ -130,6 +132,25 @@ export default {
       },
     );
   },
+
+  listenNativeStatus: (
+    fn: (clientId: number, sequenceNumber: number, status: { key: string; value: string }) => void,
+  ) => {
+    ipcRenderer.on(
+      "autofill.nativeStatus",
+      (
+        event,
+        data: {
+          clientId: number;
+          sequenceNumber: number;
+          status: { key: string; value: string };
+        },
+      ) => {
+        const { clientId, sequenceNumber, status } = data;
+        fn(clientId, sequenceNumber, status);
+      },
+    );
+  },
   configureAutotype: (enabled: boolean, keyboardShortcut: string[]) => {
     ipcRenderer.send("autofill.configureAutotype", { enabled, keyboardShortcut });
   },
diff --git a/apps/desktop/src/autofill/services/desktop-autofill.service.ts b/apps/desktop/src/autofill/services/desktop-autofill.service.ts
index 18f4652d72a..c50964e31e3 100644
--- a/apps/desktop/src/autofill/services/desktop-autofill.service.ts
+++ b/apps/desktop/src/autofill/services/desktop-autofill.service.ts
@@ -1,6 +1,8 @@
 import { Injectable, OnDestroy } from "@angular/core";
 import {
   Subject,
+  combineLatest,
+  debounceTime,
   distinctUntilChanged,
   filter,
   firstValueFrom,
@@ -8,10 +10,11 @@ import {
   mergeMap,
   switchMap,
   takeUntil,
-  EMPTY,
 } from "rxjs";
 
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { getOptionalUserId } from "@bitwarden/common/auth/services/account.service";
 import { DeviceType } from "@bitwarden/common/enums";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
@@ -48,6 +51,7 @@ import type { NativeWindowObject } from "./desktop-fido2-user-interface.service"
 @Injectable()
 export class DesktopAutofillService implements OnDestroy {
   private destroy$ = new Subject<void>();
+  private registrationRequest: autofill.PasskeyRegistrationRequest;
 
   constructor(
     private logService: LogService,
@@ -55,6 +59,7 @@ export class DesktopAutofillService implements OnDestroy {
     private configService: ConfigService,
     private fido2AuthenticatorService: Fido2AuthenticatorServiceAbstraction<NativeWindowObject>,
     private accountService: AccountService,
+    private authService: AuthService,
     private platformUtilsService: PlatformUtilsService,
   ) {}
 
@@ -68,28 +73,56 @@ export class DesktopAutofillService implements OnDestroy {
       .getFeatureFlag$(FeatureFlag.MacOsNativeCredentialSync)
       .pipe(
         distinctUntilChanged(),
-        switchMap((enabled) => {
-          if (!enabled) {
-            return EMPTY;
-          }
-
-          return this.accountService.activeAccount$.pipe(
-            map((account) => account?.id),
-            filter((userId): userId is UserId => userId != null),
-            switchMap((userId) => this.cipherService.cipherViews$(userId)),
+        filter((enabled) => enabled === true), // Only proceed if feature is enabled
+        switchMap(() => {
+          return combineLatest([
+            this.accountService.activeAccount$.pipe(
+              map((account) => account?.id),
+              filter((userId): userId is UserId => userId != null),
+            ),
+            this.authService.activeAccountStatus$,
+          ]).pipe(
+            // Only proceed when the vault is unlocked
+            filter(([, status]) => status === AuthenticationStatus.Unlocked),
+            // Then get cipher views
+            switchMap(([userId]) => this.cipherService.cipherViews$(userId)),
           );
         }),
-        // TODO: This will unset all the autofill credentials on the OS
-        // when the account locks. We should instead explicilty clear the credentials
-        // when the user logs out. Maybe by subscribing to the encrypted ciphers observable instead.
+        debounceTime(100), // just a precaution to not spam the sync if there are multiple changes (we typically observe a null change)
+        // No filter for empty arrays here - we want to sync even if there are 0 items
+        filter((cipherViewMap) => cipherViewMap !== null),
+
         mergeMap((cipherViewMap) => this.sync(Object.values(cipherViewMap ?? []))),
         takeUntil(this.destroy$),
       )
       .subscribe();
 
+    // Listen for sign out to clear credentials
+    this.authService.activeAccountStatus$
+      .pipe(
+        filter((status) => status === AuthenticationStatus.LoggedOut),
+        mergeMap(() => this.sync([])), // sync an empty array
+        takeUntil(this.destroy$),
+      )
+      .subscribe();
+
     this.listenIpc();
   }
 
+  async adHocSync(): Promise<any> {
+    this.logService.debug("Performing AdHoc sync");
+    const account = await firstValueFrom(this.accountService.activeAccount$);
+    const userId = account?.id;
+
+    if (!userId) {
+      throw new Error("No active user found");
+    }
+
+    const cipherViewMap = await firstValueFrom(this.cipherService.cipherViews$(userId));
+    this.logService.info("Performing AdHoc sync", Object.values(cipherViewMap ?? []));
+    await this.sync(Object.values(cipherViewMap ?? []));
+  }
+
   /** Give metadata about all available credentials in the users vault */
   async sync(cipherViews: CipherView[]) {
     const status = await this.status();
@@ -130,6 +163,11 @@ export class DesktopAutofillService implements OnDestroy {
       }));
     }
 
+    this.logService.info("Syncing autofill credentials", {
+      fido2Credentials,
+      passwordCredentials,
+    });
+
     const syncResult = await ipc.autofill.runCommand<NativeAutofillSyncCommand>({
       namespace: "autofill",
       command: "sync",
@@ -155,107 +193,152 @@ export class DesktopAutofillService implements OnDestroy {
     });
   }
 
+  get lastRegistrationRequest() {
+    return this.registrationRequest;
+  }
+
   listenIpc() {
-    ipc.autofill.listenPasskeyRegistration((clientId, sequenceNumber, request, callback) => {
-      this.logService.warning("listenPasskeyRegistration", clientId, sequenceNumber, request);
-      this.logService.warning(
-        "listenPasskeyRegistration2",
-        this.convertRegistrationRequest(request),
-      );
+    ipc.autofill.listenPasskeyRegistration(async (clientId, sequenceNumber, request, callback) => {
+      if (!(await this.configService.getFeatureFlag(FeatureFlag.MacOsNativeCredentialSync))) {
+        this.logService.debug(
+          "listenPasskeyRegistration: MacOsNativeCredentialSync feature flag is disabled",
+        );
+        callback(new Error("MacOsNativeCredentialSync feature flag is disabled"), null);
+        return;
+      }
+
+      this.registrationRequest = request;
+
+      this.logService.debug("listenPasskeyRegistration", clientId, sequenceNumber, request);
+      this.logService.debug("listenPasskeyRegistration2", this.convertRegistrationRequest(request));
 
       const controller = new AbortController();
-      void this.fido2AuthenticatorService
-        .makeCredential(
+
+      try {
+        const response = await this.fido2AuthenticatorService.makeCredential(
           this.convertRegistrationRequest(request),
-          { windowXy: request.windowXy },
+          { windowXy: normalizePosition(request.windowXy) },
           controller,
-        )
-        .then((response) => {
-          callback(null, this.convertRegistrationResponse(request, response));
-        })
-        .catch((error) => {
-          this.logService.error("listenPasskeyRegistration error", error);
-          callback(error, null);
-        });
+        );
+
+        callback(null, this.convertRegistrationResponse(request, response));
+      } catch (error) {
+        this.logService.error("listenPasskeyRegistration error", error);
+        callback(error, null);
+      }
     });
 
     ipc.autofill.listenPasskeyAssertionWithoutUserInterface(
       async (clientId, sequenceNumber, request, callback) => {
-        this.logService.warning(
+        if (!(await this.configService.getFeatureFlag(FeatureFlag.MacOsNativeCredentialSync))) {
+          this.logService.debug(
+            "listenPasskeyAssertionWithoutUserInterface: MacOsNativeCredentialSync feature flag is disabled",
+          );
+          callback(new Error("MacOsNativeCredentialSync feature flag is disabled"), null);
+          return;
+        }
+
+        this.logService.debug(
           "listenPasskeyAssertion without user interface",
           clientId,
           sequenceNumber,
           request,
         );
 
-        // For some reason the credentialId is passed as an empty array in the request, so we need to
-        // get it from the cipher. For that we use the recordIdentifier, which is the cipherId.
-        if (request.recordIdentifier && request.credentialId.length === 0) {
-          const activeUserId = await firstValueFrom(
-            this.accountService.activeAccount$.pipe(getOptionalUserId),
-          );
-          if (!activeUserId) {
-            this.logService.error("listenPasskeyAssertion error", "Active user not found");
-            callback(new Error("Active user not found"), null);
-            return;
-          }
-
-          const cipher = await this.cipherService.get(request.recordIdentifier, activeUserId);
-          if (!cipher) {
-            this.logService.error("listenPasskeyAssertion error", "Cipher not found");
-            callback(new Error("Cipher not found"), null);
-            return;
-          }
-
-          const decrypted = await this.cipherService.decrypt(cipher, activeUserId);
-
-          const fido2Credential = decrypted.login.fido2Credentials?.[0];
-          if (!fido2Credential) {
-            this.logService.error("listenPasskeyAssertion error", "Fido2Credential not found");
-            callback(new Error("Fido2Credential not found"), null);
-            return;
-          }
-
-          request.credentialId = Array.from(
-            new Uint8Array(parseCredentialId(decrypted.login.fido2Credentials?.[0].credentialId)),
-          );
-        }
-
         const controller = new AbortController();
-        void this.fido2AuthenticatorService
-          .getAssertion(
-            this.convertAssertionRequest(request),
-            { windowXy: request.windowXy },
+
+        try {
+          // For some reason the credentialId is passed as an empty array in the request, so we need to
+          // get it from the cipher. For that we use the recordIdentifier, which is the cipherId.
+          if (request.recordIdentifier && request.credentialId.length === 0) {
+            const activeUserId = await firstValueFrom(
+              this.accountService.activeAccount$.pipe(getOptionalUserId),
+            );
+            if (!activeUserId) {
+              this.logService.error("listenPasskeyAssertion error", "Active user not found");
+              callback(new Error("Active user not found"), null);
+              return;
+            }
+
+            const cipher = await this.cipherService.get(request.recordIdentifier, activeUserId);
+            if (!cipher) {
+              this.logService.error("listenPasskeyAssertion error", "Cipher not found");
+              callback(new Error("Cipher not found"), null);
+              return;
+            }
+
+            const decrypted = await this.cipherService.decrypt(cipher, activeUserId);
+
+            const fido2Credential = decrypted.login.fido2Credentials?.[0];
+            if (!fido2Credential) {
+              this.logService.error("listenPasskeyAssertion error", "Fido2Credential not found");
+              callback(new Error("Fido2Credential not found"), null);
+              return;
+            }
+
+            request.credentialId = Array.from(
+              new Uint8Array(parseCredentialId(decrypted.login.fido2Credentials?.[0].credentialId)),
+            );
+          }
+
+          const response = await this.fido2AuthenticatorService.getAssertion(
+            this.convertAssertionRequest(request, true),
+            { windowXy: normalizePosition(request.windowXy) },
             controller,
-          )
-          .then((response) => {
-            callback(null, this.convertAssertionResponse(request, response));
-          })
-          .catch((error) => {
-            this.logService.error("listenPasskeyAssertion error", error);
-            callback(error, null);
-          });
+          );
+
+          callback(null, this.convertAssertionResponse(request, response));
+        } catch (error) {
+          this.logService.error("listenPasskeyAssertion error", error);
+          callback(error, null);
+          return;
+        }
       },
     );
 
     ipc.autofill.listenPasskeyAssertion(async (clientId, sequenceNumber, request, callback) => {
-      this.logService.warning("listenPasskeyAssertion", clientId, sequenceNumber, request);
+      if (!(await this.configService.getFeatureFlag(FeatureFlag.MacOsNativeCredentialSync))) {
+        this.logService.debug(
+          "listenPasskeyAssertion: MacOsNativeCredentialSync feature flag is disabled",
+        );
+        callback(new Error("MacOsNativeCredentialSync feature flag is disabled"), null);
+        return;
+      }
+
+      this.logService.debug("listenPasskeyAssertion", clientId, sequenceNumber, request);
 
       const controller = new AbortController();
-      void this.fido2AuthenticatorService
-        .getAssertion(
+      try {
+        const response = await this.fido2AuthenticatorService.getAssertion(
           this.convertAssertionRequest(request),
-          { windowXy: request.windowXy },
+          { windowXy: normalizePosition(request.windowXy) },
           controller,
-        )
-        .then((response) => {
-          callback(null, this.convertAssertionResponse(request, response));
-        })
-        .catch((error) => {
-          this.logService.error("listenPasskeyAssertion error", error);
-          callback(error, null);
-        });
+        );
+
+        callback(null, this.convertAssertionResponse(request, response));
+      } catch (error) {
+        this.logService.error("listenPasskeyAssertion error", error);
+        callback(error, null);
+      }
     });
+
+    // Listen for native status messages
+    ipc.autofill.listenNativeStatus(async (clientId, sequenceNumber, status) => {
+      if (!(await this.configService.getFeatureFlag(FeatureFlag.MacOsNativeCredentialSync))) {
+        this.logService.debug(
+          "listenNativeStatus: MacOsNativeCredentialSync feature flag is disabled",
+        );
+        return;
+      }
+
+      this.logService.info("Received native status", status.key, status.value);
+      if (status.key === "request-sync") {
+        // perform ad-hoc sync
+        await this.adHocSync();
+      }
+    });
+
+    ipc.autofill.listenerReady();
   }
 
   private convertRegistrationRequest(
@@ -277,7 +360,10 @@ export class DesktopAutofillService implements OnDestroy {
         alg,
         type: "public-key",
       })),
-      excludeCredentialDescriptorList: [],
+      excludeCredentialDescriptorList: request.excludedCredentials.map((credentialId) => ({
+        id: new Uint8Array(credentialId),
+        type: "public-key" as const,
+      })),
       requireResidentKey: true,
       requireUserVerification:
         request.userVerification === "required" || request.userVerification === "preferred",
@@ -309,18 +395,19 @@ export class DesktopAutofillService implements OnDestroy {
     request:
       | autofill.PasskeyAssertionRequest
       | autofill.PasskeyAssertionWithoutUserInterfaceRequest,
+    assumeUserPresence: boolean = false,
   ): Fido2AuthenticatorGetAssertionParams {
     let allowedCredentials;
     if ("credentialId" in request) {
       allowedCredentials = [
         {
-          id: new Uint8Array(request.credentialId),
+          id: new Uint8Array(request.credentialId).buffer,
           type: "public-key" as const,
         },
       ];
     } else {
       allowedCredentials = request.allowedCredentials.map((credentialId) => ({
-        id: new Uint8Array(credentialId),
+        id: new Uint8Array(credentialId).buffer,
         type: "public-key" as const,
       }));
     }
@@ -333,7 +420,7 @@ export class DesktopAutofillService implements OnDestroy {
       requireUserVerification:
         request.userVerification === "required" || request.userVerification === "preferred",
       fallbackSupported: false,
-      assumeUserPresence: true, // For desktop assertions, it's safe to assume UP has been checked by OS dialogues
+      assumeUserPresence,
     };
   }
 
@@ -358,3 +445,13 @@ export class DesktopAutofillService implements OnDestroy {
     this.destroy$.complete();
   }
 }
+
+function normalizePosition(position: { x: number; y: number }): { x: number; y: number } {
+  // Add 100 pixels to the x-coordinate to offset the native OS dialog positioning.
+  const xPositionOffset = 100;
+
+  return {
+    x: Math.round(position.x + xPositionOffset),
+    y: Math.round(position.y),
+  };
+}
diff --git a/apps/desktop/src/autofill/services/desktop-fido2-user-interface.service.ts b/apps/desktop/src/autofill/services/desktop-fido2-user-interface.service.ts
index 3caf13fa5b7..19946ab590c 100644
--- a/apps/desktop/src/autofill/services/desktop-fido2-user-interface.service.ts
+++ b/apps/desktop/src/autofill/services/desktop-fido2-user-interface.service.ts
@@ -66,7 +66,7 @@ export class DesktopFido2UserInterfaceService
     nativeWindowObject: NativeWindowObject,
     abortController?: AbortController,
   ): Promise<DesktopFido2UserInterfaceSession> {
-    this.logService.warning("newSession", fallbackSupported, abortController, nativeWindowObject);
+    this.logService.debug("newSession", fallbackSupported, abortController, nativeWindowObject);
     const session = new DesktopFido2UserInterfaceSession(
       this.authService,
       this.cipherService,
@@ -94,9 +94,11 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
   ) {}
 
   private confirmCredentialSubject = new Subject<boolean>();
-  private createdCipher: Cipher;
 
-  private availableCipherIdsSubject = new BehaviorSubject<string[]>(null);
+  private updatedCipher: CipherView;
+
+  private rpId = new BehaviorSubject<string>(null);
+  private availableCipherIdsSubject = new BehaviorSubject<string[]>([""]);
   /**
    * Observable that emits available cipher IDs once they're confirmed by the UI
    */
@@ -114,7 +116,7 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
     assumeUserPresence,
     masterPasswordRepromptRequired,
   }: PickCredentialParams): Promise<{ cipherId: string; userVerified: boolean }> {
-    this.logService.warning("pickCredential desktop function", {
+    this.logService.debug("pickCredential desktop function", {
       cipherIds,
       userVerification,
       assumeUserPresence,
@@ -123,6 +125,7 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
 
     try {
       // Check if we can return the credential without user interaction
+      await this.accountService.setShowHeader(false);
       if (assumeUserPresence && cipherIds.length === 1 && !masterPasswordRepromptRequired) {
         this.logService.debug(
           "shortcut - Assuming user presence and returning cipherId",
@@ -136,22 +139,27 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
       // make the cipherIds available to the UI.
       this.availableCipherIdsSubject.next(cipherIds);
 
-      await this.showUi("/passkeys", this.windowObject.windowXy);
+      await this.showUi("/fido2-assertion", this.windowObject.windowXy, false);
 
       const chosenCipherResponse = await this.waitForUiChosenCipher();
 
       this.logService.debug("Received chosen cipher", chosenCipherResponse);
 
       return {
-        cipherId: chosenCipherResponse.cipherId,
-        userVerified: chosenCipherResponse.userVerified,
+        cipherId: chosenCipherResponse?.cipherId,
+        userVerified: chosenCipherResponse?.userVerified,
       };
     } finally {
       // Make sure to clean up so the app is never stuck in modal mode?
       await this.desktopSettingsService.setModalMode(false);
+      await this.accountService.setShowHeader(true);
     }
   }
 
+  async getRpId(): Promise<string> {
+    return firstValueFrom(this.rpId.pipe(filter((id) => id != null)));
+  }
+
   confirmChosenCipher(cipherId: string, userVerified: boolean = false): void {
     this.chosenCipherSubject.next({ cipherId, userVerified });
     this.chosenCipherSubject.complete();
@@ -159,7 +167,7 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
 
   private async waitForUiChosenCipher(
     timeoutMs: number = 60000,
-  ): Promise<{ cipherId: string; userVerified: boolean } | undefined> {
+  ): Promise<{ cipherId?: string; userVerified: boolean } | undefined> {
     try {
       return await lastValueFrom(this.chosenCipherSubject.pipe(timeout(timeoutMs)));
     } catch {
@@ -174,7 +182,10 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
   /**
    * Notifies the Fido2UserInterfaceSession that the UI operations has completed and it can return to the OS.
    */
-  notifyConfirmNewCredential(confirmed: boolean): void {
+  notifyConfirmCreateCredential(confirmed: boolean, updatedCipher?: CipherView): void {
+    if (updatedCipher) {
+      this.updatedCipher = updatedCipher;
+    }
     this.confirmCredentialSubject.next(confirmed);
     this.confirmCredentialSubject.complete();
   }
@@ -195,60 +206,79 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
   async confirmNewCredential({
     credentialName,
     userName,
+    userHandle,
     userVerification,
     rpId,
   }: NewCredentialParams): Promise<{ cipherId: string; userVerified: boolean }> {
-    this.logService.warning(
+    this.logService.debug(
       "confirmNewCredential",
       credentialName,
       userName,
+      userHandle,
       userVerification,
       rpId,
     );
+    this.rpId.next(rpId);
 
     try {
-      await this.showUi("/passkeys", this.windowObject.windowXy);
+      await this.showUi("/fido2-creation", this.windowObject.windowXy, false);
 
       // Wait for the UI to wrap up
       const confirmation = await this.waitForUiNewCredentialConfirmation();
       if (!confirmation) {
         return { cipherId: undefined, userVerified: false };
       }
-      // Create the credential
-      await this.createCredential({
-        credentialName,
-        userName,
-        rpId,
-        userHandle: "",
-        userVerification,
-      });
 
-      // wait for 10ms to help RXJS catch up(?)
-      // We sometimes get a race condition from this.createCredential not updating cipherService in time
-      //console.log("waiting 10ms..");
-      //await new Promise((resolve) => setTimeout(resolve, 10));
-      //console.log("Just waited 10ms");
-
-      // Return the new cipher (this.createdCipher)
-      return { cipherId: this.createdCipher.id, userVerified: userVerification };
+      if (this.updatedCipher) {
+        await this.updateCredential(this.updatedCipher);
+        return { cipherId: this.updatedCipher.id, userVerified: userVerification };
+      } else {
+        // Create the cipher
+        const createdCipher = await this.createCipher({
+          credentialName,
+          userName,
+          rpId,
+          userHandle,
+          userVerification,
+        });
+        return { cipherId: createdCipher.id, userVerified: userVerification };
+      }
     } finally {
       // Make sure to clean up so the app is never stuck in modal mode?
       await this.desktopSettingsService.setModalMode(false);
+      await this.accountService.setShowHeader(true);
     }
   }
 
-  private async showUi(route: string, position?: { x: number; y: number }): Promise<void> {
+  private async hideUi(): Promise<void> {
+    await this.desktopSettingsService.setModalMode(false);
+    await this.router.navigate(["/"]);
+  }
+
+  private async showUi(
+    route: string,
+    position?: { x: number; y: number },
+    showTrafficButtons: boolean = false,
+    disableRedirect?: boolean,
+  ): Promise<void> {
     // Load the UI:
-    await this.desktopSettingsService.setModalMode(true, position);
-    await this.router.navigate(["/passkeys"]);
+    await this.desktopSettingsService.setModalMode(true, showTrafficButtons, position);
+    await this.accountService.setShowHeader(showTrafficButtons);
+    await this.router.navigate([
+      route,
+      {
+        "disable-redirect": disableRedirect || null,
+      },
+    ]);
   }
 
   /**
-   * Can be called by the UI to create a new credential with user input etc.
+   * Can be called by the UI to create a new cipher with user input etc.
    * @param param0
    */
-  async createCredential({ credentialName, userName, rpId }: NewCredentialParams): Promise<Cipher> {
+  async createCipher({ credentialName, userName, rpId }: NewCredentialParams): Promise<Cipher> {
     // Store the passkey on a new cipher to avoid replacing something important
+
     const cipher = new CipherView();
     cipher.name = credentialName;
 
@@ -267,32 +297,81 @@ export class DesktopFido2UserInterfaceSession implements Fido2UserInterfaceSessi
       this.accountService.activeAccount$.pipe(map((a) => a?.id)),
     );
 
+    if (!activeUserId) {
+      throw new Error("No active user ID found!");
+    }
+
     const encCipher = await this.cipherService.encrypt(cipher, activeUserId);
-    const createdCipher = await this.cipherService.createWithServer(encCipher);
 
-    this.createdCipher = createdCipher;
+    try {
+      const createdCipher = await this.cipherService.createWithServer(encCipher);
 
-    return createdCipher;
+      return createdCipher;
+    } catch {
+      throw new Error("Unable to create cipher");
+    }
+  }
+
+  async updateCredential(cipher: CipherView): Promise<void> {
+    this.logService.info("updateCredential");
+    await firstValueFrom(
+      this.accountService.activeAccount$.pipe(
+        map(async (a) => {
+          if (a) {
+            const encCipher = await this.cipherService.encrypt(cipher, a.id);
+            await this.cipherService.updateWithServer(encCipher);
+          }
+        }),
+      ),
+    );
   }
 
   async informExcludedCredential(existingCipherIds: string[]): Promise<void> {
-    this.logService.warning("informExcludedCredential", existingCipherIds);
+    this.logService.debug("informExcludedCredential", existingCipherIds);
+
+    // make the cipherIds available to the UI.
+    this.availableCipherIdsSubject.next(existingCipherIds);
+
+    await this.accountService.setShowHeader(false);
+    await this.showUi("/fido2-excluded", this.windowObject.windowXy, false);
   }
 
   async ensureUnlockedVault(): Promise<void> {
-    this.logService.warning("ensureUnlockedVault");
+    this.logService.debug("ensureUnlockedVault");
 
     const status = await firstValueFrom(this.authService.activeAccountStatus$);
     if (status !== AuthenticationStatus.Unlocked) {
-      throw new Error("Vault is not unlocked");
+      await this.showUi("/lock", this.windowObject.windowXy, true, true);
+
+      let status2: AuthenticationStatus;
+      try {
+        status2 = await lastValueFrom(
+          this.authService.activeAccountStatus$.pipe(
+            filter((s) => s === AuthenticationStatus.Unlocked),
+            take(1),
+            timeout(1000 * 60 * 5), // 5 minutes
+          ),
+        );
+      } catch (error) {
+        this.logService.warning("Error while waiting for vault to unlock", error);
+      }
+
+      if (status2 === AuthenticationStatus.Unlocked) {
+        await this.router.navigate(["/"]);
+      }
+
+      if (status2 !== AuthenticationStatus.Unlocked) {
+        await this.hideUi();
+        throw new Error("Vault is not unlocked");
+      }
     }
   }
 
   async informCredentialNotFound(): Promise<void> {
-    this.logService.warning("informCredentialNotFound");
+    this.logService.debug("informCredentialNotFound");
   }
 
   async close() {
-    this.logService.warning("close");
+    this.logService.debug("close");
   }
 }
diff --git a/apps/desktop/src/billing/app/accounts/premium.component.html b/apps/desktop/src/billing/app/accounts/premium.component.html
index d88602bed1e..c5f9722f133 100644
--- a/apps/desktop/src/billing/app/accounts/premium.component.html
+++ b/apps/desktop/src/billing/app/accounts/premium.component.html
@@ -13,7 +13,7 @@
               <ul class="bwi-ul">
                 <li>
                   <i class="bwi bwi-li bwi-check text-success" aria-hidden="true"></i>
-                  {{ "premiumSignUpStorage" | i18n }}
+                  {{ "premiumSignUpStorageV2" | i18n: `${storageProvidedGb} GB` }}
                 </li>
                 <li>
                   <i class="bwi bwi-li bwi-check text-success" aria-hidden="true"></i>
diff --git a/apps/desktop/src/billing/app/accounts/premium.component.ts b/apps/desktop/src/billing/app/accounts/premium.component.ts
index 637969c1a21..4aff0cc03e1 100644
--- a/apps/desktop/src/billing/app/accounts/premium.component.ts
+++ b/apps/desktop/src/billing/app/accounts/premium.component.ts
@@ -3,6 +3,7 @@ import { Component } from "@angular/core";
 import { PremiumComponent as BasePremiumComponent } from "@bitwarden/angular/billing/components/premium.component";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstractions";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -28,6 +29,7 @@ export class PremiumComponent extends BasePremiumComponent {
     billingAccountProfileStateService: BillingAccountProfileStateService,
     toastService: ToastService,
     accountService: AccountService,
+    billingApiService: BillingApiServiceAbstraction,
   ) {
     super(
       i18nService,
@@ -39,6 +41,7 @@ export class PremiumComponent extends BasePremiumComponent {
       billingAccountProfileStateService,
       toastService,
       accountService,
+      billingApiService,
     );
   }
 }
diff --git a/apps/desktop/src/key-management/biometrics/renderer-biometrics.service.ts b/apps/desktop/src/key-management/biometrics/renderer-biometrics.service.ts
index 8e28d3ca614..3a47086b1aa 100644
--- a/apps/desktop/src/key-management/biometrics/renderer-biometrics.service.ts
+++ b/apps/desktop/src/key-management/biometrics/renderer-biometrics.service.ts
@@ -1,5 +1,7 @@
 import { Injectable } from "@angular/core";
+import { firstValueFrom } from "rxjs";
 
+import { TokenService } from "@bitwarden/common/auth/abstractions/token.service";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { UserId } from "@bitwarden/common/types/guid";
 import { UserKey } from "@bitwarden/common/types/key";
@@ -13,6 +15,10 @@ import { DesktopBiometricsService } from "./desktop.biometrics.service";
  */
 @Injectable()
 export class RendererBiometricsService extends DesktopBiometricsService {
+  constructor(private tokenService: TokenService) {
+    super();
+  }
+
   async authenticateWithBiometrics(): Promise<boolean> {
     return await ipc.keyManagement.biometric.authenticateWithBiometrics();
   }
@@ -31,6 +37,10 @@ export class RendererBiometricsService extends DesktopBiometricsService {
   }
 
   async getBiometricsStatusForUser(id: UserId): Promise<BiometricsStatus> {
+    if ((await firstValueFrom(this.tokenService.hasAccessToken$(id))) === false) {
+      return BiometricsStatus.NotEnabledInConnectedDesktopApp;
+    }
+
     return await ipc.keyManagement.biometric.getBiometricsStatusForUser(id);
   }
 
diff --git a/apps/desktop/src/key-management/key-connector/remove-password.component.html b/apps/desktop/src/key-management/key-connector/remove-password.component.html
deleted file mode 100644
index 5276e00c531..00000000000
--- a/apps/desktop/src/key-management/key-connector/remove-password.component.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<div id="remove-password-page" *ngIf="!loading">
-  <div class="content">
-    <h1>{{ "removeMasterPassword" | i18n }}</h1>
-    <p>{{ "removeMasterPasswordForOrganizationUserKeyConnector" | i18n }}</p>
-    <p class="tw-mb-0">{{ "organizationName" | i18n }}:</p>
-    <p class="tw-text-muted tw-mb-6">{{ organization.name }}</p>
-    <p class="tw-mb-0">{{ "keyConnectorDomain" | i18n }}:</p>
-    <p class="tw-text-muted tw-mb-6">{{ organization.keyConnectorUrl }}</p>
-    <div class="buttons">
-      <button type="submit" class="btn primary block" [disabled]="action" (click)="convert()">
-        <b [hidden]="continuing">{{ "removeMasterPassword" | i18n }}</b>
-        <i class="bwi bwi-spinner bwi-spin" [hidden]="!continuing" aria-hidden="true"></i>
-      </button>
-      <button type="button" class="btn secondary block" [disabled]="action" (click)="leave()">
-        <b [hidden]="leaving">{{ "leaveOrganization" | i18n }}</b>
-        <i class="bwi bwi-spinner bwi-spin" [hidden]="!leaving" aria-hidden="true"></i>
-      </button>
-    </div>
-  </div>
-</div>
diff --git a/apps/desktop/src/key-management/key-connector/remove-password.component.ts b/apps/desktop/src/key-management/key-connector/remove-password.component.ts
deleted file mode 100644
index d9fea9409f8..00000000000
--- a/apps/desktop/src/key-management/key-connector/remove-password.component.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { Component } from "@angular/core";
-
-import { RemovePasswordComponent as BaseRemovePasswordComponent } from "@bitwarden/key-management-ui";
-
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
-@Component({
-  selector: "app-remove-password",
-  templateUrl: "remove-password.component.html",
-  standalone: false,
-})
-export class RemovePasswordComponent extends BaseRemovePasswordComponent {}
diff --git a/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-settings-component.service.ts b/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-settings-component.service.ts
deleted file mode 100644
index 91c8126cdd7..00000000000
--- a/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-settings-component.service.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { defer, from, map, Observable } from "rxjs";
-
-import {
-  VaultTimeout,
-  VaultTimeoutOption,
-  VaultTimeoutStringType,
-} from "@bitwarden/common/key-management/vault-timeout";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { SessionTimeoutSettingsComponentService } from "@bitwarden/key-management-ui";
-
-export class DesktopSessionTimeoutSettingsComponentService
-  implements SessionTimeoutSettingsComponentService
-{
-  availableTimeoutOptions$: Observable<VaultTimeoutOption[]> = defer(() =>
-    from(ipc.platform.powermonitor.isLockMonitorAvailable()).pipe(
-      map((isLockMonitorAvailable) => {
-        const options: VaultTimeoutOption[] = [
-          { name: this.i18nService.t("oneMinute"), value: 1 },
-          { name: this.i18nService.t("fiveMinutes"), value: 5 },
-          { name: this.i18nService.t("fifteenMinutes"), value: 15 },
-          { name: this.i18nService.t("thirtyMinutes"), value: 30 },
-          { name: this.i18nService.t("oneHour"), value: 60 },
-          { name: this.i18nService.t("fourHours"), value: 240 },
-          { name: this.i18nService.t("onIdle"), value: VaultTimeoutStringType.OnIdle },
-          { name: this.i18nService.t("onSleep"), value: VaultTimeoutStringType.OnSleep },
-        ];
-
-        if (isLockMonitorAvailable) {
-          options.push({
-            name: this.i18nService.t("onLocked"),
-            value: VaultTimeoutStringType.OnLocked,
-          });
-        }
-
-        options.push(
-          { name: this.i18nService.t("onRestart"), value: VaultTimeoutStringType.OnRestart },
-          { name: this.i18nService.t("never"), value: VaultTimeoutStringType.Never },
-        );
-
-        return options;
-      }),
-    ),
-  );
-
-  constructor(private readonly i18nService: I18nService) {}
-
-  onTimeoutSave(_: VaultTimeout): void {}
-}
diff --git a/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.spec.ts b/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.spec.ts
new file mode 100644
index 00000000000..d3ece8842b2
--- /dev/null
+++ b/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.spec.ts
@@ -0,0 +1,125 @@
+import {
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+
+import { DesktopSessionTimeoutTypeService } from "./desktop-session-timeout-type.service";
+
+describe("DesktopSessionTimeoutTypeService", () => {
+  let service: DesktopSessionTimeoutTypeService;
+  let mockIsLockMonitorAvailable: jest.Mock;
+
+  beforeEach(() => {
+    mockIsLockMonitorAvailable = jest.fn();
+
+    (global as any).ipc = {
+      platform: {
+        powermonitor: {
+          isLockMonitorAvailable: mockIsLockMonitorAvailable,
+        },
+      },
+    };
+
+    service = new DesktopSessionTimeoutTypeService();
+  });
+
+  describe("isAvailable", () => {
+    it("should return false for Immediately", async () => {
+      const result = await service.isAvailable(VaultTimeoutNumberType.Immediately);
+
+      expect(result).toBe(false);
+    });
+
+    it.each([
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.Never,
+      VaultTimeoutStringType.Custom,
+    ])("should return true for always available type: %s", async (timeoutType) => {
+      const result = await service.isAvailable(timeoutType);
+
+      expect(result).toBe(true);
+    });
+
+    it.each([VaultTimeoutNumberType.OnMinute, VaultTimeoutNumberType.EightHours])(
+      "should return true for numeric timeout type: %s",
+      async (timeoutType) => {
+        const result = await service.isAvailable(timeoutType);
+
+        expect(result).toBe(true);
+      },
+    );
+
+    describe("OnLocked availability", () => {
+      it("should return true when lock monitor is available", async () => {
+        mockIsLockMonitorAvailable.mockResolvedValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(true);
+        expect(mockIsLockMonitorAvailable).toHaveBeenCalled();
+      });
+
+      it("should return false when lock monitor is not available", async () => {
+        mockIsLockMonitorAvailable.mockResolvedValue(false);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.OnLocked);
+
+        expect(result).toBe(false);
+        expect(mockIsLockMonitorAvailable).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe("getOrPromoteToAvailable", () => {
+    it.each([
+      VaultTimeoutNumberType.OnMinute,
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.Never,
+      VaultTimeoutStringType.Custom,
+    ])("should return the original type when it is available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(true);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(timeoutType);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+
+    it("should return OnMinute when Immediately is not available", async () => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(VaultTimeoutNumberType.Immediately);
+
+      expect(result).toBe(VaultTimeoutNumberType.OnMinute);
+      expect(service.isAvailable).toHaveBeenCalledWith(VaultTimeoutNumberType.Immediately);
+    });
+
+    it("should return OnSleep when OnLocked is not available", async () => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(VaultTimeoutStringType.OnLocked);
+
+      expect(result).toBe(VaultTimeoutStringType.OnSleep);
+      expect(service.isAvailable).toHaveBeenCalledWith(VaultTimeoutStringType.OnLocked);
+    });
+
+    it.each([
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutNumberType.OnMinute,
+      5,
+    ])("should return OnRestart when type is not available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(VaultTimeoutStringType.OnRestart);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+  });
+});
diff --git a/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.ts b/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.ts
new file mode 100644
index 00000000000..1f09e83b0f1
--- /dev/null
+++ b/apps/desktop/src/key-management/session-timeout/services/desktop-session-timeout-type.service.ts
@@ -0,0 +1,46 @@
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
+import {
+  isVaultTimeoutTypeNumeric,
+  VaultTimeout,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+
+export class DesktopSessionTimeoutTypeService implements SessionTimeoutTypeService {
+  async isAvailable(type: VaultTimeout): Promise<boolean> {
+    switch (type) {
+      case VaultTimeoutNumberType.Immediately:
+        return false;
+      case VaultTimeoutStringType.OnIdle:
+      case VaultTimeoutStringType.OnSleep:
+      case VaultTimeoutStringType.OnRestart:
+      case VaultTimeoutStringType.Never:
+      case VaultTimeoutStringType.Custom:
+        return true;
+      case VaultTimeoutStringType.OnLocked:
+        return await ipc.platform.powermonitor.isLockMonitorAvailable();
+      default:
+        if (isVaultTimeoutTypeNumeric(type)) {
+          return true;
+        }
+        break;
+    }
+
+    return false;
+  }
+
+  async getOrPromoteToAvailable(type: VaultTimeout): Promise<VaultTimeout> {
+    const available = await this.isAvailable(type);
+    if (!available) {
+      switch (type) {
+        case VaultTimeoutNumberType.Immediately:
+          return VaultTimeoutNumberType.OnMinute;
+        case VaultTimeoutStringType.OnLocked:
+          return VaultTimeoutStringType.OnSleep;
+        default:
+          return VaultTimeoutStringType.OnRestart;
+      }
+    }
+    return type;
+  }
+}
diff --git a/apps/desktop/src/locales/af/messages.json b/apps/desktop/src/locales/af/messages.json
index 1c6a2bc49c9..a4230a128c5 100644
--- a/apps/desktop/src/locales/af/messages.json
+++ b/apps/desktop/src/locales/af/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Leer meer"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funksie Onbeskikbaar"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GG geënkripteerde berging vir lêeraanhegsels."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Is u seker u wil die “Nooit”-opsie gebruik? Deur u vergrendelopsies op “Nooit” te stel word u kluis se enkripsie op u toestel bewaar. Indien u hierdie opsie gebruik moet u verseker dat u toestel behoorlik beskerm is."
   },
   "vault": {
-    "message": "Kluis"
+    "message": "Kluis",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Meld aan met meesterwagwoord"
diff --git a/apps/desktop/src/locales/ar/messages.json b/apps/desktop/src/locales/ar/messages.json
index ca404f4e179..54a9425c901 100644
--- a/apps/desktop/src/locales/ar/messages.json
+++ b/apps/desktop/src/locales/ar/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "اعرف المزيد"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "الميزة غير متوفرة"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 جيغابايت وحدة تخزين مشفرة لمرفقات الملفات."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "خيارات تسجيل الدخول بخطوتين المملوكة مثل YubiKey و Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "كل الإرسالات",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "هل أنت متأكد من أنك تريد استخدام خيار \"مطلقا\"؟ إعداد خيارات القفل إلى \"مطلقا\" يخزن مفتاح تشفير المستودع الخاص بك على جهازك. إذا كنت تستخدم هذا الخيار، يجب أن تتأكد من الحفاظ على حماية جهازك بشكل صحيح."
   },
   "vault": {
-    "message": "الخزانة"
+    "message": "الخزانة",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "تسجيل الدخول باستخدام كلمة المرور الرئيسية"
diff --git a/apps/desktop/src/locales/az/messages.json b/apps/desktop/src/locales/az/messages.json
index 55c2bdcd677..9e8c77aa76a 100644
--- a/apps/desktop/src/locales/az/messages.json
+++ b/apps/desktop/src/locales/az/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Daha ətraflı"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Özəllik əlçatmazdır"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "Fayl qoşmaları üçün 1 GB şifrələnmiş saxlama sahəsi."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey və Duo kimi mülkiyyətçi iki addımlı giriş seçimləri."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Əlaqə məlumatları"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Bütün \"Send\"lər",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "\"Heç vaxt\"i seçmək istədiyinizə əminsiniz? Kilid seçimini \"Heç vaxt\" olaraq ayarlasanız, seyfinizin şifrələmə açarı cihazınızda saxlanılacaq. Bu seçimi istifadə etsəniz, cihazınızı daha yaxşı mühafizə etdiyinizə əmin olmalısınız."
   },
   "vault": {
-    "message": "Seyf"
+    "message": "Seyf",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Ana parolla giriş et"
diff --git a/apps/desktop/src/locales/be/messages.json b/apps/desktop/src/locales/be/messages.json
index b2e4db47b32..e9b3834a9f7 100644
--- a/apps/desktop/src/locales/be/messages.json
+++ b/apps/desktop/src/locales/be/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Даведацца больш"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Функцыя недаступна"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашыфраванага сховішча для далучаных файлаў."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Прапрыетарныя варыянты двухэтапнага ўваходу, такія як YubiKey, FIDO U2F і Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Усе Send'ы",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Вы сапраўды хочаце адключыць блакіроўку сховішча? Прызначыўшы параметр блакіравання \"Ніколі\", ключ шыфравання будзе захоўвацца на вашай прыладзе. Калі вы выкарыстоўваеце гэты параметр, вы павінны быць упэўнены ў тым, што ваша прылада надзейна абаронена."
   },
   "vault": {
-    "message": "Сховішча"
+    "message": "Сховішча",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Увайсці з асноўным паролем"
diff --git a/apps/desktop/src/locales/bg/messages.json b/apps/desktop/src/locales/bg/messages.json
index ad03c2cc023..f27fb467c0c 100644
--- a/apps/desktop/src/locales/bg/messages.json
+++ b/apps/desktop/src/locales/bg/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Научете повече"
   },
+  "migrationsFailed": {
+    "message": "Възникна грешка при обновяването на настройките за шифроване."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновете настройките си за шифроване"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новите препоръчани настройки за шифроване ще подобрят сигурността на акаунта Ви. Въведете главната си парола, за да ги обновите сега."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Потвърдете самоличността си, за да продължите"
+  },
+  "enterYourMasterPassword": {
+    "message": "Въведете главната си парола"
+  },
+  "updateSettings": {
+    "message": "Обновяване на настройките"
+  },
   "featureUnavailable": {
     "message": "Функцията е недостъпна"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ пространство за файлове, които се шифроват."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ пространство за файлове, които се шифрират.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Частно двустепенно удостоверяване чрез YubiKey и Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Информация за контакт"
   },
+  "send": {
+    "message": "Изпращане",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Всички изпращания",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Уверени ли сте, че искате да зададете стойност „Никога“? Това води до съхранение на шифриращия ключ за трезора във устройството ви. Ако използвате тази възможност, е много важно да имате надлежна защита на устройството си."
   },
   "vault": {
-    "message": "Трезор"
+    "message": "Трезор",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Вписване с главната парола"
diff --git a/apps/desktop/src/locales/bn/messages.json b/apps/desktop/src/locales/bn/messages.json
index d6c61c1ab51..f9f072f290e 100644
--- a/apps/desktop/src/locales/bn/messages.json
+++ b/apps/desktop/src/locales/bn/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "আরও জানুন"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "বৈশিষ্ট্য অনুপলব্ধ"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "ফাইল সংযুক্তির জন্য ১ জিবি এনক্রিপ্টেড স্থান।"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/bs/messages.json b/apps/desktop/src/locales/bs/messages.json
index 569f1072c4b..b8798320a98 100644
--- a/apps/desktop/src/locales/bs/messages.json
+++ b/apps/desktop/src/locales/bs/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Saznajte više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funkcija nije dostupna"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifriranog prostora za pohranu podataka."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Svi Send-ovi",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/ca/messages.json b/apps/desktop/src/locales/ca/messages.json
index de468f1e8b3..a7674cbc753 100644
--- a/apps/desktop/src/locales/ca/messages.json
+++ b/apps/desktop/src/locales/ca/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Més informació"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Característica no disponible"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB d'emmagatzematge xifrat per als fitxers adjunts."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opcions propietàries de doble factor com ara YubiKey i Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informació de contacte"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Tots els Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Esteu segur que voleu utilitzar l'opció \"Mai\"? En configurar les opcions de bloqueig a \"Mai\" s'emmagatzema la clau de xifratge de la vostra caixa forta al vostre dispositiu. Si utilitzeu aquesta opció, heu d'assegurar-vos que conserveu el dispositiu degudament protegit."
   },
   "vault": {
-    "message": "Caixa forta"
+    "message": "Caixa forta",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Inici de sessió amb contrasenya mestra"
diff --git a/apps/desktop/src/locales/cs/messages.json b/apps/desktop/src/locales/cs/messages.json
index c02dbabbc93..b93e5d0f513 100644
--- a/apps/desktop/src/locales/cs/messages.json
+++ b/apps/desktop/src/locales/cs/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Dozvědět se více"
   },
+  "migrationsFailed": {
+    "message": "Došlo k chybě při aktualizaci nastavení šifrování."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aktualizovat nastavení šifrování"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Nové doporučené nastavení šifrování zlepší bezpečnost Vašeho účtu. Pokud chcete aktualizovat nyní, zadejte hlavní heslo."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Pro pokračování potvrďte svou identitu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Zadejte své hlavní heslo"
+  },
+  "updateSettings": {
+    "message": "Aktualizovat nastavení"
+  },
   "featureUnavailable": {
     "message": "Funkce není dostupná"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrovaného uložiště pro přílohy."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrovaného úložiště pro přílohy.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Volby proprietálních dvoufázových přihlášení jako je YubiKey a Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Všechny Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Opravdu chcete použít volbu \"Nikdy\"? Nastavením volby uzamčení na \"Nikdy\" bude šifrovací klíč k trezoru uložen přímo ve Vašem zařízení. Pokud tuto možnost použijete, měli byste Vaše zařízení řádně zabezpečit a chránit."
   },
   "vault": {
-    "message": "Trezor"
+    "message": "Trezor",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Přihlásit se pomocí hlavního hesla"
diff --git a/apps/desktop/src/locales/cy/messages.json b/apps/desktop/src/locales/cy/messages.json
index 25b52fcc101..5a00ad90bbd 100644
--- a/apps/desktop/src/locales/cy/messages.json
+++ b/apps/desktop/src/locales/cy/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/da/messages.json b/apps/desktop/src/locales/da/messages.json
index 1d135a533f2..622c9e9187d 100644
--- a/apps/desktop/src/locales/da/messages.json
+++ b/apps/desktop/src/locales/da/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Læs mere"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funktion utilgængelig"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB krypteret lagerplads til filvedhæftninger."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietære totrins-login muligheder, såsom YubiKey og Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Sikker på, at indstillingen \"Aldrig\" skal bruges? Sættes låseindstillinger til \"Aldrig\", gemmes din bokskrypteringsnøgle på enheden. Bruges denne indstilling, så sørg for at holde din enhed ordentligt beskyttet."
   },
   "vault": {
-    "message": "Boks"
+    "message": "Boks",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log ind med hovedadgangskoden"
diff --git a/apps/desktop/src/locales/de/messages.json b/apps/desktop/src/locales/de/messages.json
index 6fc220faded..2743ec21c8a 100644
--- a/apps/desktop/src/locales/de/messages.json
+++ b/apps/desktop/src/locales/de/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Mehr erfahren"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funktion nicht verfügbar"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB verschlüsselter Speicherplatz für Dateianhänge."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ verschlüsselter Speicher für Dateianhänge.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietäre Optionen für die Zwei-Faktor Authentifizierung wie YubiKey und Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Kontaktinformationen"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Bist du sicher, dass du die Option \"Nie\" verwenden möchtest? Durch das Setzen der Sperroptionen zu \"Nie\" wird der Verschlüsselungscode deines Tresors auf deinem Gerät gespeichert. Wenn du diese Option verwendest, solltest du sicherstellen, dass dein Gerät ausreichend geschützt ist."
   },
   "vault": {
-    "message": "Tresor"
+    "message": "Tresor",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Mit Master-Passwort anmelden"
diff --git a/apps/desktop/src/locales/el/messages.json b/apps/desktop/src/locales/el/messages.json
index 0b869c1e02f..bd8269db4ea 100644
--- a/apps/desktop/src/locales/el/messages.json
+++ b/apps/desktop/src/locales/el/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Μάθετε περισσότερα"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Μη διαθέσιμη λειτουργία"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB κρυπτογραφημένο αποθηκευτικό χώρο για συνημμένα αρχεία."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Ιδιόκτητες επιλογές σύνδεσης δύο βημάτων, όπως το YubiKey και το Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Στοιχεία επικοινωνίας"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Όλα τα Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Είστε βέβαιοι ότι θέλετε να χρησιμοποιήσετε την επιλογή \"Ποτέ\"; Ο ορισμός των επιλογών κλειδώματος σε \"Ποτέ\" αποθηκεύει το κλειδί κρυπτογράφησης του θησαυ/κίου σας στη συσκευή σας. Εάν χρησιμοποιήσετε αυτήν την επιλογή, θα πρέπει να διασφαλίσετε ότι θα διατηρείτε τη συσκευή σας κατάλληλα προστατευμένη."
   },
   "vault": {
-    "message": "Κρύπτη"
+    "message": "Κρύπτη",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Συνδεθείτε με τον κύριο κωδικό πρόσβασης"
diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index f6f078611c9..48e346d9c68 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -708,6 +708,18 @@
   "addAttachment": {
     "message": "Add attachment"
   },
+  "itemsTransferred": {
+    "message": "Items transferred"
+  },
+  "fixEncryption": {
+    "message": "Fix encryption"
+  },
+  "fixEncryptionTooltip": {
+    "message": "This file is using an outdated encryption method."
+  },
+  "attachmentUpdated": {
+    "message": "Attachment updated"
+  },
   "maxFileSizeSansPunctuation": {
     "message": "Maximum file size is 500 MB"
   },
@@ -908,6 +920,12 @@
   "unexpectedError": {
     "message": "An unexpected error has occurred."
   },
+  "unexpectedErrorShort": {
+    "message": "Unexpected error"
+  },
+  "closeThisBitwardenWindow": {
+    "message": "Close this Bitwarden window and try again."
+  },
   "itemInformation": {
     "message": "Item information"
   },
@@ -1093,6 +1111,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1526,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2592,9 +2637,6 @@
   "removedMasterPassword": {
     "message": "Master password removed"
   },
-  "removeMasterPasswordForOrganizationUserKeyConnector": {
-    "message": "A master password is no longer required for members of the following organization. Please confirm the domain below with your organization administrator."
-  },
   "organizationName": {
     "message": "Organization name"
   },
@@ -3329,7 +3371,7 @@
   "orgTrustWarning1": {
     "message": "This organization has an Enterprise policy that will enroll you in account recovery. Enrollment will allow organization administrators to change your password. Only proceed if you recognize this organization and the fingerprint phrase displayed below matches the organization's fingerprint."
   },
-  "trustUser":{
+  "trustUser": {
     "message": "Trust user"
   },
   "inputRequired": {
@@ -3859,6 +3901,75 @@
   "fileSavedToDevice": {
     "message": "File saved to device. Manage from your device downloads."
   },
+  "importantNotice": {
+    "message": "Important notice"
+  },
+  "setupTwoStepLogin": {
+    "message": "Set up two-step login"
+  },
+  "newDeviceVerificationNoticeContentPage1": {
+    "message": "Bitwarden will send a code to your account email to verify logins from new devices starting in February 2025."
+  },
+  "newDeviceVerificationNoticeContentPage2": {
+    "message": "You can set up two-step login as an alternative way to protect your account or change your email to one you can access."
+  },
+  "remindMeLater": {
+    "message": "Remind me later"
+  },
+  "newDeviceVerificationNoticePageOneFormContent": {
+    "message": "Do you have reliable access to your email, $EMAIL$?",
+    "placeholders": {
+      "email": {
+        "content": "$1",
+        "example": "your_name@email.com"
+      }
+    }
+  },
+  "newDeviceVerificationNoticePageOneEmailAccessNo": {
+    "message": "No, I do not"
+  },
+  "newDeviceVerificationNoticePageOneEmailAccessYes": {
+    "message": "Yes, I can reliably access my email"
+  },
+  "turnOnTwoStepLogin": {
+    "message": "Turn on two-step login"
+  },
+  "changeAcctEmail": {
+    "message": "Change account email"
+  },
+  "passkeyLogin": {
+    "message": "Log in with passkey?"
+  },
+  "savePasskeyQuestion": {
+    "message": "Save passkey?"
+  },
+  "saveNewPasskey": {
+    "message": "Save as new login"
+  },
+  "savePasskeyNewLogin": {
+    "message": "Save passkey as new login"
+  },
+  "noMatchingLoginsForSite": {
+    "message": "No matching logins for this site"
+  },
+  "overwritePasskey": {
+    "message": "Overwrite passkey?"
+  },
+  "unableToSavePasskey": {
+    "message": "Unable to save passkey"
+  },
+  "alreadyContainsPasskey": {
+    "message": "This item already contains a passkey. Are you sure you want to overwrite the current passkey?"
+  },
+  "passkeyAlreadyExists": {
+    "message": "A passkey already exists for this application."
+  },
+  "applicationDoesNotSupportDuplicates": {
+    "message": "This application does not support duplicates."
+  },
+  "closeThisWindow": {
+    "message": "Close this window"
+  },
   "allowScreenshots": {
     "message": "Allow screen capture"
   },
@@ -4217,16 +4328,147 @@
   "andMoreFeatures": {
     "message": "And more!"
   },
-  "planDescPremium": {
-    "message": "Complete online security"
+  "advancedOnlineSecurity": {
+    "message": "Advanced online security"
   },
   "upgradeToPremium": {
     "message": "Upgrade to Premium"
   },
+  "removeMasterPasswordForOrgUserKeyConnector":{
+    "message": "Your organization is no longer using master passwords to log into Bitwarden. To continue, verify the organization and domain."
+  },
+  "continueWithLogIn": {
+    "message": "Continue with log in"
+  },
+  "doNotContinue": {
+    "message": "Do not continue"
+  },
+  "domain": {
+    "message": "Domain"
+  },
+  "keyConnectorDomainTooltip": {
+    "message": "This domain will store your account encryption keys, so make sure you trust it. If you're not sure, check with your admin."
+  },
+  "verifyYourOrganization": {
+    "message": "Verify your organization to log in"
+  },
+  "organizationVerified":{
+    "message": "Organization verified"
+  },
+  "domainVerified":{
+    "message": "Domain verified"
+  },
+  "leaveOrganizationContent": {
+    "message": "If you don't verify your organization, your access to the organization will be revoked."
+  },
+  "leaveNow": {
+    "message": "Leave now"
+  },
+  "verifyYourDomainToLogin": {
+    "message": "Verify your domain to log in"
+  },
+  "verifyYourDomainDescription": {
+    "message": "To continue with log in, verify this domain."
+  },
+  "confirmKeyConnectorOrganizationUserDescription": {
+    "message": "To continue with log in, verify the organization and domain."
+  },
   "sessionTimeoutSettingsAction": {
     "message": "Timeout action"
   },
   "sessionTimeoutHeader": {
     "message": "Session timeout"
+  },
+  "sessionTimeoutSettingsManagedByOrganization": {
+    "message": "This setting is managed by your organization."
+  },
+  "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes": {
+    "message": "Your organization has set the maximum session timeout to $HOURS$ hour(s) and $MINUTES$ minute(s).",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "8"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "2"
+      }
+    }
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToOnLocked": {
+    "message": "Your organization has set the default session timeout to On system lock."
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart": {
+    "message": "Your organization has set the default session timeout to On restart."
+  },
+  "sessionTimeoutSettingsPolicyMaximumError": {
+    "message": "Maximum timeout cannot exceed $HOURS$ hour(s) and $MINUTES$ minute(s)",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "5"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "5"
+      }
+    }
+  },
+  "sessionTimeoutOnRestart": {
+    "message": "On restart"
+  },
+  "sessionTimeoutSettingsSetUnlockMethodToChangeTimeoutAction": {
+    "message": "Set an unlock method to change your timeout action"
+  },
+  "upgrade": {
+    "message": "Upgrade"
+  },
+  "leaveConfirmationDialogTitle": {
+    "message": "Are you sure you want to leave?"
+  },
+  "leaveConfirmationDialogContentOne": {
+    "message": "By declining, your personal items will stay in your account, but you'll lose access to shared items and organization features."
+  },
+  "leaveConfirmationDialogContentTwo": {
+    "message": "Contact your admin to regain access."
+  },
+  "leaveConfirmationDialogConfirmButton": {
+    "message": "Leave $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"
+      }
+    }
+  },
+   "howToManageMyVault": {
+    "message": "How do I manage my vault?"
+  },
+  "transferItemsToOrganizationTitle": {
+    "message": "Transfer items to $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "transferItemsToOrganizationContent": {
+    "message": "$ORGANIZATION$ is requiring all items to be owned by the organization for security and compliance. Click accept to transfer ownership of your items.",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "acceptTransfer": {
+    "message": "Accept transfer"
+  },
+  "declineAndLeave": {
+    "message": "Decline and leave"
+  },
+  "whyAmISeeingThis": {
+    "message": "Why am I seeing this?"
   }
 }
diff --git a/apps/desktop/src/locales/en_GB/messages.json b/apps/desktop/src/locales/en_GB/messages.json
index 16af69361c6..4e1f8569caf 100644
--- a/apps/desktop/src/locales/en_GB/messages.json
+++ b/apps/desktop/src/locales/en_GB/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/en_IN/messages.json b/apps/desktop/src/locales/en_IN/messages.json
index c6f1253bb59..1413debe49c 100644
--- a/apps/desktop/src/locales/en_IN/messages.json
+++ b/apps/desktop/src/locales/en_IN/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/eo/messages.json b/apps/desktop/src/locales/eo/messages.json
index 28a9f3b8bce..5cb6995eeb6 100644
--- a/apps/desktop/src/locales/eo/messages.json
+++ b/apps/desktop/src/locales/eo/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Lerni pli"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "La funkcio nedisponeblas"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Ĉiuj Send'oj",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Trezorejo"
+    "message": "Trezorejo",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Saluti per la ĉefa pasvorto"
diff --git a/apps/desktop/src/locales/es/messages.json b/apps/desktop/src/locales/es/messages.json
index 9966fa1064c..af90b40af65 100644
--- a/apps/desktop/src/locales/es/messages.json
+++ b/apps/desktop/src/locales/es/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Más información"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Característica no disponible"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1GB de espacio en disco cifrado."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opciones de inicio de sesión con autenticación de dos pasos propietarios como YubiKey y Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Información de contacto"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Todos los Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "¿Está seguro de que quieres usar la opción \"Nunca\"? Al ajustar las opciones de bloqueo a \"Nunca\", la clave de cifrado de su caja fuerte se guardará en tu dispositivo. Si usas esta opción, asegúrate de mantener tu dispositivo debidamente protegido."
   },
   "vault": {
-    "message": "Caja fuerte"
+    "message": "Caja fuerte",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Iniciar sesión con contraseña maestra"
diff --git a/apps/desktop/src/locales/et/messages.json b/apps/desktop/src/locales/et/messages.json
index d85c52bb763..8ab2818f7ea 100644
--- a/apps/desktop/src/locales/et/messages.json
+++ b/apps/desktop/src/locales/et/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Loe edasi"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funktsioon pole saadaval"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB ulatuses krüpteeritud salvestusruum."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Eraomanduses kaheastmelise logimise valikud, nagu näiteks YubiKey ja Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Kõik Sendid",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Oled kindel, et soovid kasutada valikut \"Mitte kunagi\"? Sellega talletatakse sinu hoidla krüpteerimise võtit seadme mälus. Peaksid olema väga hoolas ja kindel, et seade on ohutu ja selles ei ole pahavara."
   },
   "vault": {
-    "message": "Hoidla"
+    "message": "Hoidla",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Logi sisse ülemparooliga"
diff --git a/apps/desktop/src/locales/eu/messages.json b/apps/desktop/src/locales/eu/messages.json
index 36401df0078..451e77c4ec0 100644
--- a/apps/desktop/src/locales/eu/messages.json
+++ b/apps/desktop/src/locales/eu/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Gehiago ikasi"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Ezaugarria ez dago erabilgarri"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "Eranskinentzako 1GB-eko zifratutako biltegia."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Send guztiak",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Ziur zaude \"Inoiz ez\" aukera erabili nahi duzula? Zure blokeo aukerak \"Inoiz ez\" bezala konfiguratzeak kutxa gotorraren zifratze-gakoa gailuan gordetzen du. Aukera hau erabiltzen baduzu, gailua behar bezala babestuta duzula ziurtatu behar duzu."
   },
   "vault": {
-    "message": "Kutxa gotorra"
+    "message": "Kutxa gotorra",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Hasi saioa pasahitz nagusiarekin"
diff --git a/apps/desktop/src/locales/fa/messages.json b/apps/desktop/src/locales/fa/messages.json
index ac0e83dd44d..f7dedc42542 100644
--- a/apps/desktop/src/locales/fa/messages.json
+++ b/apps/desktop/src/locales/fa/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "بیشتر بدانید"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "ویژگی موجود نیست"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "۱ گیگابایت فضای ذخیره‌سازی رمزنگاری شده برای پرونده‌های پیوست."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "گزینه‌های ورود اضافی دو مرحله‌ای مانند YubiKey و Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "اطلاعات تماس"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "همه ارسال‌ها",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "آیا جداً می‌خواهید از گزینه \"هرگز\" استفاده کنید؟ تنظیم کردن گزینه قفل به \"هرگز\" کلیدهای رمزنگاری گاوصندوقتان را بر روی دستگاه شما ذخیره خواهد کرد. اگر از این گزینه استفاده می‌کنید باید اطمینان داشته باشید که دستگاه شما کاملا محافظت شده است."
   },
   "vault": {
-    "message": "گاوصندوق"
+    "message": "گاوصندوق",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "با کلمه عبور اصلی وارد شوید"
diff --git a/apps/desktop/src/locales/fi/messages.json b/apps/desktop/src/locales/fi/messages.json
index e2952659d03..2021248bae4 100644
--- a/apps/desktop/src/locales/fi/messages.json
+++ b/apps/desktop/src/locales/fi/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Lue lisää"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Ominaisuus ei ole käytettävissä"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 Gt salattua tallennustilaa tiedostoliitteille."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Kaksivaiheisen kirjautumisen erikoisvaihtoehdot, kuten YubiKey ja Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Yhteystiedot"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Kaikki Sendit",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Haluatko varmasti käyttää asetusta \"Ei koskaan\"? Se tallentaa holvisi salausavaimen laitteellesi. Jos käytät asetusta, varmista, että laite on suojattu hyvin."
   },
   "vault": {
-    "message": "Holvi"
+    "message": "Holvi",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Kirjaudu pääsalasanalla"
diff --git a/apps/desktop/src/locales/fil/messages.json b/apps/desktop/src/locales/fil/messages.json
index 6eaa5577807..9c8bbaf0a34 100644
--- a/apps/desktop/src/locales/fil/messages.json
+++ b/apps/desktop/src/locales/fil/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Matuto nang higit pa"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Hindi magagamit ang tampok"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB naka encrypt na imbakan para sa mga attachment ng file."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Lahat ng Mga Padala",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Sigurado ka bang gusto mong gamitin ang opsyon na \"Never\" Ang pagtatakda ng iyong mga pagpipilian sa lock sa \"Hindi kailanman\" ay nag iimbak ng key ng pag encrypt ng iyong vault sa iyong aparato. Kung gagamitin mo ang pagpipiliang ito dapat mong tiyakin na pinapanatili mong protektado nang maayos ang iyong aparato."
   },
   "vault": {
-    "message": "Ayos"
+    "message": "Ayos",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Mag-login gamit ang pangunahing password"
diff --git a/apps/desktop/src/locales/fr/messages.json b/apps/desktop/src/locales/fr/messages.json
index 6cca98444b8..8f7bfc39c4a 100644
--- a/apps/desktop/src/locales/fr/messages.json
+++ b/apps/desktop/src/locales/fr/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "En savoir plus"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Fonctionnalité non disponible"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 Go de stockage chiffré pour les fichiers joints."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Options de connexion propriétaires à deux facteurs telles que YubiKey et Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informations de contact"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Tous les Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Êtes-vous sûr de vouloir utiliser l'option \"Jamais\" ? Définir le verrouillage sur \"Jamais\" stocke la clé de chiffrement de votre coffre sur votre appareil. Si vous utilisez cette option, vous devez vous assurer de correctement protéger votre appareil."
   },
   "vault": {
-    "message": "Coffre"
+    "message": "Coffre",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Se connecter avec le mot de passe principal"
diff --git a/apps/desktop/src/locales/gl/messages.json b/apps/desktop/src/locales/gl/messages.json
index d607bb8d097..0211550b08d 100644
--- a/apps/desktop/src/locales/gl/messages.json
+++ b/apps/desktop/src/locales/gl/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/he/messages.json b/apps/desktop/src/locales/he/messages.json
index 868cd9ccbc5..5881405c190 100644
--- a/apps/desktop/src/locales/he/messages.json
+++ b/apps/desktop/src/locales/he/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "למידע נוסף"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "יכולת זו לא זמינה"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 ג'יגה של מקום אחסון מוצפן עבור קבצים מצורפים."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "אפשרויות כניסה דו־שלבית קנייניות כגון YubiKey ו־Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "פרטי איש קשר"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "כל הסֵנְדים",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "האם אתה בטוח שברצונך להשתמש באפשרות \"לעולם לא\"? הגדרת אפשרויות הנעילה שלך ל\"לעולם לא\" מאחסנת את מפתח ההצפנה של הכספת שלך במכשיר שלך. אם אתה משתמש באפשרות זו עליך לוודא שאתה שומר על המכשיר שלך מוגן כראוי."
   },
   "vault": {
-    "message": "כספת"
+    "message": "כספת",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "כניסה עם סיסמה ראשית"
diff --git a/apps/desktop/src/locales/hi/messages.json b/apps/desktop/src/locales/hi/messages.json
index 2ab323eedc9..2fac0a369fd 100644
--- a/apps/desktop/src/locales/hi/messages.json
+++ b/apps/desktop/src/locales/hi/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/hr/messages.json b/apps/desktop/src/locales/hr/messages.json
index 0f7a8185118..07effb638b8 100644
--- a/apps/desktop/src/locales/hr/messages.json
+++ b/apps/desktop/src/locales/hr/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Saznaj više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Značajka nije dostupna"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifriranog prostora za pohranu podataka."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Mogućnosti za prijavu u dva koraka kao što su YubiKey i Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Kontaktne informacije"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Svi Sendovi",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Sigurno želiš koristiti opciju „Nikada”? Postavljanje opcija zaključavanja na „Nikada” pohranjuje šifru tvojeg trezora na tvom uređaju. Ako koristiš ovu opciju, trebalo bi osigurati da je uređaj pravilno zaštićen."
   },
   "vault": {
-    "message": "Trezor"
+    "message": "Trezor",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Prijava glavnom lozinkom"
diff --git a/apps/desktop/src/locales/hu/messages.json b/apps/desktop/src/locales/hu/messages.json
index 9a6dd787f8c..583d5b86a59 100644
--- a/apps/desktop/src/locales/hu/messages.json
+++ b/apps/desktop/src/locales/hu/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "További információ"
   },
+  "migrationsFailed": {
+    "message": "Hiba történt a titkosítási beállítások frissítésekor."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "A titkosítási beállítások frissítése"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Az új ajánlott titkosítási beállítások javítják a fiók biztonságát. Adjuk meg a mesterjelszót a frissítéshez most."
+  },
+  "confirmIdentityToContinue": {
+    "message": "A folytatáshoz meg kell erősíteni a személyazonosságot."
+  },
+  "enterYourMasterPassword": {
+    "message": "Mesterjelszó megadása"
+  },
+  "updateSettings": {
+    "message": "Beállítások frissítése"
+  },
   "featureUnavailable": {
     "message": "Ez a funkció nem érhető el."
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB titkosított fájlmelléklet tárhely."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ titkosított tárhely a fájlmellékletekhez.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Saját kétlépcsős bejelentkezési lehetőségek mint a YubiKey és a Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Elérhetőségi adatok"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Összes küldés",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Biztosan szeretnénk használni a \"Soha\" opciót? A zárolási opciók \"Soha\" értékre állítása a széf titkosítási kulcsát az eszközön tárolja. Ennek az opciónak a használatakor célszerű az eszköz megfelelő védettségét biztosítani."
   },
   "vault": {
-    "message": "Széf"
+    "message": "Széf",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Bejelentkezés mesterjelszóval"
diff --git a/apps/desktop/src/locales/id/messages.json b/apps/desktop/src/locales/id/messages.json
index 188ee153da1..fbbb1440990 100644
--- a/apps/desktop/src/locales/id/messages.json
+++ b/apps/desktop/src/locales/id/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Pelajari lebih lanjut"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Fitur Tidak Tersedia"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB penyimpanan berkas yang dienkripsi."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Semua Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Brankas"
+    "message": "Brankas",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/it/messages.json b/apps/desktop/src/locales/it/messages.json
index 8caf4982356..64e31e4136f 100644
--- a/apps/desktop/src/locales/it/messages.json
+++ b/apps/desktop/src/locales/it/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Ulteriori informazioni"
   },
+  "migrationsFailed": {
+    "message": "Si è verificato un errore durante l'aggiornamento delle impostazioni di cifratura."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aggiorna le impostazioni di crittografia"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Le nuove impostazioni di crittografia consigliate miglioreranno la sicurezza del tuo account. Inserisci la tua password principale per aggiornare."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Conferma la tua identità per continuare"
+  },
+  "enterYourMasterPassword": {
+    "message": "Inserisci la tua password principale"
+  },
+  "updateSettings": {
+    "message": "Aggiorna impostazioni"
+  },
   "featureUnavailable": {
     "message": "Funzionalità non disponibile"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB di spazio di archiviazione crittografato per gli allegati."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Archivio crittografato di $SIZE$ per allegati.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opzioni di verifica in due passaggi proprietarie come YubiKey e Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informazioni di contatto"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Tutti i Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Sei sicuro di voler usare l'opzione \"Mai\"? Impostare le opzioni di blocco su \"Mai\" salverà la chiave di crittografia della cassaforte sul tuo dispositivo. Se usi questa opzione, assicurati di mantenere il tuo dispositivo adeguatamente protetto."
   },
   "vault": {
-    "message": "Cassaforte"
+    "message": "Cassaforte",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Accedi con password principale"
diff --git a/apps/desktop/src/locales/ja/messages.json b/apps/desktop/src/locales/ja/messages.json
index ca50828b12c..5accef2b5ee 100644
--- a/apps/desktop/src/locales/ja/messages.json
+++ b/apps/desktop/src/locales/ja/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "詳細情報"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "サービスが利用できません"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1GB の暗号化されたファイルストレージ。"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey、Duo などのプロプライエタリな2段階認証オプション。"
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "すべての Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "本当に「なし」オプションを使用しますか？ロックオプションを「なし」に設定すると、保管庫の暗号化キーがデバイスに保存されます。 このオプションを使用する場合は、デバイスを適切に保護する必要があります。"
   },
   "vault": {
-    "message": "保管庫"
+    "message": "保管庫",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "マスターパスワードでログイン"
diff --git a/apps/desktop/src/locales/ka/messages.json b/apps/desktop/src/locales/ka/messages.json
index 9337286d3fd..cca3ab548cf 100644
--- a/apps/desktop/src/locales/ka/messages.json
+++ b/apps/desktop/src/locales/ka/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "გაიგეთ მეტი"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "საცავი"
+    "message": "საცავი",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/km/messages.json b/apps/desktop/src/locales/km/messages.json
index d607bb8d097..0211550b08d 100644
--- a/apps/desktop/src/locales/km/messages.json
+++ b/apps/desktop/src/locales/km/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/kn/messages.json b/apps/desktop/src/locales/kn/messages.json
index d1375efee8c..4ef1f0edd05 100644
--- a/apps/desktop/src/locales/kn/messages.json
+++ b/apps/desktop/src/locales/kn/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "ಇನ್ನಷ್ಟು ತಿಳಿಯಿರಿ"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "ವೈಶಿಷ್ಟ್ಯ ಲಭ್ಯವಿಲ್ಲ"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "ಫೈಲ್ ಲಗತ್ತುಗಳಿಗಾಗಿ 1 ಜಿಬಿ ಎನ್‌ಕ್ರಿಪ್ಟ್ ಮಾಡಿದ ಸಂಗ್ರಹ."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "ಎಲ್ಲಾ ಕಳುಹಿಸುತ್ತದೆ",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/ko/messages.json b/apps/desktop/src/locales/ko/messages.json
index 2e40b8d7f23..9f6153cb314 100644
--- a/apps/desktop/src/locales/ko/messages.json
+++ b/apps/desktop/src/locales/ko/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "더 알아보기"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "기능 사용할 수 없음"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1GB의 암호화된 파일 저장소."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "모든 Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "정말 \"잠그지 않음\" 옵션을 사용하시겠습니까? 잠금 옵션을 \"잠그지 않음\"으로 설정하면 사용자 보관함의 암호화 키를 사용자의 기기에 보관합니다. 이 옵션을 사용하기 전에 사용자의 기기가 잘 보호되어 있는 상태인지 확인하십시오."
   },
   "vault": {
-    "message": "보관함"
+    "message": "보관함",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "마스터 비밀번호로 로그인"
diff --git a/apps/desktop/src/locales/lt/messages.json b/apps/desktop/src/locales/lt/messages.json
index 16f328d6240..d7612765f1a 100644
--- a/apps/desktop/src/locales/lt/messages.json
+++ b/apps/desktop/src/locales/lt/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Sužinoti daugiau"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funkcija nepasiekiama"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB užšifruotos vietos diske failų prisegimams."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Patentuotos dviejų žingsnių prisijungimo parinktys, tokios kaip YubiKey ir Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Visi Sendai",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Ar jūs tikrai norite naudoti \"Niekada\" pasirinkimą? Nustačius savo užraktą į \"Niekada\", saugyklos šifravimo raktas bus laikomas jūsų įrenginyje. Jei norite naudotis šiuo pasirinkimu, užtikrinkite savo įrenginio saugą."
   },
   "vault": {
-    "message": "Saugykla"
+    "message": "Saugykla",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Prisijungti su pagrindiniu slaptažodžiu"
diff --git a/apps/desktop/src/locales/lv/messages.json b/apps/desktop/src/locales/lv/messages.json
index 7800a4e9024..5624f89f5db 100644
--- a/apps/desktop/src/locales/lv/messages.json
+++ b/apps/desktop/src/locales/lv/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Uzzināt vairāk"
   },
+  "migrationsFailed": {
+    "message": "Atgadījās kļūda šifrēšanas iestatījumu atjaunināšanā."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atjaunini savus šifrēšanas iestatījumus"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Jaunie ieteicamie šifrēšanas iestatījumi uzlabos Tava konta drošību. Jāievada sava galvenā parole, lai atjauninātu tagad."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Jāapliecina sava identitāte, lai turpinātu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Jāievada sava galvenā parole"
+  },
+  "updateSettings": {
+    "message": "Atjaunināt Iestatījumus"
+  },
   "featureUnavailable": {
     "message": "Iespēja nav pieejama"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrētas krātuves datņu pielikumiem."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrētas krātuves datņu pielikumiem.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Tādas slēgtā pirmavota divpakāpju pieteikšanās iespējas kā YubiKey un Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Saziņas informācija"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Visi Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Vai tiešām izmantot uzstādījumu \"Nekad\"? Uzstādot aizslēgšanas iespēju uz \"Nekad\", šifrēšanas atslēga tiek glabāta ierīcē. Ja šī iespēja tiek izmantota, jāpārliecinās, ka ierīce tiek pienācīgi aizsargāta."
   },
   "vault": {
-    "message": "Glabātava"
+    "message": "Glabātava",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Pieteikties ar galveno paroli"
diff --git a/apps/desktop/src/locales/me/messages.json b/apps/desktop/src/locales/me/messages.json
index 29e3cefee0c..684c4682aa0 100644
--- a/apps/desktop/src/locales/me/messages.json
+++ b/apps/desktop/src/locales/me/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Saznaj više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funkcija nije dostupna"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrovanog skladišta za priloge datoteka."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/ml/messages.json b/apps/desktop/src/locales/ml/messages.json
index 662ce9a1fc6..e91ca21a686 100644
--- a/apps/desktop/src/locales/ml/messages.json
+++ b/apps/desktop/src/locales/ml/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "കൂടുതൽ അറിയുക"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "സവിശേഷത ലഭ്യമല്ല"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "ഫയൽ അറ്റാച്ചുമെന്റുകൾക്കായി 1 GB എൻക്രിപ്റ്റുചെയ്‌ത സ്റ്റോറേജ്."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "എല്ലാം Send-കൾ",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/mr/messages.json b/apps/desktop/src/locales/mr/messages.json
index d607bb8d097..0211550b08d 100644
--- a/apps/desktop/src/locales/mr/messages.json
+++ b/apps/desktop/src/locales/mr/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/my/messages.json b/apps/desktop/src/locales/my/messages.json
index bcbd26cede3..969e67d3560 100644
--- a/apps/desktop/src/locales/my/messages.json
+++ b/apps/desktop/src/locales/my/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/nb/messages.json b/apps/desktop/src/locales/nb/messages.json
index 42fb6d479c0..35bd7750481 100644
--- a/apps/desktop/src/locales/nb/messages.json
+++ b/apps/desktop/src/locales/nb/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Lær mer"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funksjonen er utilgjengelig"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB med kryptert fillagring."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Kontaktinformasjon"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Send-er",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Er du sikker på at du vil bruke alternativet «Aldri»? Ved å angi låsemulighetene til «Aldri» lagres hvelvets krypteringsnøkkel på enheten. Hvis du bruker dette alternativet, bør du sørge for at du holder enheten forsvarlig beskyttet."
   },
   "vault": {
-    "message": "Hvelv"
+    "message": "Hvelv",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Logg inn med hovedpassord"
diff --git a/apps/desktop/src/locales/ne/messages.json b/apps/desktop/src/locales/ne/messages.json
index cce8f6a2ba5..b8038093f90 100644
--- a/apps/desktop/src/locales/ne/messages.json
+++ b/apps/desktop/src/locales/ne/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/nl/messages.json b/apps/desktop/src/locales/nl/messages.json
index 82b51b018c5..8833f59489a 100644
--- a/apps/desktop/src/locales/nl/messages.json
+++ b/apps/desktop/src/locales/nl/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Meer informatie"
   },
+  "migrationsFailed": {
+    "message": "Er is een fout opgetreden bij het bijwerken van de versleutelingsinstellingen."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Je versleutelingsinstellingen bijwerken"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nieuwe aanbevolen versleutelingsinstellingen verbeteren de beveiliging van je account. Voer je hoofdwachtwoord in om nu bij te werken."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bevestig je identiteit om door te gaan"
+  },
+  "enterYourMasterPassword": {
+    "message": "Voer je hoofdwachtwoord in"
+  },
+  "updateSettings": {
+    "message": "Instellingen bijwerken"
+  },
   "featureUnavailable": {
     "message": "Functionaliteit niet beschikbaar"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB versleutelde opslag voor bijlagen."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ versleutelde opslag voor bijlagen.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Eigen opties voor tweestapsaanmelding zoals YubiKey en Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact informatie"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Weet je zeker dat je de optie \"Nooit\" wilt gebruiken? De vergrendelingsoptie \"Nooit\" bewaart de sleutel van je kluis op je apparaat. Als je deze optie gebruikt, moet je ervoor zorgen dat je je apparaat naar behoren beschermt."
   },
   "vault": {
-    "message": "Kluis"
+    "message": "Kluis",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Inloggen met je hoofdwachtwoord"
@@ -3631,7 +3663,7 @@
     "message": "Import directly from browser"
   },
   "browserProfile": {
-    "message": "Browser Profile"
+    "message": "Browserprofiel"
   },
   "seeDetailedInstructions": {
     "message": "Zie gedetailleerde instructies op onze helpsite op",
diff --git a/apps/desktop/src/locales/nn/messages.json b/apps/desktop/src/locales/nn/messages.json
index 08567979e8b..5264ce8c561 100644
--- a/apps/desktop/src/locales/nn/messages.json
+++ b/apps/desktop/src/locales/nn/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Lær meir"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funksjon er utilgjengeleg"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alle Send-ar",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/or/messages.json b/apps/desktop/src/locales/or/messages.json
index 4ca05acaac5..b145306e14d 100644
--- a/apps/desktop/src/locales/or/messages.json
+++ b/apps/desktop/src/locales/or/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/pl/messages.json b/apps/desktop/src/locales/pl/messages.json
index c05e7f05cb1..4cb6650e2c7 100644
--- a/apps/desktop/src/locales/pl/messages.json
+++ b/apps/desktop/src/locales/pl/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Dowiedz się więcej"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funkcja jest niedostępna"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB miejsca na zaszyfrowane załączniki."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Specjalne opcje logowania dwustopniowego, takie jak YubiKey i Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informacje kontaktowe"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Wszystkie wysyłki",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Czy na pewno chcesz użyć opcji „Nigdy”? Ustawienie blokady na „Nigdy” spowoduje przechowywanie klucza szyfrowania sejfu na urządzeniu. Upewnij się, że urządzenie jest odpowiednio chronione."
   },
   "vault": {
-    "message": "Sejf"
+    "message": "Sejf",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Logowanie hasłem głównym"
diff --git a/apps/desktop/src/locales/pt_BR/messages.json b/apps/desktop/src/locales/pt_BR/messages.json
index e351bfb7dba..dc64f1b701b 100644
--- a/apps/desktop/src/locales/pt_BR/messages.json
+++ b/apps/desktop/src/locales/pt_BR/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Saiba mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as configurações de criptografia."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize suas configurações de criptografia"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas configurações de criptografia recomendadas melhorarão a segurança da sua conta. Digite sua senha principal para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Digite sua senha principal"
+  },
+  "updateSettings": {
+    "message": "Atualizar configurações"
+  },
   "featureUnavailable": {
     "message": "Recurso indisponível"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB de armazenamento criptografado para anexos de arquivos."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento criptografado para anexos de arquivo.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opções proprietárias de autenticação em duas etapas como YubiKey e Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informações de contato"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Todos os Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Você tem certeza que deseja usar a opção \"Nunca\"? Ao usar o \"Nunca\", a chave de criptografia do seu cofre é armazenada no seu dispositivo. Se você usar esta opção, deve garantir que mantém seu dispositivo devidamente protegido."
   },
   "vault": {
-    "message": "Cofre"
+    "message": "Cofre",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Conectar-se com senha principal"
diff --git a/apps/desktop/src/locales/pt_PT/messages.json b/apps/desktop/src/locales/pt_PT/messages.json
index de0427ddab0..c0e396c63c4 100644
--- a/apps/desktop/src/locales/pt_PT/messages.json
+++ b/apps/desktop/src/locales/pt_PT/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Saber mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as definições de encriptação."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize as suas definições de encriptação"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas definições de encriptação recomendadas irão melhorar a segurança da sua conta. Introduza a sua palavra-passe mestra para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme a sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Introduza a sua palavra-passe mestra"
+  },
+  "updateSettings": {
+    "message": "Atualizar definições"
+  },
   "featureUnavailable": {
     "message": "Funcionalidade indisponível"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB de armazenamento encriptado para anexos de ficheiros."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento encriptado para anexos de ficheiros.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opções proprietárias de verificação de dois passos, como YubiKey e Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Informações de contacto"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Todos os Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Tem a certeza de que deseja utilizar a opção \"Nunca\"? Ao definir as opções de bloqueio para \"Nunca\" armazena a chave de encriptação do seu cofre no seu dispositivo. Se utilizar esta opção deve assegurar-se de que mantém o seu dispositivo devidamente protegido."
   },
   "vault": {
-    "message": "Cofre"
+    "message": "Cofre",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Iniciar sessão com a palavra-passe mestra"
@@ -3048,7 +3080,7 @@
     "message": "Será notificado quando o pedido for aprovado"
   },
   "needAnotherOption": {
-    "message": "O início de sessão com o dispositivo deve ser ativado nas definições da aplicação Bitwarden. Precisa de outra opção?"
+    "message": "O início de sessão com o dispositivo deve ser ativado nas definições da app Bitwarden. Precisa de outra opção?"
   },
   "viewAllLogInOptions": {
     "message": "Ver todas as opções de início de sessão"
diff --git a/apps/desktop/src/locales/ro/messages.json b/apps/desktop/src/locales/ro/messages.json
index a72ce3547e9..d2e589836e0 100644
--- a/apps/desktop/src/locales/ro/messages.json
+++ b/apps/desktop/src/locales/ro/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Aflați mai multe"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funcție indisponibilă"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB spațiu de stocare criptat pentru atașamente de fișiere."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Toate Send-urile",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Sunteți sigur că doriți să folosiți opțiunea „Niciodată”? Setarea opțiunilor de blocare la „Niciodată” stochează cheia de criptare a seifului pe dispozitivul dumneavoastră. Dacă utilizați această opțiune, trebuie să vă asigurați că vă păstrați dispozitivul protejat corespunzător."
   },
   "vault": {
-    "message": "Seif"
+    "message": "Seif",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Autentificați-vă cu parola principală"
diff --git a/apps/desktop/src/locales/ru/messages.json b/apps/desktop/src/locales/ru/messages.json
index 914bb603630..a59ae2282d5 100644
--- a/apps/desktop/src/locales/ru/messages.json
+++ b/apps/desktop/src/locales/ru/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Подробнее"
   },
+  "migrationsFailed": {
+    "message": "Произошла ошибка при обновлении настроек шифрования."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновите настройки шифрования"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новые рекомендуемые настройки шифрования повысят безопасность вашего аккаунта. Введите мастер-пароль, чтобы обновить сейчас."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Подтвердите вашу личность, чтобы продолжить"
+  },
+  "enterYourMasterPassword": {
+    "message": "Введите ваш мастер-пароль"
+  },
+  "updateSettings": {
+    "message": "Обновить настройки"
+  },
   "featureUnavailable": {
     "message": "Функция недоступна"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашифрованного хранилища для вложенных файлов."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Зашифрованного хранилища для вложенных файлов: $SIZE$",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Проприетарные варианты двухэтапной аутентификации, такие как YubiKey или Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Контактная информация"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Все Send’ы",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Вы действительно хотите отключить блокировку хранилища? В этом случае ключ шифрования вашего хранилища будет сохранен на вашем устройстве. Отключая блокировку, вы должны убедиться, что ваше устройство надежно защищено."
   },
   "vault": {
-    "message": "Хранилище"
+    "message": "Хранилище",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Войти с мастер-паролем"
diff --git a/apps/desktop/src/locales/si/messages.json b/apps/desktop/src/locales/si/messages.json
index a83b2cbf536..51333386f8a 100644
--- a/apps/desktop/src/locales/si/messages.json
+++ b/apps/desktop/src/locales/si/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/sk/messages.json b/apps/desktop/src/locales/sk/messages.json
index 0b14b961bbb..0e62a8ee8b0 100644
--- a/apps/desktop/src/locales/sk/messages.json
+++ b/apps/desktop/src/locales/sk/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Zistiť viac"
   },
+  "migrationsFailed": {
+    "message": "Pri aktualizácii nastavení šifrovania došlo k chybe."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aktualizujte nastavenie šifrovania"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Nové odporúčané nastavenia šifrovania zlepšia bezpečnosť vášho účtu. Ak ich chcete aktualizovať teraz, zadajte hlavné heslo."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Ak chcete pokračovať, potvrďte svoju identitu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Zadajte hlavné heslo"
+  },
+  "updateSettings": {
+    "message": "Aktualizovať nastavenia"
+  },
   "featureUnavailable": {
     "message": "Funkcia nie je k dispozícii"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrovaného úložiska."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrovaného úložiska na prílohy.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietárne možnosti dvojstupňového prihlásenia ako napríklad YubiKey a Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Kontaktné informácie"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Všetky Sendy",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Ste si istí, že chcete použiť možnosť \"Nikdy\"? Táto predvoľba ukladá šifrovací kľúč od trezora priamo na zariadení. Ak použijete túto možnosť, mali by ste svoje zariadenie náležite zabezpečiť."
   },
   "vault": {
-    "message": "Trezor"
+    "message": "Trezor",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Prihlásenie pomocou hlavného hesla"
diff --git a/apps/desktop/src/locales/sl/messages.json b/apps/desktop/src/locales/sl/messages.json
index 353c6858afa..c640320ab1a 100644
--- a/apps/desktop/src/locales/sl/messages.json
+++ b/apps/desktop/src/locales/sl/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Več o tem"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Funkcija ni na voljo"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Vsi Sendsi",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/sr/messages.json b/apps/desktop/src/locales/sr/messages.json
index 1bc4a0ed016..4e69efe726f 100644
--- a/apps/desktop/src/locales/sr/messages.json
+++ b/apps/desktop/src/locales/sr/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Сазнај више"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Функција је недоступна"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1ГБ шифровано складиште за прилоге."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Приоритарне опције пријаве у два корака као што су YubiKey и Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Контакт подаци"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Сва слања",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Да ли сте сигурни да желите да користите опцију „Никад“? Ако поставите опције закључавања на „Никада“, на вашем уређају се чува кључ за шифровање сефа. Ако користите ову опцију, осигурајте да је уређај правилно заштићен."
   },
   "vault": {
-    "message": "Сеф"
+    "message": "Сеф",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Пријавите се са главном лозинком"
diff --git a/apps/desktop/src/locales/sv/messages.json b/apps/desktop/src/locales/sv/messages.json
index 93d56419ae3..6f3e68c8959 100644
--- a/apps/desktop/src/locales/sv/messages.json
+++ b/apps/desktop/src/locales/sv/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Läs mer"
   },
+  "migrationsFailed": {
+    "message": "Ett fel inträffade när krypteringsinställningarna skulle uppdateras."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Uppdatera dina krypteringsinställningar"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nya rekommenderade krypteringsinställningarna kommer att förbättra säkerheten för ditt konto. Ange ditt huvudlösenord för att uppdatera nu."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bekräfta din identitet för att fortsätta"
+  },
+  "enterYourMasterPassword": {
+    "message": "Ange ditt huvudlösenord"
+  },
+  "updateSettings": {
+    "message": "Uppdatera inställningar"
+  },
   "featureUnavailable": {
     "message": "Funktion ej tillgänglig"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB krypterad lagring."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ krypterad lagring för filbilagor.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Premium-alternativ för tvåstegsverifiering, såsom YubiKey och Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Kontaktinformation"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Alla Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Är du säker på att du vill använda alternativet ”Aldrig”? Att ställa in låsnings-alternativet till ”Aldrig” lagrar valvets krypteringsnyckel på datorn. Om du använder det här alternativet bör du se till att du håller datorn ordentligt skyddad."
   },
   "vault": {
-    "message": "Valv"
+    "message": "Valv",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Logga in med huvudlösenord"
diff --git a/apps/desktop/src/locales/ta/messages.json b/apps/desktop/src/locales/ta/messages.json
index 2f9d12917d6..a83867a9eff 100644
--- a/apps/desktop/src/locales/ta/messages.json
+++ b/apps/desktop/src/locales/ta/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "மேலும் அறியவும்"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "வசதி கிடைக்கவில்லை"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "கோப்பு இணைப்புகளுக்கு 1 GB குறியாக்கப்பட்ட சேமிப்பகம்."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey மற்றும் Duo போன்ற பிரத்யேக இரண்டு-படி உள்நுழைவு விருப்பங்கள்."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "தொடர்புத் தகவல்"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "அனைத்து அனுப்புதல்களும்",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "\"ஒருபோதும் இல்லை\" விருப்பத்தைப் பயன்படுத்த விரும்புகிறீர்களா? உங்கள் பூட்டு விருப்பங்களை \"ஒருபோதும் இல்லை\" என அமைப்பது உங்கள் வால்ட்டின் குறியாக்க சாவியை உங்கள் சாதனத்தில் சேமிக்கிறது. இந்த விருப்பத்தைப் பயன்படுத்தினால், உங்கள் சாதனத்தை நீங்கள் சரியாகப் பாதுகாப்பதை உறுதி செய்ய வேண்டும்."
   },
   "vault": {
-    "message": "வால்ட்"
+    "message": "வால்ட்",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "முதன்மை கடவுச்சொல்லுடன் உள்நுழைக"
diff --git a/apps/desktop/src/locales/te/messages.json b/apps/desktop/src/locales/te/messages.json
index d607bb8d097..0211550b08d 100644
--- a/apps/desktop/src/locales/te/messages.json
+++ b/apps/desktop/src/locales/te/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "All Sends",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/th/messages.json b/apps/desktop/src/locales/th/messages.json
index d794ace629c..f5bbde79a86 100644
--- a/apps/desktop/src/locales/th/messages.json
+++ b/apps/desktop/src/locales/th/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "เรียนรู้เพิ่มเติม"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Feature Unavailable"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB of encrypted file storage."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Contact information"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "ส่งทั้งหมด",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Are you sure you want to use the \"Never\" option? Setting your lock options to \"Never\" stores your vault's encryption key on your device. If you use this option you should ensure that you keep your device properly protected."
   },
   "vault": {
-    "message": "Vault"
+    "message": "Vault",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Log in with master password"
diff --git a/apps/desktop/src/locales/tr/messages.json b/apps/desktop/src/locales/tr/messages.json
index ac67b177cbf..bb0b6f2fd51 100644
--- a/apps/desktop/src/locales/tr/messages.json
+++ b/apps/desktop/src/locales/tr/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Daha fazla bilgi al"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Özellik kullanılamıyor"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "Dosya ekleri için 1 GB şifrelenmiş depolama."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Dosya ekleri için $SIZE$ şifrelenmiş depolama.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey ve Duo gibi marka bazlı iki aşamalı giriş seçenekleri."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "İletişim bilgileri"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Tüm Send'ler",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "\"Asla\" seçeneğini kullanmak istediğinizden emin misiniz? Kilit seçeneklerinizi \"Asla\" olarak ayarlarsanız kasanızın şifreleme anahtarı cihazınızda saklanacaktır. Bu seçeneği kullanırsanız cihazınızı çok iyi korumalısınız."
   },
   "vault": {
-    "message": "Kasa"
+    "message": "Kasa",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Ana parola ile giriş yap"
diff --git a/apps/desktop/src/locales/uk/messages.json b/apps/desktop/src/locales/uk/messages.json
index 7ed0710ca74..bed09352f03 100644
--- a/apps/desktop/src/locales/uk/messages.json
+++ b/apps/desktop/src/locales/uk/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Докладніше"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Функція недоступна"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашифрованого сховища для файлів."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Додаткові можливості двоетапної авторизації, як-от YubiKey та Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Контактна інформація"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Усі відправлення",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Ви впевнені, що ніколи не хочете блокувати? Встановивши параметр блокування \"Ніколи\", ключ шифрування сховища зберігатиметься на вашому пристрої. Користуючись цим параметром, ви маєте бути впевнені в тому, що ваш пристрій надійно захищений."
   },
   "vault": {
-    "message": "Сховище"
+    "message": "Сховище",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Увійти з головним паролем"
diff --git a/apps/desktop/src/locales/vi/messages.json b/apps/desktop/src/locales/vi/messages.json
index 8bf88aba458..30038f046db 100644
--- a/apps/desktop/src/locales/vi/messages.json
+++ b/apps/desktop/src/locales/vi/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "Tìm hiểu thêm"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "Tính năng không có sẵn"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "1GB bộ nhớ lưu trữ được mã hóa cho các tệp đính kèm."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Các tùy chọn xác minh hai bước như YubiKey và Duo."
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "Thông tin liên hệ"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "Tất cả Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "Bạn có chắc chắn muốn chọn \"Không bao giờ\" không? Lựa chọn này sẽ lưu khóa mã hóa kho của bạn trực tiếp trên thiết bị. Hãy nhớ bảo vệ thiết bị của bạn thật cẩn thận nếu bạn chọn tùy chọn này."
   },
   "vault": {
-    "message": "Kho lưu trữ"
+    "message": "Kho lưu trữ",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "Đăng nhập bằng mật khẩu chính"
diff --git a/apps/desktop/src/locales/zh_CN/messages.json b/apps/desktop/src/locales/zh_CN/messages.json
index 70711c7aa4e..80965415475 100644
--- a/apps/desktop/src/locales/zh_CN/messages.json
+++ b/apps/desktop/src/locales/zh_CN/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "进一步了解"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "功能不可用"
   },
@@ -1488,7 +1506,16 @@
     "message": "注册高级会员将获得："
   },
   "premiumSignUpStorage": {
-    "message": "1 GB 文件附件加密存储。"
+    "message": "1 GB 文件附件加密存储空间。"
+  },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ 文件附件加密存储空间。",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
   },
   "premiumSignUpTwoStepOptions": {
     "message": "专有的两步登录选项，如 YubiKey 和 Duo。"
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "联系信息"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "所有的 Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "确定要使用「从不」选项吗？将锁定选项设置为「从不」会将密码库的加密密钥存储在您的设备上。如果使用此选项，您必须确保您的设备安全。"
   },
   "vault": {
-    "message": "密码库"
+    "message": "密码库",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "使用主密码登录"
diff --git a/apps/desktop/src/locales/zh_TW/messages.json b/apps/desktop/src/locales/zh_TW/messages.json
index 61fc00543ed..e412adf9e5b 100644
--- a/apps/desktop/src/locales/zh_TW/messages.json
+++ b/apps/desktop/src/locales/zh_TW/messages.json
@@ -1093,6 +1093,24 @@
   "learnMore": {
     "message": "了解更多"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "featureUnavailable": {
     "message": "功能不可用"
   },
@@ -1490,6 +1508,15 @@
   "premiumSignUpStorage": {
     "message": "用於檔案附件的 1 GB 的加密檔案儲存空間。"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "專有的兩步驟登入選項，例如 YubiKey 和 Duo。"
   },
@@ -2228,6 +2255,10 @@
   "contactInfo": {
     "message": "聯絡資訊"
   },
+  "send": {
+    "message": "Send",
+    "description": "'Send' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
+  },
   "allSends": {
     "message": "所有 Send",
     "description": "'Sends' is a noun and the name of a feature called 'Bitwarden Send'. It should not be translated."
@@ -2991,7 +3022,8 @@
     "message": "您確定要使用「永不」選項嗎？將鎖定選項設定為「永不」會將密碼庫的加密金鑰儲存在您的裝置上。如果使用此選項，應確保您的裝置是安全的。"
   },
   "vault": {
-    "message": "密碼庫"
+    "message": "密碼庫",
+    "description": "'Vault' is a noun and refers to the Bitwarden Vault feature."
   },
   "loginWithMasterPassword": {
     "message": "使用主密碼登入"
diff --git a/apps/desktop/src/main/native-messaging.main.ts b/apps/desktop/src/main/native-messaging.main.ts
index ba5d8616752..a0c17a115e0 100644
--- a/apps/desktop/src/main/native-messaging.main.ts
+++ b/apps/desktop/src/main/native-messaging.main.ts
@@ -14,7 +14,7 @@ import { isDev } from "../utils";
 import { WindowMain } from "./window.main";
 
 export class NativeMessagingMain {
-  private ipcServer: ipc.IpcServer | null;
+  private ipcServer: ipc.NativeIpcServer | null;
   private connected: number[] = [];
 
   constructor(
@@ -78,7 +78,7 @@ export class NativeMessagingMain {
       this.ipcServer.stop();
     }
 
-    this.ipcServer = await ipc.IpcServer.listen("bw", (error, msg) => {
+    this.ipcServer = await ipc.NativeIpcServer.listen("bw", (error, msg) => {
       switch (msg.kind) {
         case ipc.IpcMessageType.Connected: {
           this.connected.push(msg.clientId);
@@ -314,6 +314,7 @@ export class NativeMessagingMain {
       "Microsoft Edge Canary": `${this.homedir()}/Library/Application\ Support/Microsoft\ Edge\ Canary/`,
       Vivaldi: `${this.homedir()}/Library/Application\ Support/Vivaldi/`,
       Zen: `${this.homedir()}/Library/Application\ Support/Zen/`,
+      Helium: `${this.homedir()}/Library/Application\ Support/net.imput.helium/`,
     };
     /* eslint-enable no-useless-escape */
   }
diff --git a/apps/desktop/src/main/tray.main.ts b/apps/desktop/src/main/tray.main.ts
index b7ddefe6e1b..81df6497ca8 100644
--- a/apps/desktop/src/main/tray.main.ts
+++ b/apps/desktop/src/main/tray.main.ts
@@ -53,9 +53,14 @@ export class TrayMain {
       },
       {
         visible: isDev(),
-        label: "Fake Popup",
+        label: "Fake Popup Select",
         click: () => this.fakePopup(),
       },
+      {
+        visible: isDev(),
+        label: "Fake Popup Create",
+        click: () => this.fakePopupCreate(),
+      },
       { type: "separator" },
       {
         label: this.i18nService.t("exit"),
@@ -218,4 +223,8 @@ export class TrayMain {
   private async fakePopup() {
     await this.messagingService.send("loadurl", { url: "/passkeys", modal: true });
   }
+
+  private async fakePopupCreate() {
+    await this.messagingService.send("loadurl", { url: "/create-passkey", modal: true });
+  }
 }
diff --git a/apps/desktop/src/main/window.main.ts b/apps/desktop/src/main/window.main.ts
index 0e234126ea3..bbdd2ad0a0f 100644
--- a/apps/desktop/src/main/window.main.ts
+++ b/apps/desktop/src/main/window.main.ts
@@ -100,10 +100,10 @@ export class WindowMain {
             applyMainWindowStyles(this.win, this.windowStates[mainWindowSizeKey]);
             // Because modal is used in front of another app, UX wise it makes sense to hide the main window when leaving modal mode.
             this.win.hide();
-          } else if (!lastValue.isModalModeActive && newValue.isModalModeActive) {
+          } else if (newValue.isModalModeActive) {
             // Apply the popup modal styles
             this.logService.info("Applying popup modal styles", newValue.modalPosition);
-            applyPopupModalStyles(this.win, newValue.modalPosition);
+            applyPopupModalStyles(this.win, newValue.showTrafficButtons, newValue.modalPosition);
             this.win.show();
           }
         }),
@@ -273,7 +273,7 @@ export class WindowMain {
     this.win = new BrowserWindow({
       width: this.windowStates[mainWindowSizeKey].width,
       height: this.windowStates[mainWindowSizeKey].height,
-      minWidth: 680,
+      minWidth: 600,
       minHeight: 500,
       x: this.windowStates[mainWindowSizeKey].x,
       y: this.windowStates[mainWindowSizeKey].y,
diff --git a/apps/desktop/src/platform/components/approve-ssh-request.html b/apps/desktop/src/platform/components/approve-ssh-request.html
index 55092788079..c691891487e 100644
--- a/apps/desktop/src/platform/components/approve-ssh-request.html
+++ b/apps/desktop/src/platform/components/approve-ssh-request.html
@@ -2,13 +2,11 @@
   <bit-dialog>
     <div class="tw-font-medium" bitDialogTitle>{{ "sshkeyApprovalTitle" | i18n }}</div>
     <div bitDialogContent>
-      <app-callout
-        type="warning"
-        title="{{ 'agentForwardingWarningTitle' | i18n }}"
-        *ngIf="params.isAgentForwarding"
-      >
+      @if (params.isAgentForwarding) {
+      <bit-callout type="warning" title="{{ 'agentForwardingWarningTitle' | i18n }}">
         {{ 'agentForwardingWarningText' | i18n }}
-      </app-callout>
+      </bit-callout>
+      }
 
       <b>{{params.applicationName}}</b> {{ "sshkeyApprovalMessageInfix" | i18n }}
       <b>{{params.cipherName}}</b>
diff --git a/apps/desktop/src/platform/components/approve-ssh-request.ts b/apps/desktop/src/platform/components/approve-ssh-request.ts
index 1741124774d..a2cae3d59e7 100644
--- a/apps/desktop/src/platform/components/approve-ssh-request.ts
+++ b/apps/desktop/src/platform/components/approve-ssh-request.ts
@@ -12,6 +12,7 @@ import {
   FormFieldModule,
   IconButtonModule,
   DialogService,
+  CalloutModule,
 } from "@bitwarden/components";
 
 export interface ApproveSshRequestParams {
@@ -35,6 +36,7 @@ export interface ApproveSshRequestParams {
     ReactiveFormsModule,
     AsyncActionsModule,
     FormFieldModule,
+    CalloutModule,
   ],
 })
 export class ApproveSshRequestComponent {
diff --git a/apps/desktop/src/platform/main/autofill/native-autofill.main.ts b/apps/desktop/src/platform/main/autofill/native-autofill.main.ts
index 71cfcab84ba..c0d860d74db 100644
--- a/apps/desktop/src/platform/main/autofill/native-autofill.main.ts
+++ b/apps/desktop/src/platform/main/autofill/native-autofill.main.ts
@@ -7,6 +7,11 @@ import { WindowMain } from "../../../main/window.main";
 
 import { CommandDefinition } from "./command";
 
+type BufferedMessage = {
+  channel: string;
+  data: any;
+};
+
 export type RunCommandParams<C extends CommandDefinition> = {
   namespace: C["namespace"];
   command: C["name"];
@@ -16,13 +21,44 @@ export type RunCommandParams<C extends CommandDefinition> = {
 export type RunCommandResult<C extends CommandDefinition> = C["output"];
 
 export class NativeAutofillMain {
-  private ipcServer: autofill.IpcServer | null;
+  private ipcServer?: autofill.AutofillIpcServer;
+  private messageBuffer: BufferedMessage[] = [];
+  private listenerReady = false;
 
   constructor(
     private logService: LogService,
     private windowMain: WindowMain,
   ) {}
 
+  /**
+   * Safely sends a message to the renderer, buffering it if the server isn't ready yet
+   */
+  private safeSend(channel: string, data: any) {
+    if (this.listenerReady && this.windowMain.win?.webContents) {
+      this.windowMain.win.webContents.send(channel, data);
+    } else {
+      this.messageBuffer.push({ channel, data });
+    }
+  }
+
+  /**
+   * Flushes all buffered messages to the renderer
+   */
+  private flushMessageBuffer() {
+    if (!this.windowMain.win?.webContents) {
+      this.logService.error("Cannot flush message buffer - window not available");
+      return;
+    }
+
+    this.logService.info(`Flushing ${this.messageBuffer.length} buffered messages`);
+
+    for (const { channel, data } of this.messageBuffer) {
+      this.windowMain.win.webContents.send(channel, data);
+    }
+
+    this.messageBuffer = [];
+  }
+
   async init() {
     ipcMain.handle(
       "autofill.runCommand",
@@ -34,16 +70,16 @@ export class NativeAutofillMain {
       },
     );
 
-    this.ipcServer = await autofill.IpcServer.listen(
+    this.ipcServer = await autofill.AutofillIpcServer.listen(
       "af",
       // RegistrationCallback
       (error, clientId, sequenceNumber, request) => {
         if (error) {
           this.logService.error("autofill.IpcServer.registration", error);
-          this.ipcServer.completeError(clientId, sequenceNumber, String(error));
+          this.ipcServer?.completeError(clientId, sequenceNumber, String(error));
           return;
         }
-        this.windowMain.win.webContents.send("autofill.passkeyRegistration", {
+        this.safeSend("autofill.passkeyRegistration", {
           clientId,
           sequenceNumber,
           request,
@@ -53,10 +89,10 @@ export class NativeAutofillMain {
       (error, clientId, sequenceNumber, request) => {
         if (error) {
           this.logService.error("autofill.IpcServer.assertion", error);
-          this.ipcServer.completeError(clientId, sequenceNumber, String(error));
+          this.ipcServer?.completeError(clientId, sequenceNumber, String(error));
           return;
         }
-        this.windowMain.win.webContents.send("autofill.passkeyAssertion", {
+        this.safeSend("autofill.passkeyAssertion", {
           clientId,
           sequenceNumber,
           request,
@@ -66,33 +102,54 @@ export class NativeAutofillMain {
       (error, clientId, sequenceNumber, request) => {
         if (error) {
           this.logService.error("autofill.IpcServer.assertion", error);
-          this.ipcServer.completeError(clientId, sequenceNumber, String(error));
+          this.ipcServer?.completeError(clientId, sequenceNumber, String(error));
           return;
         }
-        this.windowMain.win.webContents.send("autofill.passkeyAssertionWithoutUserInterface", {
+        this.safeSend("autofill.passkeyAssertionWithoutUserInterface", {
           clientId,
           sequenceNumber,
           request,
         });
       },
+      // NativeStatusCallback
+      (error, clientId, sequenceNumber, status) => {
+        if (error) {
+          this.logService.error("autofill.IpcServer.nativeStatus", error);
+          this.ipcServer?.completeError(clientId, sequenceNumber, String(error));
+          return;
+        }
+        this.safeSend("autofill.nativeStatus", {
+          clientId,
+          sequenceNumber,
+          status,
+        });
+      },
     );
 
+    ipcMain.on("autofill.listenerReady", () => {
+      this.listenerReady = true;
+      this.logService.info(
+        `Listener is ready, flushing ${this.messageBuffer.length} buffered messages`,
+      );
+      this.flushMessageBuffer();
+    });
+
     ipcMain.on("autofill.completePasskeyRegistration", (event, data) => {
-      this.logService.warning("autofill.completePasskeyRegistration", data);
+      this.logService.debug("autofill.completePasskeyRegistration", data);
       const { clientId, sequenceNumber, response } = data;
-      this.ipcServer.completeRegistration(clientId, sequenceNumber, response);
+      this.ipcServer?.completeRegistration(clientId, sequenceNumber, response);
     });
 
     ipcMain.on("autofill.completePasskeyAssertion", (event, data) => {
-      this.logService.warning("autofill.completePasskeyAssertion", data);
+      this.logService.debug("autofill.completePasskeyAssertion", data);
       const { clientId, sequenceNumber, response } = data;
-      this.ipcServer.completeAssertion(clientId, sequenceNumber, response);
+      this.ipcServer?.completeAssertion(clientId, sequenceNumber, response);
     });
 
     ipcMain.on("autofill.completeError", (event, data) => {
-      this.logService.warning("autofill.completeError", data);
+      this.logService.debug("autofill.completeError", data);
       const { clientId, sequenceNumber, error } = data;
-      this.ipcServer.completeError(clientId, sequenceNumber, String(error));
+      this.ipcServer?.completeError(clientId, sequenceNumber, String(error));
     });
   }
 
diff --git a/apps/desktop/src/platform/models/domain/window-state.ts b/apps/desktop/src/platform/models/domain/window-state.ts
index 0efc9a1efab..ab52531bb5d 100644
--- a/apps/desktop/src/platform/models/domain/window-state.ts
+++ b/apps/desktop/src/platform/models/domain/window-state.ts
@@ -14,5 +14,6 @@ export class WindowState {
 
 export class ModalModeState {
   isModalModeActive: boolean;
+  showTrafficButtons?: boolean;
   modalPosition?: { x: number; y: number }; // Modal position is often passed from the native UI
 }
diff --git a/apps/desktop/src/platform/popup-modal-styles.ts b/apps/desktop/src/platform/popup-modal-styles.ts
index 5c5619bd463..6ad00b44171 100644
--- a/apps/desktop/src/platform/popup-modal-styles.ts
+++ b/apps/desktop/src/platform/popup-modal-styles.ts
@@ -3,15 +3,19 @@ import { BrowserWindow } from "electron";
 import { WindowState } from "./models/domain/window-state";
 
 // change as needed, however limited by mainwindow minimum size
-const popupWidth = 680;
-const popupHeight = 500;
+const popupWidth = 600;
+const popupHeight = 600;
 
 type Position = { x: number; y: number };
 
-export function applyPopupModalStyles(window: BrowserWindow, position?: Position) {
+export function applyPopupModalStyles(
+  window: BrowserWindow,
+  showTrafficButtons: boolean = true,
+  position?: Position,
+) {
   window.unmaximize();
   window.setSize(popupWidth, popupHeight);
-  window.setWindowButtonVisibility?.(false);
+  window.setWindowButtonVisibility?.(showTrafficButtons);
   window.setMenuBarVisibility?.(false);
   window.setResizable(false);
   window.setAlwaysOnTop(true);
@@ -40,7 +44,7 @@ function positionWindow(window: BrowserWindow, position?: Position) {
 }
 
 export function applyMainWindowStyles(window: BrowserWindow, existingWindowState: WindowState) {
-  window.setMinimumSize(680, 500);
+  window.setMinimumSize(popupWidth, popupHeight);
 
   // need to guard against null/undefined values
 
diff --git a/apps/desktop/src/platform/preload.ts b/apps/desktop/src/platform/preload.ts
index 5af2fa571ec..a45ac753b3f 100644
--- a/apps/desktop/src/platform/preload.ts
+++ b/apps/desktop/src/platform/preload.ts
@@ -108,8 +108,13 @@ const ephemeralStore = {
 };
 
 const localhostCallbackService = {
-  openSsoPrompt: (codeChallenge: string, state: string, email: string): Promise<void> => {
-    return ipcRenderer.invoke("openSsoPrompt", { codeChallenge, state, email });
+  openSsoPrompt: (
+    codeChallenge: string,
+    state: string,
+    email: string,
+    orgSsoIdentifier?: string,
+  ): Promise<void> => {
+    return ipcRenderer.invoke("openSsoPrompt", { codeChallenge, state, email, orgSsoIdentifier });
   },
 };
 
diff --git a/apps/desktop/src/platform/services/desktop-settings.service.ts b/apps/desktop/src/platform/services/desktop-settings.service.ts
index c11f10646d7..d7c17433471 100644
--- a/apps/desktop/src/platform/services/desktop-settings.service.ts
+++ b/apps/desktop/src/platform/services/desktop-settings.service.ts
@@ -335,9 +335,14 @@ export class DesktopSettingsService {
    * Sets the modal mode of the application. Setting this changes the windows-size and other properties.
    * @param value `true` if the application is in modal mode, `false` if it is not.
    */
-  async setModalMode(value: boolean, modalPosition?: { x: number; y: number }) {
+  async setModalMode(
+    value: boolean,
+    showTrafficButtons?: boolean,
+    modalPosition?: { x: number; y: number },
+  ) {
     await this.modalModeState.update(() => ({
       isModalModeActive: value,
+      showTrafficButtons,
       modalPosition,
     }));
   }
diff --git a/apps/desktop/src/platform/services/sso-localhost-callback.service.ts b/apps/desktop/src/platform/services/sso-localhost-callback.service.ts
index 75a84919b07..fdd9bc29237 100644
--- a/apps/desktop/src/platform/services/sso-localhost-callback.service.ts
+++ b/apps/desktop/src/platform/services/sso-localhost-callback.service.ts
@@ -25,20 +25,25 @@ export class SSOLocalhostCallbackService {
     private messagingService: MessageSender,
     private ssoUrlService: SsoUrlService,
   ) {
-    ipcMain.handle("openSsoPrompt", async (event, { codeChallenge, state, email }) => {
-      // Close any existing server before starting new one
-      if (this.currentServer) {
-        await this.closeCurrentServer();
-      }
+    ipcMain.handle(
+      "openSsoPrompt",
+      async (event, { codeChallenge, state, email, orgSsoIdentifier }) => {
+        // Close any existing server before starting new one
+        if (this.currentServer) {
+          await this.closeCurrentServer();
+        }
 
-      return this.openSsoPrompt(codeChallenge, state, email).then(({ ssoCode, recvState }) => {
-        this.messagingService.send("ssoCallback", {
-          code: ssoCode,
-          state: recvState,
-          redirectUri: this.ssoRedirectUri,
-        });
-      });
-    });
+        return this.openSsoPrompt(codeChallenge, state, email, orgSsoIdentifier).then(
+          ({ ssoCode, recvState }) => {
+            this.messagingService.send("ssoCallback", {
+              code: ssoCode,
+              state: recvState,
+              redirectUri: this.ssoRedirectUri,
+            });
+          },
+        );
+      },
+    );
   }
 
   private async closeCurrentServer(): Promise<void> {
@@ -58,6 +63,7 @@ export class SSOLocalhostCallbackService {
     codeChallenge: string,
     state: string,
     email: string,
+    orgSsoIdentifier?: string,
   ): Promise<{ ssoCode: string; recvState: string }> {
     const env = await firstValueFrom(this.environmentService.environment$);
 
@@ -121,6 +127,7 @@ export class SSOLocalhostCallbackService {
           state,
           codeChallenge,
           email,
+          orgSsoIdentifier,
         );
 
         // Set up error handler before attempting to listen
diff --git a/apps/desktop/src/scss/migration.scss b/apps/desktop/src/scss/migration.scss
new file mode 100644
index 00000000000..e3078158283
--- /dev/null
+++ b/apps/desktop/src/scss/migration.scss
@@ -0,0 +1,15 @@
+/**
+ * Desktop UI Migration
+ *
+ * These are temporary styles during the desktop ui migration.
+ **/
+
+/**
+ * This removes any padding applied by the bit-layout to content.
+ * This should be revisited once the table is migrated, and again once drawers are migrated.
+ **/
+bit-layout {
+  #main-content {
+    padding: 0 0 0 0;
+  }
+}
diff --git a/apps/desktop/src/scss/styles.scss b/apps/desktop/src/scss/styles.scss
index c579e6acdc0..b4082afd38c 100644
--- a/apps/desktop/src/scss/styles.scss
+++ b/apps/desktop/src/scss/styles.scss
@@ -15,5 +15,6 @@
 @import "left-nav.scss";
 @import "loading.scss";
 @import "plugins.scss";
+@import "migration.scss";
 @import "../../../../libs/angular/src/scss/icons.scss";
 @import "../../../../libs/components/src/multi-select/scss/bw.theme";
diff --git a/apps/desktop/src/vault/app/vault-v3/vault.component.ts b/apps/desktop/src/vault/app/vault-v3/vault.component.ts
index 8f1214c2338..d92c3080b07 100644
--- a/apps/desktop/src/vault/app/vault-v3/vault.component.ts
+++ b/apps/desktop/src/vault/app/vault-v3/vault.component.ts
@@ -273,10 +273,6 @@ export class VaultComponent implements OnInit, OnDestroy, CopyClickListener {
                 break;
               case "syncCompleted":
                 if (this.vaultItemsComponent) {
-                  // const filterFn = this.wrapFilterForCipherListView(
-                  //   this.activeFilter.buildFilter(),
-                  // );
-                  // await this.vaultItemsComponent.reload(filterFn).catch(() => {});
                   const filter = this.activeFilter.buildFilter();
                   await this.vaultItemsComponent.reload(filter).catch(() => {});
                 }
diff --git a/apps/desktop/src/vault/app/vault/item-footer.component.ts b/apps/desktop/src/vault/app/vault/item-footer.component.ts
index 0034bd9a43c..0ac12c928f2 100644
--- a/apps/desktop/src/vault/app/vault/item-footer.component.ts
+++ b/apps/desktop/src/vault/app/vault/item-footer.component.ts
@@ -225,7 +225,7 @@ export class ItemFooterComponent implements OnInit, OnChanges {
         switchMap((id) =>
           combineLatest([
             this.cipherArchiveService.userCanArchive$(id),
-            this.cipherArchiveService.hasArchiveFlagEnabled$(),
+            this.cipherArchiveService.hasArchiveFlagEnabled$,
           ]),
         ),
       ),
diff --git a/apps/web/package.json b/apps/web/package.json
index a5399de920e..344a78f2a2c 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bitwarden/web-vault",
-  "version": "2025.12.1",
+  "version": "2025.12.0",
   "scripts": {
     "build:oss": "webpack",
     "build:bit": "webpack -c ../../bitwarden_license/bit-web/webpack.config.js",
diff --git a/apps/web/src/app/admin-console/common/people-table-data-source.spec.ts b/apps/web/src/app/admin-console/common/people-table-data-source.spec.ts
new file mode 100644
index 00000000000..e9cf87a114d
--- /dev/null
+++ b/apps/web/src/app/admin-console/common/people-table-data-source.spec.ts
@@ -0,0 +1,130 @@
+import { TestBed } from "@angular/core/testing";
+import { ReplaySubject } from "rxjs";
+
+import { OrganizationUserStatusType } from "@bitwarden/common/admin-console/enums";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import {
+  Environment,
+  EnvironmentService,
+} from "@bitwarden/common/platform/abstractions/environment.service";
+
+import { PeopleTableDataSource } from "./people-table-data-source";
+
+interface MockUser {
+  id: string;
+  name: string;
+  email: string;
+  status: OrganizationUserStatusType;
+  checked?: boolean;
+}
+
+class TestPeopleTableDataSource extends PeopleTableDataSource<any> {
+  protected statusType = OrganizationUserStatusType;
+}
+
+describe("PeopleTableDataSource", () => {
+  let dataSource: TestPeopleTableDataSource;
+
+  const createMockUser = (id: string, checked: boolean = false): MockUser => ({
+    id,
+    name: `User ${id}`,
+    email: `user${id}@example.com`,
+    status: OrganizationUserStatusType.Confirmed,
+    checked,
+  });
+
+  const createMockUsers = (count: number, checked: boolean = false): MockUser[] => {
+    return Array.from({ length: count }, (_, i) => createMockUser(`${i + 1}`, checked));
+  };
+
+  beforeEach(() => {
+    const featureFlagSubject = new ReplaySubject<boolean>(1);
+    featureFlagSubject.next(false);
+
+    const environmentSubject = new ReplaySubject<Environment>(1);
+    environmentSubject.next({
+      isCloud: () => false,
+    } as Environment);
+
+    const mockConfigService = {
+      getFeatureFlag$: jest.fn(() => featureFlagSubject.asObservable()),
+    } as any;
+
+    const mockEnvironmentService = {
+      environment$: environmentSubject.asObservable(),
+    } as any;
+
+    TestBed.configureTestingModule({
+      providers: [
+        { provide: ConfigService, useValue: mockConfigService },
+        { provide: EnvironmentService, useValue: mockEnvironmentService },
+      ],
+    });
+
+    dataSource = TestBed.runInInjectionContext(
+      () => new TestPeopleTableDataSource(mockConfigService, mockEnvironmentService),
+    );
+  });
+
+  describe("limitAndUncheckExcess", () => {
+    it("should return all users when under limit", () => {
+      const users = createMockUsers(10, true);
+      dataSource.data = users;
+
+      const result = dataSource.limitAndUncheckExcess(users, 500);
+
+      expect(result).toHaveLength(10);
+      expect(result).toEqual(users);
+      expect(users.every((u) => u.checked)).toBe(true);
+    });
+
+    it("should limit users and uncheck excess", () => {
+      const users = createMockUsers(600, true);
+      dataSource.data = users;
+
+      const result = dataSource.limitAndUncheckExcess(users, 500);
+
+      expect(result).toHaveLength(500);
+      expect(result).toEqual(users.slice(0, 500));
+      expect(users.slice(0, 500).every((u) => u.checked)).toBe(true);
+      expect(users.slice(500).every((u) => u.checked)).toBe(false);
+    });
+
+    it("should only affect users in the provided array", () => {
+      const allUsers = createMockUsers(1000, true);
+      dataSource.data = allUsers;
+
+      // Pass only a subset (simulates filtering by status)
+      const subset = allUsers.slice(0, 600);
+
+      const result = dataSource.limitAndUncheckExcess(subset, 500);
+
+      expect(result).toHaveLength(500);
+      expect(subset.slice(0, 500).every((u) => u.checked)).toBe(true);
+      expect(subset.slice(500).every((u) => u.checked)).toBe(false);
+      // Users outside subset remain checked
+      expect(allUsers.slice(600).every((u) => u.checked)).toBe(true);
+    });
+  });
+
+  describe("status counts", () => {
+    it("should correctly count users by status", () => {
+      const users: MockUser[] = [
+        { ...createMockUser("1"), status: OrganizationUserStatusType.Invited },
+        { ...createMockUser("2"), status: OrganizationUserStatusType.Invited },
+        { ...createMockUser("3"), status: OrganizationUserStatusType.Accepted },
+        { ...createMockUser("4"), status: OrganizationUserStatusType.Confirmed },
+        { ...createMockUser("5"), status: OrganizationUserStatusType.Confirmed },
+        { ...createMockUser("6"), status: OrganizationUserStatusType.Confirmed },
+        { ...createMockUser("7"), status: OrganizationUserStatusType.Revoked },
+      ];
+      dataSource.data = users;
+
+      expect(dataSource.invitedUserCount).toBe(2);
+      expect(dataSource.acceptedUserCount).toBe(1);
+      expect(dataSource.confirmedUserCount).toBe(3);
+      expect(dataSource.revokedUserCount).toBe(1);
+      expect(dataSource.activeUserCount).toBe(6); // All except revoked
+    });
+  });
+});
diff --git a/apps/web/src/app/admin-console/common/people-table-data-source.ts b/apps/web/src/app/admin-console/common/people-table-data-source.ts
index 4696f8a6738..9ac370d8c0d 100644
--- a/apps/web/src/app/admin-console/common/people-table-data-source.ts
+++ b/apps/web/src/app/admin-console/common/people-table-data-source.ts
@@ -1,14 +1,30 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { computed, Signal } from "@angular/core";
+import { toSignal } from "@angular/core/rxjs-interop";
+import { map } from "rxjs";
+
 import {
   OrganizationUserStatusType,
   ProviderUserStatusType,
 } from "@bitwarden/common/admin-console/enums";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { TableDataSource } from "@bitwarden/components";
 
 import { StatusType, UserViewTypes } from "./base-members.component";
 
-const MaxCheckedCount = 500;
+/**
+ * Default maximum for most bulk operations (confirm, remove, delete, etc.)
+ */
+export const MaxCheckedCount = 500;
+
+/**
+ * Maximum for bulk reinvite operations when the IncreaseBulkReinviteLimitForCloud
+ * feature flag is enabled on cloud environments.
+ */
+export const CloudBulkReinviteLimit = 8000;
 
 /**
  * Returns true if the user matches the status, or where the status is `null`, if the user is active (not revoked).
@@ -56,6 +72,20 @@ export abstract class PeopleTableDataSource<T extends UserViewTypes> extends Tab
   confirmedUserCount: number;
   revokedUserCount: number;
 
+  /** True when increased bulk limit feature is enabled (feature flag + cloud environment) */
+  readonly isIncreasedBulkLimitEnabled: Signal<boolean>;
+
+  constructor(configService: ConfigService, environmentService: EnvironmentService) {
+    super();
+
+    const featureFlagEnabled = toSignal(
+      configService.getFeatureFlag$(FeatureFlag.IncreaseBulkReinviteLimitForCloud),
+    );
+    const isCloud = toSignal(environmentService.environment$.pipe(map((env) => env.isCloud())));
+
+    this.isIncreasedBulkLimitEnabled = computed(() => featureFlagEnabled() && isCloud());
+  }
+
   override set data(data: T[]) {
     super.data = data;
 
@@ -89,6 +119,14 @@ export abstract class PeopleTableDataSource<T extends UserViewTypes> extends Tab
     return this.data.filter((u) => (u as any).checked);
   }
 
+  /**
+   * Gets checked users in the order they appear in the filtered/sorted table view.
+   * Use this when enforcing limits to ensure visual consistency (top N visible rows stay checked).
+   */
+  getCheckedUsersInVisibleOrder() {
+    return this.filteredData.filter((u) => (u as any).checked);
+  }
+
   /**
    * Check all filtered users (i.e. those rows that are currently visible)
    * @param select check the filtered users (true) or uncheck the filtered users (false)
@@ -101,8 +139,13 @@ export abstract class PeopleTableDataSource<T extends UserViewTypes> extends Tab
 
     const filteredUsers = this.filteredData;
 
-    const selectCount =
-      filteredUsers.length > MaxCheckedCount ? MaxCheckedCount : filteredUsers.length;
+    // When the increased bulk limit feature is enabled, allow checking all users.
+    // Individual bulk operations will enforce their specific limits.
+    // When disabled, enforce the legacy limit at check time.
+    const selectCount = this.isIncreasedBulkLimitEnabled()
+      ? filteredUsers.length
+      : Math.min(filteredUsers.length, MaxCheckedCount);
+
     for (let i = 0; i < selectCount; i++) {
       this.checkUser(filteredUsers[i], select);
     }
@@ -132,4 +175,41 @@ export abstract class PeopleTableDataSource<T extends UserViewTypes> extends Tab
       this.data = updatedData;
     }
   }
+
+  /**
+   * Limits an array of users and unchecks those beyond the limit.
+   * Returns the limited array.
+   *
+   * @param users The array of users to limit
+   * @param limit The maximum number of users to keep
+   * @returns The users array limited to the specified count
+   */
+  limitAndUncheckExcess(users: T[], limit: number): T[] {
+    if (users.length <= limit) {
+      return users;
+    }
+
+    // Uncheck users beyond the limit
+    users.slice(limit).forEach((user) => this.checkUser(user, false));
+
+    return users.slice(0, limit);
+  }
+
+  /**
+   * Gets checked users with optional limiting based on the IncreaseBulkReinviteLimitForCloud feature flag.
+   *
+   * When the feature flag is enabled: Returns checked users in visible order, limited to the specified count.
+   * When the feature flag is disabled: Returns all checked users without applying any limit.
+   *
+   * @param limit The maximum number of users to return (only applied when feature flag is enabled)
+   * @returns The checked users array
+   */
+  getCheckedUsersWithLimit(limit: number): T[] {
+    if (this.isIncreasedBulkLimitEnabled()) {
+      const allUsers = this.getCheckedUsersInVisibleOrder();
+      return this.limitAndUncheckExcess(allUsers, limit);
+    } else {
+      return this.getCheckedUsers();
+    }
+  }
 }
diff --git a/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts b/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts
index 6db8fa5e4d6..67d19b3bcee 100644
--- a/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts
+++ b/apps/web/src/app/admin-console/organizations/collections/vault-filter/vault-filter.component.ts
@@ -11,6 +11,7 @@ import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.servic
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { CipherArchiveService } from "@bitwarden/common/vault/abstractions/cipher-archive.service";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { PremiumUpgradePromptService } from "@bitwarden/common/vault/abstractions/premium-upgrade-prompt.service";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
 import { DialogService, ToastService } from "@bitwarden/components";
@@ -59,6 +60,7 @@ export class VaultFilterComponent
     protected restrictedItemTypesService: RestrictedItemTypesService,
     protected cipherService: CipherService,
     protected cipherArchiveService: CipherArchiveService,
+    premiumUpgradePromptService: PremiumUpgradePromptService,
   ) {
     super(
       vaultFilterService,
@@ -72,6 +74,7 @@ export class VaultFilterComponent
       restrictedItemTypesService,
       cipherService,
       cipherArchiveService,
+      premiumUpgradePromptService,
     );
   }
 
diff --git a/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.html b/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.html
index e84f78458d6..59bc03babd4 100644
--- a/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.html
+++ b/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.html
@@ -2,12 +2,15 @@
   <app-side-nav variant="secondary" *ngIf="organization$ | async as organization">
     <bit-nav-logo [openIcon]="logo" route="." [label]="'adminConsole' | i18n"></bit-nav-logo>
     <org-switcher [filter]="orgFilter" [hideNewButton]="hideNewOrgButton$ | async"></org-switcher>
-    <bit-nav-item
-      icon="bwi-dashboard"
-      *ngIf="organization.canAccessReports"
-      [text]="'accessIntelligence' | i18n"
-      route="access-intelligence"
-    ></bit-nav-item>
+
+    @if (canShowAccessIntelligenceTab(organization)) {
+      <bit-nav-item
+        icon="bwi-dashboard"
+        [text]="'accessIntelligence' | i18n"
+        route="access-intelligence"
+      ></bit-nav-item>
+    }
+
     <bit-nav-item
       icon="bwi-collection-shared"
       [text]="'collections' | i18n"
diff --git a/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.ts b/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.ts
index ee09143ed2f..b00e4d9840d 100644
--- a/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.ts
+++ b/apps/web/src/app/admin-console/organizations/layouts/organization-layout.component.ts
@@ -8,6 +8,7 @@ import { combineLatest, filter, map, Observable, switchMap, withLatestFrom } fro
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { AdminConsoleLogo } from "@bitwarden/assets/svg";
 import {
+  canAccessAccessIntelligence,
   canAccessBillingTab,
   canAccessGroupsTab,
   canAccessMembersTab,
@@ -172,6 +173,10 @@ export class OrganizationLayoutComponent implements OnInit {
     return canAccessBillingTab(organization);
   }
 
+  canShowAccessIntelligenceTab(organization: Organization): boolean {
+    return canAccessAccessIntelligence(organization);
+  }
+
   getReportTabLabel(organization: Organization): string {
     return organization.useEvents ? "reporting" : "reports";
   }
diff --git a/apps/web/src/app/admin-console/organizations/members/members.component.ts b/apps/web/src/app/admin-console/organizations/members/members.component.ts
index 59c4c4898ea..51a2a6dafc0 100644
--- a/apps/web/src/app/admin-console/organizations/members/members.component.ts
+++ b/apps/web/src/app/admin-console/organizations/members/members.component.ts
@@ -33,6 +33,8 @@ import { AccountService } from "@bitwarden/common/auth/abstractions/account.serv
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { OrganizationMetadataServiceAbstraction } from "@bitwarden/common/billing/abstractions/organization-metadata.service.abstraction";
 import { OrganizationBillingMetadataResponse } from "@bitwarden/common/billing/models/response/organization-billing-metadata.response";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
@@ -44,7 +46,11 @@ import { BillingConstraintService } from "@bitwarden/web-vault/app/billing/membe
 import { OrganizationWarningsService } from "@bitwarden/web-vault/app/billing/organizations/warnings/services";
 
 import { BaseMembersComponent } from "../../common/base-members.component";
-import { PeopleTableDataSource } from "../../common/people-table-data-source";
+import {
+  CloudBulkReinviteLimit,
+  MaxCheckedCount,
+  PeopleTableDataSource,
+} from "../../common/people-table-data-source";
 import { OrganizationUserView } from "../core/views/organization-user.view";
 
 import { AccountRecoveryDialogResultType } from "./components/account-recovery/account-recovery-dialog.component";
@@ -70,7 +76,7 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
   userType = OrganizationUserType;
   userStatusType = OrganizationUserStatusType;
   memberTab = MemberDialogTab;
-  protected dataSource = new MembersTableDataSource();
+  protected dataSource: MembersTableDataSource;
 
   readonly organization: Signal<Organization | undefined>;
   status: OrganizationUserStatusType | undefined;
@@ -113,6 +119,8 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
     private policyService: PolicyService,
     private policyApiService: PolicyApiServiceAbstraction,
     private organizationMetadataService: OrganizationMetadataServiceAbstraction,
+    private configService: ConfigService,
+    private environmentService: EnvironmentService,
   ) {
     super(
       apiService,
@@ -126,6 +134,8 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       toastService,
     );
 
+    this.dataSource = new MembersTableDataSource(this.configService, this.environmentService);
+
     const organization$ = this.route.params.pipe(
       concatMap((params) =>
         this.userId$.pipe(
@@ -356,10 +366,9 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       return;
     }
 
-    await this.memberDialogManager.openBulkRemoveDialog(
-      organization,
-      this.dataSource.getCheckedUsers(),
-    );
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
+    await this.memberDialogManager.openBulkRemoveDialog(organization, users);
     this.organizationMetadataService.refreshMetadataCache();
     await this.load(organization);
   }
@@ -369,10 +378,9 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       return;
     }
 
-    await this.memberDialogManager.openBulkDeleteDialog(
-      organization,
-      this.dataSource.getCheckedUsers(),
-    );
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
+    await this.memberDialogManager.openBulkDeleteDialog(organization, users);
     await this.load(organization);
   }
 
@@ -389,11 +397,9 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       return;
     }
 
-    await this.memberDialogManager.openBulkRestoreRevokeDialog(
-      organization,
-      this.dataSource.getCheckedUsers(),
-      isRevoking,
-    );
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
+    await this.memberDialogManager.openBulkRestoreRevokeDialog(organization, users, isRevoking);
     await this.load(organization);
   }
 
@@ -402,8 +408,28 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       return;
     }
 
-    const users = this.dataSource.getCheckedUsers();
-    const filteredUsers = users.filter((u) => u.status === OrganizationUserStatusType.Invited);
+    let users: OrganizationUserView[];
+    if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+      users = this.dataSource.getCheckedUsersInVisibleOrder();
+    } else {
+      users = this.dataSource.getCheckedUsers();
+    }
+
+    const allInvitedUsers = users.filter((u) => u.status === OrganizationUserStatusType.Invited);
+
+    // Capture the original count BEFORE enforcing the limit
+    const originalInvitedCount = allInvitedUsers.length;
+
+    // When feature flag is enabled, limit invited users and uncheck the excess
+    let filteredUsers: OrganizationUserView[];
+    if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+      filteredUsers = this.dataSource.limitAndUncheckExcess(
+        allInvitedUsers,
+        CloudBulkReinviteLimit,
+      );
+    } else {
+      filteredUsers = allInvitedUsers;
+    }
 
     if (filteredUsers.length <= 0) {
       this.toastService.showToast({
@@ -417,20 +443,44 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
     try {
       const result = await this.memberActionsService.bulkReinvite(
         organization,
-        filteredUsers.map((user) => user.id),
+        filteredUsers.map((user) => user.id as UserId),
       );
 
       if (!result.successful) {
         throw new Error();
       }
 
-      // Bulk Status component open
-      await this.memberDialogManager.openBulkStatusDialog(
-        users,
-        filteredUsers,
-        Promise.resolve(result.successful),
-        this.i18nService.t("bulkReinviteMessage"),
-      );
+      // When feature flag is enabled, show toast instead of dialog
+      if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+        const selectedCount = originalInvitedCount;
+        const invitedCount = filteredUsers.length;
+
+        if (selectedCount > CloudBulkReinviteLimit) {
+          const excludedCount = selectedCount - CloudBulkReinviteLimit;
+          this.toastService.showToast({
+            variant: "success",
+            message: this.i18nService.t(
+              "bulkReinviteLimitedSuccessToast",
+              CloudBulkReinviteLimit.toLocaleString(),
+              selectedCount.toLocaleString(),
+              excludedCount.toLocaleString(),
+            ),
+          });
+        } else {
+          this.toastService.showToast({
+            variant: "success",
+            message: this.i18nService.t("bulkReinviteSuccessToast", invitedCount.toString()),
+          });
+        }
+      } else {
+        // Feature flag disabled - show legacy dialog
+        await this.memberDialogManager.openBulkStatusDialog(
+          users,
+          filteredUsers,
+          Promise.resolve(result.successful),
+          this.i18nService.t("bulkReinviteMessage"),
+        );
+      }
     } catch (e) {
       this.validationService.showError(e);
     }
@@ -442,15 +492,14 @@ export class MembersComponent extends BaseMembersComponent<OrganizationUserView>
       return;
     }
 
-    await this.memberDialogManager.openBulkConfirmDialog(
-      organization,
-      this.dataSource.getCheckedUsers(),
-    );
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
+    await this.memberDialogManager.openBulkConfirmDialog(organization, users);
     await this.load(organization);
   }
 
   async bulkEnableSM(organization: Organization) {
-    const users = this.dataSource.getCheckedUsers();
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
 
     await this.memberDialogManager.openBulkEnableSecretsManagerDialog(organization, users);
 
diff --git a/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.spec.ts b/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.spec.ts
index e856ab7afd1..80a330b0db1 100644
--- a/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.spec.ts
+++ b/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.spec.ts
@@ -4,6 +4,7 @@ import { of } from "rxjs";
 import {
   OrganizationUserApiService,
   OrganizationUserBulkResponse,
+  OrganizationUserService,
 } from "@bitwarden/admin-console/common";
 import {
   OrganizationUserType,
@@ -22,9 +23,8 @@ import { newGuid } from "@bitwarden/guid";
 import { KeyService } from "@bitwarden/key-management";
 
 import { OrganizationUserView } from "../../../core/views/organization-user.view";
-import { OrganizationUserService } from "../organization-user/organization-user.service";
 
-import { MemberActionsService } from "./member-actions.service";
+import { REQUESTS_PER_BATCH, MemberActionsService } from "./member-actions.service";
 
 describe("MemberActionsService", () => {
   let service: MemberActionsService;
@@ -308,41 +308,308 @@ describe("MemberActionsService", () => {
   });
 
   describe("bulkReinvite", () => {
-    const userIds = [newGuid(), newGuid(), newGuid()];
+    const userIds = [newGuid() as UserId, newGuid() as UserId, newGuid() as UserId];
 
-    it("should successfully reinvite multiple users", async () => {
-      const mockResponse = {
-        data: userIds.map((id) => ({
-          id,
-          error: null,
-        })),
-        continuationToken: null,
-      } as ListResponse<OrganizationUserBulkResponse>;
-      organizationUserApiService.postManyOrganizationUserReinvite.mockResolvedValue(mockResponse);
-
-      const result = await service.bulkReinvite(mockOrganization, userIds);
-
-      expect(result).toEqual({
-        successful: mockResponse,
-        failed: [],
+    describe("when feature flag is false", () => {
+      beforeEach(() => {
+        configService.getFeatureFlag$.mockReturnValue(of(false));
+      });
+
+      it("should successfully reinvite multiple users", async () => {
+        const mockResponse = new ListResponse(
+          {
+            data: userIds.map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        organizationUserApiService.postManyOrganizationUserReinvite.mockResolvedValue(mockResponse);
+
+        const result = await service.bulkReinvite(mockOrganization, userIds);
+
+        expect(result.failed).toEqual([]);
+        expect(result.successful).toBeDefined();
+        expect(result.successful).toEqual(mockResponse);
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledWith(
+          organizationId,
+          userIds,
+        );
+      });
+
+      it("should handle bulk reinvite errors", async () => {
+        const errorMessage = "Bulk reinvite failed";
+        organizationUserApiService.postManyOrganizationUserReinvite.mockRejectedValue(
+          new Error(errorMessage),
+        );
+
+        const result = await service.bulkReinvite(mockOrganization, userIds);
+
+        expect(result.successful).toBeUndefined();
+        expect(result.failed).toHaveLength(3);
+        expect(result.failed[0]).toEqual({ id: userIds[0], error: errorMessage });
       });
-      expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledWith(
-        organizationId,
-        userIds,
-      );
     });
 
-    it("should handle bulk reinvite errors", async () => {
-      const errorMessage = "Bulk reinvite failed";
-      organizationUserApiService.postManyOrganizationUserReinvite.mockRejectedValue(
-        new Error(errorMessage),
-      );
+    describe("when feature flag is true (batching behavior)", () => {
+      beforeEach(() => {
+        configService.getFeatureFlag$.mockReturnValue(of(true));
+      });
+      it("should process users in a single batch when count equals REQUESTS_PER_BATCH", async () => {
+        const userIdsBatch = Array.from({ length: REQUESTS_PER_BATCH }, () => newGuid() as UserId);
+        const mockResponse = new ListResponse(
+          {
+            data: userIdsBatch.map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
 
-      const result = await service.bulkReinvite(mockOrganization, userIds);
+        organizationUserApiService.postManyOrganizationUserReinvite.mockResolvedValue(mockResponse);
 
-      expect(result.successful).toBeUndefined();
-      expect(result.failed).toHaveLength(3);
-      expect(result.failed[0]).toEqual({ id: userIds[0], error: errorMessage });
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(result.successful).toBeDefined();
+        expect(result.successful?.response).toHaveLength(REQUESTS_PER_BATCH);
+        expect(result.failed).toHaveLength(0);
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledTimes(
+          1,
+        );
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledWith(
+          organizationId,
+          userIdsBatch,
+        );
+      });
+
+      it("should process users in multiple batches when count exceeds REQUESTS_PER_BATCH", async () => {
+        const totalUsers = REQUESTS_PER_BATCH + 100;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+
+        const mockResponse1 = new ListResponse(
+          {
+            data: userIdsBatch.slice(0, REQUESTS_PER_BATCH).map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        const mockResponse2 = new ListResponse(
+          {
+            data: userIdsBatch.slice(REQUESTS_PER_BATCH).map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        organizationUserApiService.postManyOrganizationUserReinvite
+          .mockResolvedValueOnce(mockResponse1)
+          .mockResolvedValueOnce(mockResponse2);
+
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(result.successful).toBeDefined();
+        expect(result.successful?.response).toHaveLength(totalUsers);
+        expect(result.failed).toHaveLength(0);
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledTimes(
+          2,
+        );
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenNthCalledWith(
+          1,
+          organizationId,
+          userIdsBatch.slice(0, REQUESTS_PER_BATCH),
+        );
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenNthCalledWith(
+          2,
+          organizationId,
+          userIdsBatch.slice(REQUESTS_PER_BATCH),
+        );
+      });
+
+      it("should aggregate results across multiple successful batches", async () => {
+        const totalUsers = REQUESTS_PER_BATCH + 50;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+
+        const mockResponse1 = new ListResponse(
+          {
+            data: userIdsBatch.slice(0, REQUESTS_PER_BATCH).map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        const mockResponse2 = new ListResponse(
+          {
+            data: userIdsBatch.slice(REQUESTS_PER_BATCH).map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        organizationUserApiService.postManyOrganizationUserReinvite
+          .mockResolvedValueOnce(mockResponse1)
+          .mockResolvedValueOnce(mockResponse2);
+
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(result.successful).toBeDefined();
+        expect(result.successful?.response).toHaveLength(totalUsers);
+        expect(result.successful?.response.slice(0, REQUESTS_PER_BATCH)).toEqual(
+          mockResponse1.data,
+        );
+        expect(result.successful?.response.slice(REQUESTS_PER_BATCH)).toEqual(mockResponse2.data);
+        expect(result.failed).toHaveLength(0);
+      });
+
+      it("should handle mixed individual errors across multiple batches", async () => {
+        const totalUsers = REQUESTS_PER_BATCH + 4;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+
+        const mockResponse1 = new ListResponse(
+          {
+            data: userIdsBatch.slice(0, REQUESTS_PER_BATCH).map((id, index) => ({
+              id,
+              error: index % 10 === 0 ? "Rate limit exceeded" : null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        const mockResponse2 = new ListResponse(
+          {
+            data: [
+              { id: userIdsBatch[REQUESTS_PER_BATCH], error: null },
+              { id: userIdsBatch[REQUESTS_PER_BATCH + 1], error: "Invalid email" },
+              { id: userIdsBatch[REQUESTS_PER_BATCH + 2], error: null },
+              { id: userIdsBatch[REQUESTS_PER_BATCH + 3], error: "User suspended" },
+            ],
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        organizationUserApiService.postManyOrganizationUserReinvite
+          .mockResolvedValueOnce(mockResponse1)
+          .mockResolvedValueOnce(mockResponse2);
+
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        // Count expected failures: every 10th index (0, 10, 20, ..., 490) in first batch + 2 explicit in second batch
+        // Indices 0 to REQUESTS_PER_BATCH-1 where index % 10 === 0: that's floor((BATCH_SIZE-1)/10) + 1 values
+        const expectedFailuresInBatch1 = Math.floor((REQUESTS_PER_BATCH - 1) / 10) + 1;
+        const expectedFailuresInBatch2 = 2;
+        const expectedTotalFailures = expectedFailuresInBatch1 + expectedFailuresInBatch2;
+        const expectedSuccesses = totalUsers - expectedTotalFailures;
+
+        expect(result.successful).toBeDefined();
+        expect(result.successful?.response).toHaveLength(expectedSuccesses);
+        expect(result.failed).toHaveLength(expectedTotalFailures);
+        expect(result.failed.some((f) => f.error === "Rate limit exceeded")).toBe(true);
+        expect(result.failed.some((f) => f.error === "Invalid email")).toBe(true);
+        expect(result.failed.some((f) => f.error === "User suspended")).toBe(true);
+      });
+
+      it("should aggregate all failures when all batches fail", async () => {
+        const totalUsers = REQUESTS_PER_BATCH + 100;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+        const errorMessage = "All batches failed";
+
+        organizationUserApiService.postManyOrganizationUserReinvite.mockRejectedValue(
+          new Error(errorMessage),
+        );
+
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(result.successful).toBeUndefined();
+        expect(result.failed).toHaveLength(totalUsers);
+        expect(result.failed.every((f) => f.error === errorMessage)).toBe(true);
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledTimes(
+          2,
+        );
+      });
+
+      it("should handle empty data in batch response", async () => {
+        const totalUsers = REQUESTS_PER_BATCH + 50;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+
+        const mockResponse1 = new ListResponse(
+          {
+            data: userIdsBatch.slice(0, REQUESTS_PER_BATCH).map((id) => ({
+              id,
+              error: null,
+            })),
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        const mockResponse2 = new ListResponse(
+          {
+            data: [],
+            continuationToken: null,
+          },
+          OrganizationUserBulkResponse,
+        );
+
+        organizationUserApiService.postManyOrganizationUserReinvite
+          .mockResolvedValueOnce(mockResponse1)
+          .mockResolvedValueOnce(mockResponse2);
+
+        const result = await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(result.successful).toBeDefined();
+        expect(result.successful?.response).toHaveLength(REQUESTS_PER_BATCH);
+        expect(result.failed).toHaveLength(0);
+      });
+
+      it("should process batches sequentially in order", async () => {
+        const totalUsers = REQUESTS_PER_BATCH * 2;
+        const userIdsBatch = Array.from({ length: totalUsers }, () => newGuid() as UserId);
+        const callOrder: number[] = [];
+
+        organizationUserApiService.postManyOrganizationUserReinvite.mockImplementation(
+          async (orgId, ids) => {
+            const batchIndex = ids.includes(userIdsBatch[0]) ? 1 : 2;
+            callOrder.push(batchIndex);
+
+            return new ListResponse(
+              {
+                data: ids.map((id) => ({
+                  id,
+                  error: null,
+                })),
+                continuationToken: null,
+              },
+              OrganizationUserBulkResponse,
+            );
+          },
+        );
+
+        await service.bulkReinvite(mockOrganization, userIdsBatch);
+
+        expect(callOrder).toEqual([1, 2]);
+        expect(organizationUserApiService.postManyOrganizationUserReinvite).toHaveBeenCalledTimes(
+          2,
+        );
+      });
     });
   });
 
@@ -427,14 +694,6 @@ describe("MemberActionsService", () => {
       expect(result).toBe(false);
     });
 
-    it("should not allow reset password when organization lacks public and private keys", () => {
-      const org = { ...mockOrganization, hasPublicAndPrivateKeys: false } as Organization;
-
-      const result = service.allowResetPassword(mockOrgUser, org, resetPasswordEnabled);
-
-      expect(result).toBe(false);
-    });
-
     it("should not allow reset password when user is not enrolled in reset password", () => {
       const user = { ...mockOrgUser, resetPasswordEnrolled: false } as OrganizationUserView;
 
@@ -443,12 +702,6 @@ describe("MemberActionsService", () => {
       expect(result).toBe(false);
     });
 
-    it("should not allow reset password when reset password is disabled", () => {
-      const result = service.allowResetPassword(mockOrgUser, mockOrganization, false);
-
-      expect(result).toBe(false);
-    });
-
     it("should not allow reset password when user status is not confirmed", () => {
       const user = {
         ...mockOrgUser,
diff --git a/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.ts b/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.ts
index 5e19e26954e..f3774e3cb25 100644
--- a/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.ts
+++ b/apps/web/src/app/admin-console/organizations/members/services/member-actions/member-actions.service.ts
@@ -20,9 +20,12 @@ import { EncryptService } from "@bitwarden/common/key-management/crypto/abstract
 import { ListResponse } from "@bitwarden/common/models/response/list.response";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { KeyService } from "@bitwarden/key-management";
+import { UserId } from "@bitwarden/user-core";
 
 import { OrganizationUserView } from "../../../core/views/organization-user.view";
 
+export const REQUESTS_PER_BATCH = 500;
+
 export interface MemberActionResult {
   success: boolean;
   error?: string;
@@ -162,20 +165,36 @@ export class MemberActionsService {
     }
   }
 
-  async bulkReinvite(organization: Organization, userIds: string[]): Promise<BulkActionResult> {
-    try {
-      const result = await this.organizationUserApiService.postManyOrganizationUserReinvite(
-        organization.id,
-        userIds,
-      );
-      return { successful: result, failed: [] };
-    } catch (error) {
-      return {
-        failed: userIds.map((id) => ({ id, error: (error as Error).message ?? String(error) })),
-      };
+  async bulkReinvite(organization: Organization, userIds: UserId[]): Promise<BulkActionResult> {
+    const increaseBulkReinviteLimitForCloud = await firstValueFrom(
+      this.configService.getFeatureFlag$(FeatureFlag.IncreaseBulkReinviteLimitForCloud),
+    );
+    if (increaseBulkReinviteLimitForCloud) {
+      return await this.vNextBulkReinvite(organization, userIds);
+    } else {
+      try {
+        const result = await this.organizationUserApiService.postManyOrganizationUserReinvite(
+          organization.id,
+          userIds,
+        );
+        return { successful: result, failed: [] };
+      } catch (error) {
+        return {
+          failed: userIds.map((id) => ({ id, error: (error as Error).message ?? String(error) })),
+        };
+      }
     }
   }
 
+  async vNextBulkReinvite(
+    organization: Organization,
+    userIds: UserId[],
+  ): Promise<BulkActionResult> {
+    return this.processBatchedOperation(userIds, REQUESTS_PER_BATCH, (batch) =>
+      this.organizationUserApiService.postManyOrganizationUserReinvite(organization.id, batch),
+    );
+  }
+
   allowResetPassword(
     orgUser: OrganizationUserView,
     organization: Organization,
@@ -207,4 +226,52 @@ export class MemberActionsService {
       orgUser.status === OrganizationUserStatusType.Confirmed
     );
   }
+
+  /**
+   * Processes user IDs in sequential batches and aggregates results.
+   * @param userIds - Array of user IDs to process
+   * @param batchSize - Number of IDs to process per batch
+   * @param processBatch - Async function that processes a single batch and returns the result
+   * @returns Aggregated bulk action result
+   */
+  private async processBatchedOperation(
+    userIds: UserId[],
+    batchSize: number,
+    processBatch: (batch: string[]) => Promise<ListResponse<OrganizationUserBulkResponse>>,
+  ): Promise<BulkActionResult> {
+    const allSuccessful: OrganizationUserBulkResponse[] = [];
+    const allFailed: { id: string; error: string }[] = [];
+
+    for (let i = 0; i < userIds.length; i += batchSize) {
+      const batch = userIds.slice(i, i + batchSize);
+
+      try {
+        const result = await processBatch(batch);
+
+        if (result?.data) {
+          for (const response of result.data) {
+            if (response.error) {
+              allFailed.push({ id: response.id, error: response.error });
+            } else {
+              allSuccessful.push(response);
+            }
+          }
+        }
+      } catch (error) {
+        allFailed.push(
+          ...batch.map((id) => ({ id, error: (error as Error).message ?? String(error) })),
+        );
+      }
+    }
+
+    const successful =
+      allSuccessful.length > 0
+        ? new ListResponse(allSuccessful, OrganizationUserBulkResponse)
+        : undefined;
+
+    return {
+      successful,
+      failed: allFailed,
+    };
+  }
 }
diff --git a/apps/web/src/app/auth/core/services/login/web-login-component.service.ts b/apps/web/src/app/auth/core/services/login/web-login-component.service.ts
index 5bea0908b0a..8c1bc4bd080 100644
--- a/apps/web/src/app/auth/core/services/login/web-login-component.service.ts
+++ b/apps/web/src/app/auth/core/services/login/web-login-component.service.ts
@@ -61,8 +61,11 @@ export class WebLoginComponentService
     email: string,
     state: string,
     codeChallenge: string,
+    orgSsoIdentifier?: string,
   ): Promise<void> {
-    await this.router.navigate(["/sso"]);
+    await this.router.navigate(["/sso"], {
+      queryParams: { identifier: orgSsoIdentifier },
+    });
     return;
   }
 
diff --git a/apps/web/src/app/auth/recover-two-factor.component.ts b/apps/web/src/app/auth/recover-two-factor.component.ts
index 9c033b88a75..20f40b5319a 100644
--- a/apps/web/src/app/auth/recover-two-factor.component.ts
+++ b/apps/web/src/app/auth/recover-two-factor.component.ts
@@ -108,7 +108,7 @@ export class RecoverTwoFactorComponent implements OnInit {
         message: this.i18nService.t("twoStepRecoverDisabled"),
       });
 
-      await this.loginSuccessHandlerService.run(authResult.userId);
+      await this.loginSuccessHandlerService.run(authResult.userId, this.masterPassword);
 
       await this.router.navigate(["/settings/security/two-factor"]);
     } catch (error: unknown) {
diff --git a/apps/web/src/app/auth/verify-recover-delete.component.html b/apps/web/src/app/auth/verify-recover-delete.component.html
index 02581b21418..27eda24a118 100644
--- a/apps/web/src/app/auth/verify-recover-delete.component.html
+++ b/apps/web/src/app/auth/verify-recover-delete.component.html
@@ -1,5 +1,5 @@
 <form [bitSubmit]="submit" [formGroup]="formGroup">
-  <app-callout type="warning">{{ "deleteAccountWarning" | i18n }}</app-callout>
+  <bit-callout type="warning">{{ "deleteAccountWarning" | i18n }}</bit-callout>
   <p bitTypography="body1" class="tw-text-center">
     <strong>{{ email }}</strong>
   </p>
diff --git a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.html b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.html
index 6b168901b2e..e182659acbb 100644
--- a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.html
+++ b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.html
@@ -21,7 +21,7 @@
       <div>
         @if (premiumCardData$ | async; as premiumData) {
           <billing-pricing-card
-            [tagline]="'planDescPremium' | i18n"
+            [tagline]="'advancedOnlineSecurity' | i18n"
             [price]="{ amount: premiumData.price, cadence: 'monthly' }"
             [button]="{ type: 'primary', text: ('upgradeToPremium' | i18n) }"
             [features]="premiumData.features"
diff --git a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.ts b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.ts
index d78451e4f3a..aac7fd3156f 100644
--- a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.ts
+++ b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium-vnext.component.ts
@@ -157,7 +157,7 @@ export class CloudHostedPremiumVNextComponent {
         return {
           tier,
           price:
-            tier?.passwordManager.type === "standalone"
+            tier?.passwordManager.type === "standalone" && tier.passwordManager.annualPrice
               ? Number((tier.passwordManager.annualPrice / 12).toFixed(2))
               : 0,
           features: tier?.passwordManager.features.map((f) => f.value) || [],
@@ -172,7 +172,7 @@ export class CloudHostedPremiumVNextComponent {
         return {
           tier,
           price:
-            tier?.passwordManager.type === "packaged"
+            tier?.passwordManager.type === "packaged" && tier.passwordManager.annualPrice
               ? Number((tier.passwordManager.annualPrice / 12).toFixed(2))
               : 0,
           features: tier?.passwordManager.features.map((f) => f.value) || [],
diff --git a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.html b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.html
index 63c26bd61f1..33e89f21fc0 100644
--- a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.html
+++ b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.html
@@ -24,7 +24,7 @@
         <ul class="bwi-ul">
           <li>
             <i class="bwi bwi-check tw-text-success bwi-li" aria-hidden="true"></i>
-            {{ "premiumSignUpStorage" | i18n }}
+            {{ "premiumSignUpStorageV2" | i18n: `${(providedStorageGb$ | async)} GB` }}
           </li>
           <li>
             <i class="bwi bwi-check tw-text-success bwi-li" aria-hidden="true"></i>
@@ -82,7 +82,10 @@
             />
             <bit-hint>{{
               "additionalStorageIntervalDesc"
-                | i18n: "1 GB" : (storagePrice$ | async | currency: "$") : ("year" | i18n)
+                | i18n
+                  : `${(providedStorageGb$ | async)} GB`
+                  : (storagePrice$ | async | currency: "$")
+                  : ("year" | i18n)
             }}</bit-hint>
           </bit-form-field>
         </div>
diff --git a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.ts b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.ts
index fceeeedf170..86a508d2701 100644
--- a/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.ts
+++ b/apps/web/src/app/billing/individual/premium/cloud-hosted-premium.component.ts
@@ -22,8 +22,8 @@ import { debounceTime } from "rxjs/operators";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions";
+import { SubscriptionPricingServiceAbstraction } from "@bitwarden/common/billing/abstractions/subscription-pricing.service.abstraction";
 import { PaymentMethodType } from "@bitwarden/common/billing/enums";
-import { DefaultSubscriptionPricingService } from "@bitwarden/common/billing/services/subscription-pricing.service";
 import { PersonalSubscriptionPricingTierIds } from "@bitwarden/common/billing/types/subscription-pricing-tier";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -75,6 +75,7 @@ export class CloudHostedPremiumComponent {
       return {
         seat: premiumPlan.passwordManager.annualPrice,
         storage: premiumPlan.passwordManager.annualPricePerAdditionalStorageGB,
+        providedStorageGb: premiumPlan.passwordManager.providedStorageGB,
       };
     }),
     shareReplay({ bufferSize: 1, refCount: true }),
@@ -84,6 +85,8 @@ export class CloudHostedPremiumComponent {
 
   storagePrice$ = this.premiumPrices$.pipe(map((prices) => prices.storage));
 
+  providedStorageGb$ = this.premiumPrices$.pipe(map((prices) => prices.providedStorageGb));
+
   protected isLoadingPrices$ = this.premiumPrices$.pipe(
     map(() => false),
     startWith(true),
@@ -134,7 +137,7 @@ export class CloudHostedPremiumComponent {
     private accountService: AccountService,
     private subscriberBillingClient: SubscriberBillingClient,
     private taxClient: TaxClient,
-    private subscriptionPricingService: DefaultSubscriptionPricingService,
+    private subscriptionPricingService: SubscriptionPricingServiceAbstraction,
   ) {
     this.hasPremiumFromAnyOrganization$ = this.accountService.activeAccount$.pipe(
       switchMap((account) =>
diff --git a/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.spec.ts b/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.spec.ts
index 7f698ae50d1..b28a7b8c4a2 100644
--- a/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.spec.ts
+++ b/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.spec.ts
@@ -1,4 +1,4 @@
-import { Component, input, output } from "@angular/core";
+import { ChangeDetectionStrategy, Component, input, output } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { NoopAnimationsModule } from "@angular/platform-browser/animations";
 import { Router } from "@angular/router";
@@ -28,12 +28,11 @@ import {
   UnifiedUpgradeDialogStep,
 } from "./unified-upgrade-dialog.component";
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-upgrade-account",
   template: "",
   standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class MockUpgradeAccountComponent {
   readonly dialogTitleMessageOverride = input<string | null>(null);
@@ -42,12 +41,11 @@ class MockUpgradeAccountComponent {
   closeClicked = output<UpgradeAccountStatus>();
 }
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-upgrade-payment",
   template: "",
   standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class MockUpgradePaymentComponent {
   readonly selectedPlanId = input<PersonalSubscriptionPricingTierId | null>(null);
@@ -77,10 +75,56 @@ describe("UnifiedUpgradeDialogComponent", () => {
     planSelectionStepTitleOverride: null,
   };
 
+  /**
+   * Helper function to create and configure a fresh component instance with custom dialog data
+   */
+  async function createComponentWithDialogData(
+    dialogData: UnifiedUpgradeDialogParams,
+    waitForStable = false,
+  ): Promise<{
+    fixture: ComponentFixture<UnifiedUpgradeDialogComponent>;
+    component: UnifiedUpgradeDialogComponent;
+  }> {
+    TestBed.resetTestingModule();
+    jest.clearAllMocks();
+
+    await TestBed.configureTestingModule({
+      imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
+      providers: [
+        { provide: DialogRef, useValue: mockDialogRef },
+        { provide: DIALOG_DATA, useValue: dialogData },
+        { provide: Router, useValue: mockRouter },
+        { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
+      ],
+    })
+      .overrideComponent(UnifiedUpgradeDialogComponent, {
+        remove: {
+          imports: [UpgradeAccountComponent, UpgradePaymentComponent],
+        },
+        add: {
+          imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
+        },
+      })
+      .compileComponents();
+
+    const newFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
+    const newComponent = newFixture.componentInstance;
+    newFixture.detectChanges();
+
+    if (waitForStable) {
+      await newFixture.whenStable();
+    }
+
+    return { fixture: newFixture, component: newComponent };
+  }
+
   beforeEach(async () => {
     // Reset mocks
     jest.clearAllMocks();
 
+    // Default mock: no premium interest
+    mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(false);
+
     await TestBed.configureTestingModule({
       imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
       providers: [
@@ -117,49 +161,63 @@ describe("UnifiedUpgradeDialogComponent", () => {
   });
 
   it("should initialize with custom initial step", async () => {
-    TestBed.resetTestingModule();
-
     const customDialogData: UnifiedUpgradeDialogParams = {
       account: mockAccount,
       initialStep: UnifiedUpgradeDialogStep.Payment,
       selectedPlan: PersonalSubscriptionPricingTierIds.Premium,
     };
 
-    await TestBed.configureTestingModule({
-      imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
-      providers: [
-        { provide: DialogRef, useValue: mockDialogRef },
-        { provide: DIALOG_DATA, useValue: customDialogData },
-        { provide: Router, useValue: mockRouter },
-        { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
-      ],
-    })
-      .overrideComponent(UnifiedUpgradeDialogComponent, {
-        remove: {
-          imports: [UpgradeAccountComponent, UpgradePaymentComponent],
-        },
-        add: {
-          imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
-        },
-      })
-      .compileComponents();
-
-    const customFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
-    const customComponent = customFixture.componentInstance;
-    customFixture.detectChanges();
+    const { component: customComponent } = await createComponentWithDialogData(customDialogData);
 
     expect(customComponent["step"]()).toBe(UnifiedUpgradeDialogStep.Payment);
     expect(customComponent["selectedPlan"]()).toBe(PersonalSubscriptionPricingTierIds.Premium);
   });
 
+  describe("ngOnInit premium interest handling", () => {
+    it("should check premium interest on initialization", async () => {
+      // Component already initialized in beforeEach
+      expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledWith(
+        mockAccount.id,
+      );
+    });
+
+    it("should set hasPremiumInterest signal and clear premium interest when it exists", async () => {
+      mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(true);
+      mockPremiumInterestStateService.clearPremiumInterest.mockResolvedValue(undefined);
+
+      const { component: customComponent } = await createComponentWithDialogData(
+        defaultDialogData,
+        true,
+      );
+
+      expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledWith(
+        mockAccount.id,
+      );
+      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledWith(
+        mockAccount.id,
+      );
+      expect(customComponent["hasPremiumInterest"]()).toBe(true);
+    });
+
+    it("should not set hasPremiumInterest signal or clear when premium interest does not exist", async () => {
+      mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(false);
+
+      const { component: customComponent } = await createComponentWithDialogData(defaultDialogData);
+
+      expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledWith(
+        mockAccount.id,
+      );
+      expect(mockPremiumInterestStateService.clearPremiumInterest).not.toHaveBeenCalled();
+      expect(customComponent["hasPremiumInterest"]()).toBe(false);
+    });
+  });
+
   describe("custom dialog title", () => {
     it("should use null as default when no override is provided", () => {
       expect(component["planSelectionStepTitleOverride"]()).toBeNull();
     });
 
     it("should use custom title when provided in dialog config", async () => {
-      TestBed.resetTestingModule();
-
       const customDialogData: UnifiedUpgradeDialogParams = {
         account: mockAccount,
         initialStep: UnifiedUpgradeDialogStep.PlanSelection,
@@ -167,28 +225,7 @@ describe("UnifiedUpgradeDialogComponent", () => {
         planSelectionStepTitleOverride: "upgradeYourPlan",
       };
 
-      await TestBed.configureTestingModule({
-        imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
-        providers: [
-          { provide: DialogRef, useValue: mockDialogRef },
-          { provide: DIALOG_DATA, useValue: customDialogData },
-          { provide: Router, useValue: mockRouter },
-          { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
-        ],
-      })
-        .overrideComponent(UnifiedUpgradeDialogComponent, {
-          remove: {
-            imports: [UpgradeAccountComponent, UpgradePaymentComponent],
-          },
-          add: {
-            imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
-          },
-        })
-        .compileComponents();
-
-      const customFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
-      const customComponent = customFixture.componentInstance;
-      customFixture.detectChanges();
+      const { component: customComponent } = await createComponentWithDialogData(customDialogData);
 
       expect(customComponent["planSelectionStepTitleOverride"]()).toBe("upgradeYourPlan");
     });
@@ -221,8 +258,6 @@ describe("UnifiedUpgradeDialogComponent", () => {
     });
 
     it("should be set to true when provided in dialog config", async () => {
-      TestBed.resetTestingModule();
-
       const customDialogData: UnifiedUpgradeDialogParams = {
         account: mockAccount,
         initialStep: null,
@@ -230,108 +265,32 @@ describe("UnifiedUpgradeDialogComponent", () => {
         hideContinueWithoutUpgradingButton: true,
       };
 
-      await TestBed.configureTestingModule({
-        imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
-        providers: [
-          { provide: DialogRef, useValue: mockDialogRef },
-          { provide: DIALOG_DATA, useValue: customDialogData },
-          { provide: Router, useValue: mockRouter },
-          { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
-        ],
-      })
-        .overrideComponent(UnifiedUpgradeDialogComponent, {
-          remove: {
-            imports: [UpgradeAccountComponent, UpgradePaymentComponent],
-          },
-          add: {
-            imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
-          },
-        })
-        .compileComponents();
-
-      const customFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
-      const customComponent = customFixture.componentInstance;
-      customFixture.detectChanges();
+      const { component: customComponent } = await createComponentWithDialogData(customDialogData);
 
       expect(customComponent["hideContinueWithoutUpgradingButton"]()).toBe(true);
     });
   });
 
-  describe("onComplete with premium interest", () => {
-    it("should check premium interest, clear it, and route to /vault when premium interest exists", async () => {
+  describe("onComplete", () => {
+    it("should route to /vault when upgrading to premium with premium interest", async () => {
+      // Set up component with premium interest
       mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(true);
-      mockPremiumInterestStateService.clearPremiumInterest.mockResolvedValue();
+      mockPremiumInterestStateService.clearPremiumInterest.mockResolvedValue(undefined);
       mockRouter.navigate.mockResolvedValue(true);
 
-      const result: UpgradePaymentResult = {
-        status: "upgradedToPremium",
-        organizationId: null,
-      };
-
-      await component["onComplete"](result);
+      const { component: customComponent } = await createComponentWithDialogData(
+        defaultDialogData,
+        true,
+      );
 
+      // Premium interest should be set and cleared during ngOnInit
       expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledWith(
         mockAccount.id,
       );
       expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledWith(
         mockAccount.id,
       );
-      expect(mockRouter.navigate).toHaveBeenCalledWith(["/vault"]);
-      expect(mockDialogRef.close).toHaveBeenCalledWith({
-        status: "upgradedToPremium",
-        organizationId: null,
-      });
-    });
-
-    it("should not clear premium interest when upgrading to families", async () => {
-      const result: UpgradePaymentResult = {
-        status: "upgradedToFamilies",
-        organizationId: "org-123",
-      };
-
-      await component["onComplete"](result);
-
-      expect(mockPremiumInterestStateService.getPremiumInterest).not.toHaveBeenCalled();
-      expect(mockPremiumInterestStateService.clearPremiumInterest).not.toHaveBeenCalled();
-      expect(mockDialogRef.close).toHaveBeenCalledWith({
-        status: "upgradedToFamilies",
-        organizationId: "org-123",
-      });
-    });
-
-    it("should use standard redirect when no premium interest exists", async () => {
-      TestBed.resetTestingModule();
-
-      const customDialogData: UnifiedUpgradeDialogParams = {
-        account: mockAccount,
-        redirectOnCompletion: true,
-      };
-
-      mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(false);
-      mockRouter.navigate.mockResolvedValue(true);
-
-      await TestBed.configureTestingModule({
-        imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
-        providers: [
-          { provide: DialogRef, useValue: mockDialogRef },
-          { provide: DIALOG_DATA, useValue: customDialogData },
-          { provide: Router, useValue: mockRouter },
-          { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
-        ],
-      })
-        .overrideComponent(UnifiedUpgradeDialogComponent, {
-          remove: {
-            imports: [UpgradeAccountComponent, UpgradePaymentComponent],
-          },
-          add: {
-            imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
-          },
-        })
-        .compileComponents();
-
-      const customFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
-      const customComponent = customFixture.componentInstance;
-      customFixture.detectChanges();
+      expect(customComponent["hasPremiumInterest"]()).toBe(true);
 
       const result: UpgradePaymentResult = {
         status: "upgradedToPremium",
@@ -340,10 +299,55 @@ describe("UnifiedUpgradeDialogComponent", () => {
 
       await customComponent["onComplete"](result);
 
-      expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledWith(
-        mockAccount.id,
-      );
-      expect(mockPremiumInterestStateService.clearPremiumInterest).not.toHaveBeenCalled();
+      // Should route to /vault because hasPremiumInterest signal is true
+      // No additional service calls should be made in onComplete
+      expect(mockPremiumInterestStateService.getPremiumInterest).toHaveBeenCalledTimes(1); // Only from ngOnInit
+      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledTimes(1); // Only from ngOnInit
+      expect(mockRouter.navigate).toHaveBeenCalledWith(["/vault"]);
+      expect(mockDialogRef.close).toHaveBeenCalledWith({
+        status: "upgradedToPremium",
+        organizationId: null,
+      });
+    });
+
+    it("should close dialog when upgrading to families (premium interest not relevant)", async () => {
+      const result: UpgradePaymentResult = {
+        status: "upgradedToFamilies",
+        organizationId: "org-123",
+      };
+
+      await component["onComplete"](result);
+
+      // Premium interest logic only runs for premium upgrades, not families
+      expect(mockDialogRef.close).toHaveBeenCalledWith({
+        status: "upgradedToFamilies",
+        organizationId: "org-123",
+      });
+    });
+
+    it("should use standard redirect when upgrading to premium without premium interest", async () => {
+      const customDialogData: UnifiedUpgradeDialogParams = {
+        account: mockAccount,
+        redirectOnCompletion: true,
+      };
+
+      // No premium interest
+      mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(false);
+      mockRouter.navigate.mockResolvedValue(true);
+
+      const { component: customComponent } = await createComponentWithDialogData(customDialogData);
+
+      // Verify no premium interest was set during ngOnInit
+      expect(customComponent["hasPremiumInterest"]()).toBe(false);
+
+      const result: UpgradePaymentResult = {
+        status: "upgradedToPremium",
+        organizationId: null,
+      };
+
+      await customComponent["onComplete"](result);
+
+      // Should use standard redirect because hasPremiumInterest signal is false
       expect(mockRouter.navigate).toHaveBeenCalledWith([
         "/settings/subscription/user-subscription",
       ]);
@@ -354,70 +358,44 @@ describe("UnifiedUpgradeDialogComponent", () => {
     });
   });
 
-  describe("onCloseClicked with premium interest", () => {
-    it("should clear premium interest when modal is closed", async () => {
-      mockPremiumInterestStateService.clearPremiumInterest.mockResolvedValue();
-
+  describe("onCloseClicked", () => {
+    it("should close dialog without clearing premium interest (cleared in ngOnInit)", async () => {
       await component["onCloseClicked"]();
 
-      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledWith(
-        mockAccount.id,
-      );
+      // Premium interest should have been cleared only once during ngOnInit, not again here
+      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledTimes(0);
       expect(mockDialogRef.close).toHaveBeenCalledWith({ status: "closed" });
     });
   });
 
-  describe("previousStep with premium interest", () => {
-    it("should NOT clear premium interest when navigating between steps", async () => {
+  describe("previousStep", () => {
+    it("should go back to plan selection when on payment step", async () => {
       component["step"].set(UnifiedUpgradeDialogStep.Payment);
       component["selectedPlan"].set(PersonalSubscriptionPricingTierIds.Premium);
 
       await component["previousStep"]();
 
-      expect(mockPremiumInterestStateService.clearPremiumInterest).not.toHaveBeenCalled();
       expect(component["step"]()).toBe(UnifiedUpgradeDialogStep.PlanSelection);
       expect(component["selectedPlan"]()).toBeNull();
+      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledTimes(0);
     });
 
-    it("should clear premium interest when backing out of dialog completely", async () => {
-      TestBed.resetTestingModule();
-
+    it("should close dialog when backing out from plan selection step (no premium interest cleared)", async () => {
       const customDialogData: UnifiedUpgradeDialogParams = {
         account: mockAccount,
         initialStep: UnifiedUpgradeDialogStep.Payment,
         selectedPlan: PersonalSubscriptionPricingTierIds.Premium,
       };
 
-      mockPremiumInterestStateService.clearPremiumInterest.mockResolvedValue();
+      mockPremiumInterestStateService.getPremiumInterest.mockResolvedValue(false);
 
-      await TestBed.configureTestingModule({
-        imports: [NoopAnimationsModule, UnifiedUpgradeDialogComponent],
-        providers: [
-          { provide: DialogRef, useValue: mockDialogRef },
-          { provide: DIALOG_DATA, useValue: customDialogData },
-          { provide: Router, useValue: mockRouter },
-          { provide: PremiumInterestStateService, useValue: mockPremiumInterestStateService },
-        ],
-      })
-        .overrideComponent(UnifiedUpgradeDialogComponent, {
-          remove: {
-            imports: [UpgradeAccountComponent, UpgradePaymentComponent],
-          },
-          add: {
-            imports: [MockUpgradeAccountComponent, MockUpgradePaymentComponent],
-          },
-        })
-        .compileComponents();
-
-      const customFixture = TestBed.createComponent(UnifiedUpgradeDialogComponent);
-      const customComponent = customFixture.componentInstance;
-      customFixture.detectChanges();
+      const { component: customComponent } = await createComponentWithDialogData(customDialogData);
 
+      // Start at payment step, go back once to reach plan selection, then go back again to close
       await customComponent["previousStep"]();
 
-      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledWith(
-        mockAccount.id,
-      );
+      // Premium interest cleared only in ngOnInit, not in previousStep
+      expect(mockPremiumInterestStateService.clearPremiumInterest).toHaveBeenCalledTimes(0);
       expect(mockDialogRef.close).toHaveBeenCalledWith({ status: "closed" });
     });
   });
diff --git a/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.ts b/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.ts
index 02d48e8d8f4..222bf77715c 100644
--- a/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.ts
+++ b/apps/web/src/app/billing/individual/upgrade/unified-upgrade-dialog/unified-upgrade-dialog.component.ts
@@ -1,6 +1,6 @@
 import { DIALOG_DATA } from "@angular/cdk/dialog";
 import { CommonModule } from "@angular/common";
-import { Component, Inject, OnInit, signal } from "@angular/core";
+import { ChangeDetectionStrategy, Component, Inject, OnInit, signal } from "@angular/core";
 import { Router } from "@angular/router";
 
 import { PremiumInterestStateService } from "@bitwarden/angular/billing/services/premium-interest/premium-interest-state.service.abstraction";
@@ -63,10 +63,9 @@ export type UnifiedUpgradeDialogParams = {
   redirectOnCompletion?: boolean;
 };
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-unified-upgrade-dialog",
+  changeDetection: ChangeDetectionStrategy.OnPush,
   imports: [
     CommonModule,
     DialogModule,
@@ -87,6 +86,7 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
   protected readonly account = signal<Account | null>(null);
   protected readonly planSelectionStepTitleOverride = signal<string | null>(null);
   protected readonly hideContinueWithoutUpgradingButton = signal<boolean>(false);
+  protected readonly hasPremiumInterest = signal(false);
 
   protected readonly PaymentStep = UnifiedUpgradeDialogStep.Payment;
   protected readonly PlanSelectionStep = UnifiedUpgradeDialogStep.PlanSelection;
@@ -98,7 +98,7 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
     private premiumInterestStateService: PremiumInterestStateService,
   ) {}
 
-  ngOnInit(): void {
+  async ngOnInit(): Promise<void> {
     this.account.set(this.params.account);
     this.step.set(this.params.initialStep ?? UnifiedUpgradeDialogStep.PlanSelection);
     this.selectedPlan.set(this.params.selectedPlan ?? null);
@@ -106,6 +106,19 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
     this.hideContinueWithoutUpgradingButton.set(
       this.params.hideContinueWithoutUpgradingButton ?? false,
     );
+
+    /*
+     * Check if the user has premium interest at the point we open the dialog.
+     * If they do, record it on a component-level signal and clear the user's premium interest.
+     * This prevents us from having to clear it at every dialog conclusion point.
+     * */
+    const hasPremiumInterest = await this.premiumInterestStateService.getPremiumInterest(
+      this.params.account.id,
+    );
+    if (hasPremiumInterest) {
+      this.hasPremiumInterest.set(true);
+      await this.premiumInterestStateService.clearPremiumInterest(this.params.account.id);
+    }
   }
 
   protected onPlanSelected(planId: PersonalSubscriptionPricingTierId): void {
@@ -113,8 +126,6 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
     this.nextStep();
   }
   protected async onCloseClicked(): Promise<void> {
-    // Clear premium interest when user closes/abandons modal
-    await this.premiumInterestStateService.clearPremiumInterest(this.params.account.id);
     this.close({ status: UnifiedUpgradeDialogStatus.Closed });
   }
 
@@ -135,8 +146,6 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
       this.step.set(UnifiedUpgradeDialogStep.PlanSelection);
       this.selectedPlan.set(null);
     } else {
-      // Clear premium interest when backing out of dialog completely
-      await this.premiumInterestStateService.clearPremiumInterest(this.params.account.id);
       this.close({ status: UnifiedUpgradeDialogStatus.Closed });
     }
   }
@@ -161,11 +170,7 @@ export class UnifiedUpgradeDialogComponent implements OnInit {
 
     // Check premium interest and route to vault for marketing-initiated premium upgrades
     if (status === UnifiedUpgradeDialogStatus.UpgradedToPremium) {
-      const hasPremiumInterest = await this.premiumInterestStateService.getPremiumInterest(
-        this.params.account.id,
-      );
-      if (hasPremiumInterest) {
-        await this.premiumInterestStateService.clearPremiumInterest(this.params.account.id);
+      if (this.hasPremiumInterest()) {
         await this.router.navigate(["/vault"]);
         return; // Exit early, don't use redirectOnCompletion
       }
diff --git a/apps/web/src/app/billing/individual/upgrade/upgrade-account/upgrade-account.component.ts b/apps/web/src/app/billing/individual/upgrade/upgrade-account/upgrade-account.component.ts
index a4089d7a47a..2ac44ff72db 100644
--- a/apps/web/src/app/billing/individual/upgrade/upgrade-account/upgrade-account.component.ts
+++ b/apps/web/src/app/billing/individual/upgrade/upgrade-account/upgrade-account.component.ts
@@ -1,15 +1,15 @@
 import { CdkTrapFocus } from "@angular/cdk/a11y";
 import { CommonModule } from "@angular/common";
-import { Component, DestroyRef, OnInit, computed, input, output, signal } from "@angular/core";
+import { Component, computed, DestroyRef, input, OnInit, output, signal } from "@angular/core";
 import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
 import { catchError, of } from "rxjs";
 
+import { SubscriptionPricingCardDetails } from "@bitwarden/angular/billing/types/subscription-pricing-card-details";
 import { SubscriptionPricingServiceAbstraction } from "@bitwarden/common/billing/abstractions/subscription-pricing.service.abstraction";
 import {
   PersonalSubscriptionPricingTier,
   PersonalSubscriptionPricingTierId,
   PersonalSubscriptionPricingTierIds,
-  SubscriptionCadence,
   SubscriptionCadenceIds,
 } from "@bitwarden/common/billing/types/subscription-pricing-tier";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -32,14 +32,6 @@ export type UpgradeAccountResult = {
   plan: PersonalSubscriptionPricingTierId | null;
 };
 
-type CardDetails = {
-  title: string;
-  tagline: string;
-  price: { amount: number; cadence: SubscriptionCadence };
-  button: { text: string; type: ButtonType };
-  features: string[];
-};
-
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
 // eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
@@ -60,8 +52,8 @@ export class UpgradeAccountComponent implements OnInit {
   planSelected = output<PersonalSubscriptionPricingTierId>();
   closeClicked = output<UpgradeAccountStatus>();
   protected readonly loading = signal(true);
-  protected premiumCardDetails!: CardDetails;
-  protected familiesCardDetails!: CardDetails;
+  protected premiumCardDetails!: SubscriptionPricingCardDetails;
+  protected familiesCardDetails!: SubscriptionPricingCardDetails;
 
   protected familiesPlanType = PersonalSubscriptionPricingTierIds.Families;
   protected premiumPlanType = PersonalSubscriptionPricingTierIds.Premium;
@@ -122,14 +114,16 @@ export class UpgradeAccountComponent implements OnInit {
   private createCardDetails(
     tier: PersonalSubscriptionPricingTier,
     buttonType: ButtonType,
-  ): CardDetails {
+  ): SubscriptionPricingCardDetails {
     return {
       title: tier.name,
       tagline: tier.description,
-      price: {
-        amount: tier.passwordManager.annualPrice / 12,
-        cadence: SubscriptionCadenceIds.Monthly,
-      },
+      price: tier.passwordManager.annualPrice
+        ? {
+            amount: tier.passwordManager.annualPrice / 12,
+            cadence: SubscriptionCadenceIds.Monthly,
+          }
+        : undefined,
       button: {
         text: this.i18nService.t(
           this.isFamiliesPlan(tier.id) ? "startFreeFamiliesTrial" : "upgradeToPremium",
diff --git a/apps/web/src/app/billing/individual/upgrade/upgrade-payment/services/upgrade-payment.service.ts b/apps/web/src/app/billing/individual/upgrade/upgrade-payment/services/upgrade-payment.service.ts
index 94f1c816168..ae18ab4c629 100644
--- a/apps/web/src/app/billing/individual/upgrade/upgrade-payment/services/upgrade-payment.service.ts
+++ b/apps/web/src/app/billing/individual/upgrade/upgrade-payment/services/upgrade-payment.service.ts
@@ -200,7 +200,8 @@ export class UpgradePaymentService {
   }
 
   private getPasswordManagerSeats(planDetails: PlanDetails): number {
-    return "users" in planDetails.details.passwordManager
+    return "users" in planDetails.details.passwordManager &&
+      planDetails.details.passwordManager.users
       ? planDetails.details.passwordManager.users
       : 0;
   }
diff --git a/apps/web/src/app/billing/organizations/change-plan-dialog.component.ts b/apps/web/src/app/billing/organizations/change-plan-dialog.component.ts
index 0fd7746fc9d..978bb35c5c7 100644
--- a/apps/web/src/app/billing/organizations/change-plan-dialog.component.ts
+++ b/apps/web/src/app/billing/organizations/change-plan-dialog.component.ts
@@ -620,7 +620,10 @@ export class ChangePlanDialogComponent implements OnInit, OnDestroy {
   }
 
   get storageGb() {
-    return this.sub?.maxStorageGb ? this.sub?.maxStorageGb - 1 : 0;
+    return Math.max(
+      0,
+      (this.sub?.maxStorageGb ?? 0) - this.selectedPlan.PasswordManager.baseStorageGb,
+    );
   }
 
   passwordManagerSeatTotal(plan: PlanResponse): number {
@@ -644,12 +647,7 @@ export class ChangePlanDialogComponent implements OnInit, OnDestroy {
       return 0;
     }
 
-    return (
-      plan.PasswordManager.additionalStoragePricePerGb *
-      // TODO: Eslint upgrade. Please resolve this  since the null check does nothing
-      // eslint-disable-next-line no-constant-binary-expression
-      Math.abs(this.sub?.maxStorageGb ? this.sub?.maxStorageGb - 1 : 0 || 0)
-    );
+    return plan.PasswordManager.additionalStoragePricePerGb * this.storageGb;
   }
 
   additionalStoragePriceMonthly(selectedPlan: PlanResponse) {
diff --git a/apps/web/src/app/billing/organizations/organization-plans.component.html b/apps/web/src/app/billing/organizations/organization-plans.component.html
index 6234fc6e6e3..d06604ba29e 100644
--- a/apps/web/src/app/billing/organizations/organization-plans.component.html
+++ b/apps/web/src/app/billing/organizations/organization-plans.component.html
@@ -104,7 +104,7 @@
                   <li *ngIf="selectableProduct.PasswordManager.baseStorageGb">
                     {{
                       "gbEncryptedFileStorage"
-                        | i18n: selectableProduct.PasswordManager.baseStorageGb + "GB"
+                        | i18n: selectableProduct.PasswordManager.baseStorageGb + " GB"
                     }}
                   </li>
                   <li *ngIf="selectableProduct.hasGroups">
@@ -239,7 +239,7 @@
           <bit-hint class="tw-text-sm">{{
             "additionalStorageIntervalDesc"
               | i18n
-                : "1 GB"
+                : `${selectedPlan.PasswordManager.baseStorageGb} GB`
                 : (additionalStoragePriceMonthly(selectedPlan) | currency: "$")
                 : ("month" | i18n)
           }}</bit-hint>
diff --git a/apps/web/src/app/billing/organizations/organization-plans.component.ts b/apps/web/src/app/billing/organizations/organization-plans.component.ts
index 561a3e03deb..67f6f9b0a6b 100644
--- a/apps/web/src/app/billing/organizations/organization-plans.component.ts
+++ b/apps/web/src/app/billing/organizations/organization-plans.component.ts
@@ -654,6 +654,14 @@ export class OrganizationPlansComponent implements OnInit, OnDestroy {
     if (this.singleOrgPolicyBlock) {
       return;
     }
+
+    // Validate billing form for paid plans during creation
+    if (this.createOrganization && this.selectedPlan.type !== PlanType.Free) {
+      this.billingFormGroup.markAllAsTouched();
+      if (this.billingFormGroup.invalid) {
+        return;
+      }
+    }
     const doSubmit = async (): Promise<string> => {
       let orgId: string;
       if (this.createOrganization) {
@@ -703,11 +711,18 @@ export class OrganizationPlansComponent implements OnInit, OnDestroy {
       return orgId;
     };
 
-    this.formPromise = doSubmit();
-    const organizationId = await this.formPromise;
-    this.onSuccess.emit({ organizationId: organizationId });
-    // TODO: No one actually listening to this message?
-    this.messagingService.send("organizationCreated", { organizationId });
+    try {
+      this.formPromise = doSubmit();
+      const organizationId = await this.formPromise;
+      this.onSuccess.emit({ organizationId: organizationId });
+      // TODO: No one actually listening to this message?
+      this.messagingService.send("organizationCreated", { organizationId });
+    } catch (error: unknown) {
+      if (error instanceof Error && error.message === "Payment method validation failed") {
+        return;
+      }
+      throw error;
+    }
   };
 
   protected get showTaxIdField(): boolean {
@@ -826,6 +841,9 @@ export class OrganizationPlansComponent implements OnInit, OnDestroy {
         return;
       }
       const paymentMethod = await this.enterPaymentMethodComponent.tokenize();
+      if (!paymentMethod) {
+        throw new Error("Payment method validation failed");
+      }
       await this.subscriberBillingClient.updatePaymentMethod(
         { type: "organization", data: this.organization },
         paymentMethod,
@@ -877,6 +895,9 @@ export class OrganizationPlansComponent implements OnInit, OnDestroy {
       }
 
       const paymentMethod = await this.enterPaymentMethodComponent.tokenize();
+      if (!paymentMethod) {
+        throw new Error("Payment method validation failed");
+      }
 
       const billingAddress = getBillingAddressFromForm(
         this.billingFormGroup.controls.billingAddress,
diff --git a/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.html b/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.html
index 0666cca2c4b..8b9b98dc390 100644
--- a/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.html
+++ b/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.html
@@ -38,12 +38,7 @@
                   {{ i.amount | currency: "$" }}
                 </td>
                 <td bitCell class="tw-text-right">
-                  <ng-container
-                    *ngIf="
-                      sub?.customerDiscount?.appliesTo?.includes(i.productId);
-                      else calculateElse
-                    "
-                  >
+                  <ng-container *ngIf="isSecretsManagerTrial(); else calculateElse">
                     {{ "freeForOneYear" | i18n }}
                   </ng-container>
                   <ng-template #calculateElse>
@@ -52,7 +47,7 @@
                         {{ i.quantity * i.amount | currency: "$" }} /{{ i.interval | i18n }}
                       </span>
                       <span
-                        *ngIf="customerDiscount?.percentOff && !isSecretsManagerTrial()"
+                        *ngIf="customerDiscount?.percentOff"
                         class="tw-line-through !tw-text-muted"
                         >{{
                           calculateTotalAppliedDiscount(i.quantity * i.amount) | currency: "$"
diff --git a/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.ts b/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.ts
index e0c1a12a80f..de5d71cce5e 100644
--- a/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.ts
+++ b/apps/web/src/app/billing/organizations/organization-subscription-cloud.component.ts
@@ -403,11 +403,13 @@ export class OrganizationSubscriptionCloudComponent implements OnInit, OnDestroy
   }
 
   isSecretsManagerTrial(): boolean {
-    return (
+    const isSmStandalone = this.sub?.customerDiscount?.id === "sm-standalone";
+    const appliesToProduct =
       this.sub?.subscription?.items?.some((item) =>
         this.sub?.customerDiscount?.appliesTo?.includes(item.productId),
-      ) ?? false
-    );
+      ) ?? false;
+
+    return isSmStandalone && appliesToProduct;
   }
 
   closeChangePlan() {
diff --git a/apps/web/src/app/billing/services/pricing-summary.service.spec.ts b/apps/web/src/app/billing/services/pricing-summary.service.spec.ts
new file mode 100644
index 00000000000..4e15d318a03
--- /dev/null
+++ b/apps/web/src/app/billing/services/pricing-summary.service.spec.ts
@@ -0,0 +1,232 @@
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { PlanInterval, ProductTierType } from "@bitwarden/common/billing/enums";
+import {
+  BillingCustomerDiscount,
+  OrganizationSubscriptionResponse,
+} from "@bitwarden/common/billing/models/response/organization-subscription.response";
+import {
+  PasswordManagerPlanFeaturesResponse,
+  PlanResponse,
+  SecretsManagerPlanFeaturesResponse,
+} from "@bitwarden/common/billing/models/response/plan.response";
+
+import { PricingSummaryData } from "../shared/pricing-summary/pricing-summary.component";
+
+import { PricingSummaryService } from "./pricing-summary.service";
+
+describe("PricingSummaryService", () => {
+  let service: PricingSummaryService;
+
+  beforeEach(() => {
+    service = new PricingSummaryService();
+  });
+
+  describe("getPricingSummaryData", () => {
+    let mockPlan: PlanResponse;
+    let mockSub: OrganizationSubscriptionResponse;
+    let mockOrganization: Organization;
+
+    beforeEach(() => {
+      // Create mock plan with password manager features
+      mockPlan = {
+        productTier: ProductTierType.Teams,
+        PasswordManager: {
+          basePrice: 0,
+          seatPrice: 48,
+          baseSeats: 0,
+          hasAdditionalSeatsOption: true,
+          hasPremiumAccessOption: false,
+          premiumAccessOptionPrice: 0,
+          hasAdditionalStorageOption: true,
+          additionalStoragePricePerGb: 6,
+          baseStorageGb: 1,
+        } as PasswordManagerPlanFeaturesResponse,
+        SecretsManager: {
+          basePrice: 0,
+          seatPrice: 72,
+          baseSeats: 3,
+          hasAdditionalSeatsOption: true,
+          hasAdditionalServiceAccountOption: true,
+          additionalPricePerServiceAccount: 6,
+          baseServiceAccount: 50,
+        } as SecretsManagerPlanFeaturesResponse,
+      } as PlanResponse;
+
+      // Create mock subscription
+      mockSub = {
+        seats: 5,
+        smSeats: 5,
+        smServiceAccounts: 5,
+        maxStorageGb: 2,
+        customerDiscount: null,
+      } as OrganizationSubscriptionResponse;
+
+      // Create mock organization
+      mockOrganization = {
+        useSecretsManager: false,
+      } as Organization;
+    });
+
+    it("should calculate pricing data correctly for password manager only", async () => {
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        false,
+        50, // estimatedTax
+      );
+
+      expect(result).toEqual<PricingSummaryData>({
+        selectedPlanInterval: "month",
+        passwordManagerSeats: 5,
+        passwordManagerSeatTotal: 240, // 48 * 5
+        secretsManagerSeatTotal: 360, // 72 * 5
+        additionalStorageTotal: 6, // 6 * (2 - 1)
+        additionalStoragePriceMonthly: 6,
+        additionalServiceAccountTotal: 0, // No additional service accounts (50 base vs 5 used)
+        totalAppliedDiscount: 0,
+        secretsManagerSubtotal: 360, // 0 + 360 + 0
+        passwordManagerSubtotal: 246, // 0 + 240 + 6
+        total: 296, // 246 + 50 (tax) - organization doesn't use secrets manager
+        organization: mockOrganization,
+        sub: mockSub,
+        selectedPlan: mockPlan,
+        selectedInterval: PlanInterval.Monthly,
+        discountPercentageFromSub: 0,
+        discountPercentage: 20,
+        acceptingSponsorship: false,
+        additionalServiceAccount: 0, // 50 - 5 = 45, which is > 0, so return 0
+        storageGb: 1,
+        isSecretsManagerTrial: false,
+        estimatedTax: 50,
+      });
+    });
+
+    it("should calculate pricing data correctly with secrets manager enabled", async () => {
+      mockOrganization.useSecretsManager = true;
+
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        false,
+        50,
+      );
+
+      expect(result.total).toBe(656); // passwordManagerSubtotal (246) + secretsManagerSubtotal (360) + tax (50)
+    });
+
+    it("should handle secrets manager trial", async () => {
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        true, // isSecretsManagerTrial
+        50,
+      );
+
+      expect(result.passwordManagerSeatTotal).toBe(0); // Should be 0 during trial
+      expect(result.discountPercentageFromSub).toBe(0); // Should be 0 during trial
+    });
+
+    it("should handle premium access option", async () => {
+      mockPlan.PasswordManager.hasPremiumAccessOption = true;
+      mockPlan.PasswordManager.premiumAccessOptionPrice = 25;
+
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        false,
+        50,
+      );
+
+      expect(result.passwordManagerSubtotal).toBe(271); // 0 + 240 + 6 + 25
+    });
+
+    it("should handle customer discount", async () => {
+      mockSub.customerDiscount = {
+        id: "discount1",
+        active: true,
+        percentOff: 10,
+        appliesTo: ["subscription"],
+      } as BillingCustomerDiscount;
+
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        false,
+        50,
+      );
+
+      expect(result.discountPercentageFromSub).toBe(10);
+    });
+
+    it("should handle zero storage calculation", async () => {
+      mockSub.maxStorageGb = 1; // Same as base storage
+
+      const result = await service.getPricingSummaryData(
+        mockPlan,
+        mockSub,
+        mockOrganization,
+        PlanInterval.Monthly,
+        false,
+        50,
+      );
+
+      expect(result.additionalStorageTotal).toBe(0);
+      expect(result.storageGb).toBe(0);
+    });
+  });
+
+  describe("getAdditionalServiceAccount", () => {
+    let mockPlan: PlanResponse;
+    let mockSub: OrganizationSubscriptionResponse;
+
+    beforeEach(() => {
+      mockPlan = {
+        SecretsManager: {
+          baseServiceAccount: 50,
+        } as SecretsManagerPlanFeaturesResponse,
+      } as PlanResponse;
+
+      mockSub = {
+        smServiceAccounts: 55,
+      } as OrganizationSubscriptionResponse;
+    });
+
+    it("should return additional service accounts when used exceeds base", () => {
+      const result = service.getAdditionalServiceAccount(mockPlan, mockSub);
+      expect(result).toBe(5); // Math.abs(50 - 55) = 5
+    });
+
+    it("should return 0 when used is less than or equal to base", () => {
+      mockSub.smServiceAccounts = 40;
+      const result = service.getAdditionalServiceAccount(mockPlan, mockSub);
+      expect(result).toBe(0);
+    });
+
+    it("should return 0 when used equals base", () => {
+      mockSub.smServiceAccounts = 50;
+      const result = service.getAdditionalServiceAccount(mockPlan, mockSub);
+      expect(result).toBe(0);
+    });
+
+    it("should return 0 when plan is null", () => {
+      const result = service.getAdditionalServiceAccount(null, mockSub);
+      expect(result).toBe(0);
+    });
+
+    it("should return 0 when plan has no SecretsManager", () => {
+      mockPlan.SecretsManager = null;
+      const result = service.getAdditionalServiceAccount(mockPlan, mockSub);
+      expect(result).toBe(0);
+    });
+  });
+});
diff --git a/apps/web/src/app/billing/services/pricing-summary.service.ts b/apps/web/src/app/billing/services/pricing-summary.service.ts
index b3c071a8b88..da2fe0e8dbb 100644
--- a/apps/web/src/app/billing/services/pricing-summary.service.ts
+++ b/apps/web/src/app/billing/services/pricing-summary.service.ts
@@ -31,9 +31,10 @@ export class PricingSummaryService {
 
     const additionalServiceAccount = this.getAdditionalServiceAccount(plan, sub);
 
+    const storageGb = Math.max(0, (sub?.maxStorageGb ?? 0) - plan.PasswordManager.baseStorageGb);
+
     const additionalStorageTotal = plan.PasswordManager?.hasAdditionalStorageOption
-      ? plan.PasswordManager.additionalStoragePricePerGb *
-        (sub?.maxStorageGb ? sub.maxStorageGb - 1 : 0)
+      ? plan.PasswordManager.additionalStoragePricePerGb * storageGb
       : 0;
 
     const additionalStoragePriceMonthly = plan.PasswordManager?.additionalStoragePricePerGb || 0;
@@ -66,7 +67,6 @@ export class PricingSummaryService {
       : (sub?.customerDiscount?.percentOff ?? 0);
     const discountPercentage = 20;
     const acceptingSponsorship = false;
-    const storageGb = sub?.maxStorageGb ? sub?.maxStorageGb - 1 : 0;
 
     const total = organization?.useSecretsManager
       ? passwordManagerSubtotal + secretsManagerSubtotal + estimatedTax
diff --git a/apps/web/src/app/core/core.module.ts b/apps/web/src/app/core/core.module.ts
index c0716d99716..fb42e19f863 100644
--- a/apps/web/src/app/core/core.module.ts
+++ b/apps/web/src/app/core/core.module.ts
@@ -69,6 +69,7 @@ import { ProcessReloadServiceAbstraction } from "@bitwarden/common/key-managemen
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
 import {
   VaultTimeout,
   VaultTimeoutStringType,
@@ -111,6 +112,7 @@ import {
 } from "@bitwarden/common/platform/theming/theme-state.service";
 import { PremiumUpgradePromptService } from "@bitwarden/common/vault/abstractions/premium-upgrade-prompt.service";
 import { DialogService, ToastService } from "@bitwarden/components";
+import { GeneratorServicesModule } from "@bitwarden/generator-components";
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
 import {
   KdfConfigService,
@@ -124,7 +126,6 @@ import {
 import { SerializedMemoryStorageService } from "@bitwarden/storage-core";
 import { DefaultSshImportPromptService, SshImportPromptService } from "@bitwarden/vault";
 import { WebOrganizationInviteService } from "@bitwarden/web-vault/app/auth/core/services/organization-invite/web-organization-invite.service";
-import { WebSessionTimeoutSettingsComponentService } from "@bitwarden/web-vault/app/key-management/session-timeout/services/web-session-timeout-settings-component.service";
 import { WebVaultPremiumUpgradePromptService } from "@bitwarden/web-vault/app/vault/services/web-premium-upgrade-prompt.service";
 
 import { flagEnabled } from "../../utils/flags";
@@ -149,6 +150,7 @@ import { WebFileDownloadService } from "../core/web-file-download.service";
 import { UserKeyRotationService } from "../key-management/key-rotation/user-key-rotation.service";
 import { WebLockComponentService } from "../key-management/lock/services/web-lock-component.service";
 import { WebProcessReloadService } from "../key-management/services/web-process-reload.service";
+import { WebSessionTimeoutTypeService } from "../key-management/session-timeout/services/web-session-timeout-type.service";
 import { WebBiometricsService } from "../key-management/web-biometric.service";
 import { WebIpcService } from "../platform/ipc/web-ipc.service";
 import { WebEnvironmentService } from "../platform/web-environment.service";
@@ -469,16 +471,21 @@ const safeProviders: SafeProvider[] = [
     useClass: WebSystemService,
     deps: [],
   }),
+  safeProvider({
+    provide: SessionTimeoutTypeService,
+    useClass: WebSessionTimeoutTypeService,
+    deps: [PlatformUtilsService],
+  }),
   safeProvider({
     provide: SessionTimeoutSettingsComponentService,
-    useClass: WebSessionTimeoutSettingsComponentService,
-    deps: [I18nServiceAbstraction, PlatformUtilsService],
+    useClass: SessionTimeoutSettingsComponentService,
+    deps: [I18nServiceAbstraction, SessionTimeoutTypeService, PolicyService],
   }),
 ];
 
 @NgModule({
   declarations: [],
-  imports: [CommonModule, JslibServicesModule],
+  imports: [CommonModule, JslibServicesModule, GeneratorServicesModule],
   // Do not register your dependency here! Add it to the typesafeProviders array using the helper function
   providers: safeProviders,
 })
diff --git a/apps/web/src/app/core/event.service.ts b/apps/web/src/app/core/event.service.ts
index 05a7f5aa64c..55d5524c2fa 100644
--- a/apps/web/src/app/core/event.service.ts
+++ b/apps/web/src/app/core/event.service.ts
@@ -372,7 +372,7 @@ export class EventService {
         msg = humanReadableMsg = this.i18nService.t("enabledSso");
         break;
       case EventType.Organization_DisabledSso:
-        msg = humanReadableMsg = this.i18nService.t("disabledSso");
+        msg = humanReadableMsg = this.i18nService.t("ssoTurnedOff");
         break;
       case EventType.Organization_EnabledKeyConnector:
         msg = humanReadableMsg = this.i18nService.t("enabledKeyConnector");
diff --git a/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.spec.ts b/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.spec.ts
index 525ddd89675..2c2caba7b3a 100644
--- a/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.spec.ts
+++ b/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.spec.ts
@@ -4,7 +4,7 @@ import { mock, MockProxy } from "jest-mock-extended";
 import { of } from "rxjs";
 
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf-service.abstraction";
+import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf.service.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
diff --git a/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.ts b/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.ts
index b730a3597ba..ffeabffa019 100644
--- a/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.ts
+++ b/apps/web/src/app/key-management/change-kdf/change-kdf-confirmation.component.ts
@@ -5,7 +5,7 @@ import { firstValueFrom, Observable } from "rxjs";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
-import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf-service.abstraction";
+import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf.service.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
diff --git a/apps/web/src/app/key-management/data-recovery/data-recovery.component.html b/apps/web/src/app/key-management/data-recovery/data-recovery.component.html
new file mode 100644
index 00000000000..f357e516115
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/data-recovery.component.html
@@ -0,0 +1,75 @@
+<h2 class="tw-mt-6 tw-mb-2 tw-pb-2.5">{{ "dataRecoveryTitle" | i18n }}</h2>
+
+<div class="tw-max-w-lg">
+  <p bitTypography="body1" class="tw-mb-4">
+    {{ "dataRecoveryDescription" | i18n }}
+  </p>
+
+  @if (!diagnosticsCompleted() && !recoveryCompleted()) {
+    <button
+      type="button"
+      bitButton
+      buttonType="primary"
+      [bitAction]="runDiagnostics"
+      class="tw-mb-6"
+    >
+      {{ "runDiagnostics" | i18n }}
+    </button>
+  }
+
+  <div class="tw-space-y-3 tw-mb-6">
+    @for (step of steps(); track $index) {
+      @if (
+        ($index === 0 && hasStarted()) ||
+        ($index > 0 &&
+          (steps()[$index - 1].status === StepStatus.Completed ||
+            steps()[$index - 1].status === StepStatus.Failed))
+      ) {
+        <div class="tw-flex tw-items-start tw-gap-3">
+          <div class="tw-mt-1">
+            @if (step.status === StepStatus.Failed) {
+              <i class="bwi bwi-close tw-text-danger" aria-hidden="true"></i>
+            } @else if (step.status === StepStatus.Completed) {
+              <i class="bwi bwi-check tw-text-success" aria-hidden="true"></i>
+            } @else if (step.status === StepStatus.InProgress) {
+              <i class="bwi bwi-spinner bwi-spin tw-text-primary-600" aria-hidden="true"></i>
+            } @else {
+              <i class="bwi bwi-circle tw-text-secondary-300" aria-hidden="true"></i>
+            }
+          </div>
+          <div>
+            <span
+              [class.tw-text-danger]="step.status === StepStatus.Failed"
+              [class.tw-text-success]="step.status === StepStatus.Completed"
+              [class.tw-text-primary-600]="step.status === StepStatus.InProgress"
+              [class.tw-font-semibold]="step.status === StepStatus.InProgress"
+              [class.tw-text-secondary-500]="step.status === StepStatus.NotStarted"
+            >
+              {{ step.title }}
+            </span>
+          </div>
+        </div>
+      }
+    }
+  </div>
+
+  @if (diagnosticsCompleted()) {
+    <div class="tw-flex tw-gap-3">
+      @if (hasIssues() && !recoveryCompleted()) {
+        <button
+          type="button"
+          bitButton
+          buttonType="primary"
+          [disabled]="status() === StepStatus.InProgress"
+          [bitAction]="runRecovery"
+        >
+          {{ "repairIssues" | i18n }}
+        </button>
+      }
+      <button type="button" bitButton buttonType="secondary" [bitAction]="saveDiagnosticLogs">
+        <i class="bwi bwi-download" aria-hidden="true"></i>
+        {{ "saveDiagnosticLogs" | i18n }}
+      </button>
+    </div>
+  }
+</div>
diff --git a/apps/web/src/app/key-management/data-recovery/data-recovery.component.spec.ts b/apps/web/src/app/key-management/data-recovery/data-recovery.component.spec.ts
new file mode 100644
index 00000000000..1976a8dfe27
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/data-recovery.component.spec.ts
@@ -0,0 +1,348 @@
+import { ComponentFixture, TestBed } from "@angular/core/testing";
+import { mock, MockProxy } from "jest-mock-extended";
+
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
+import { FileDownloadService } from "@bitwarden/common/platform/abstractions/file-download/file-download.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FakeAccountService, mockAccountServiceWith } from "@bitwarden/common/spec";
+import { UserId } from "@bitwarden/common/types/guid";
+import { CipherEncryptionService } from "@bitwarden/common/vault/abstractions/cipher-encryption.service";
+import { FolderApiServiceAbstraction } from "@bitwarden/common/vault/abstractions/folder/folder-api.service.abstraction";
+import { DialogService } from "@bitwarden/components";
+import { KeyService, UserAsymmetricKeysRegenerationService } from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { DataRecoveryComponent, StepStatus } from "./data-recovery.component";
+import { RecoveryStep, RecoveryWorkingData } from "./steps";
+
+// Mock SdkLoadService
+jest.mock("@bitwarden/common/platform/abstractions/sdk/sdk-load.service", () => ({
+  SdkLoadService: {
+    Ready: Promise.resolve(),
+  },
+}));
+
+describe("DataRecoveryComponent", () => {
+  let component: DataRecoveryComponent;
+  let fixture: ComponentFixture<DataRecoveryComponent>;
+
+  // Mock Services
+  let mockI18nService: MockProxy<I18nService>;
+  let mockApiService: MockProxy<ApiService>;
+  let mockAccountService: FakeAccountService;
+  let mockKeyService: MockProxy<KeyService>;
+  let mockFolderApiService: MockProxy<FolderApiServiceAbstraction>;
+  let mockCipherEncryptService: MockProxy<CipherEncryptionService>;
+  let mockDialogService: MockProxy<DialogService>;
+  let mockPrivateKeyRegenerationService: MockProxy<UserAsymmetricKeysRegenerationService>;
+  let mockLogService: MockProxy<LogService>;
+  let mockCryptoFunctionService: MockProxy<CryptoFunctionService>;
+  let mockFileDownloadService: MockProxy<FileDownloadService>;
+
+  const mockUserId = "user-id" as UserId;
+
+  beforeEach(async () => {
+    mockI18nService = mock<I18nService>();
+    mockApiService = mock<ApiService>();
+    mockAccountService = mockAccountServiceWith(mockUserId);
+    mockKeyService = mock<KeyService>();
+    mockFolderApiService = mock<FolderApiServiceAbstraction>();
+    mockCipherEncryptService = mock<CipherEncryptionService>();
+    mockDialogService = mock<DialogService>();
+    mockPrivateKeyRegenerationService = mock<UserAsymmetricKeysRegenerationService>();
+    mockLogService = mock<LogService>();
+    mockCryptoFunctionService = mock<CryptoFunctionService>();
+    mockFileDownloadService = mock<FileDownloadService>();
+
+    mockI18nService.t.mockImplementation((key) => `${key}_used-i18n`);
+
+    await TestBed.configureTestingModule({
+      imports: [DataRecoveryComponent],
+      providers: [
+        { provide: I18nService, useValue: mockI18nService },
+        { provide: ApiService, useValue: mockApiService },
+        { provide: AccountService, useValue: mockAccountService },
+        { provide: KeyService, useValue: mockKeyService },
+        { provide: FolderApiServiceAbstraction, useValue: mockFolderApiService },
+        { provide: CipherEncryptionService, useValue: mockCipherEncryptService },
+        { provide: DialogService, useValue: mockDialogService },
+        {
+          provide: UserAsymmetricKeysRegenerationService,
+          useValue: mockPrivateKeyRegenerationService,
+        },
+        { provide: LogService, useValue: mockLogService },
+        { provide: CryptoFunctionService, useValue: mockCryptoFunctionService },
+        { provide: FileDownloadService, useValue: mockFileDownloadService },
+      ],
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(DataRecoveryComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  describe("Component Initialization", () => {
+    it("should create", () => {
+      expect(component).toBeTruthy();
+    });
+
+    it("should initialize with default signal values", () => {
+      expect(component.status()).toBe(StepStatus.NotStarted);
+      expect(component.hasStarted()).toBe(false);
+      expect(component.diagnosticsCompleted()).toBe(false);
+      expect(component.recoveryCompleted()).toBe(false);
+      expect(component.hasIssues()).toBe(false);
+    });
+
+    it("should initialize steps in correct order", () => {
+      const steps = component.steps();
+      expect(steps.length).toBe(5);
+      expect(steps[0].title).toBe("recoveryStepUserInfoTitle_used-i18n");
+      expect(steps[1].title).toBe("recoveryStepSyncTitle_used-i18n");
+      expect(steps[2].title).toBe("recoveryStepPrivateKeyTitle_used-i18n");
+      expect(steps[3].title).toBe("recoveryStepFoldersTitle_used-i18n");
+      expect(steps[4].title).toBe("recoveryStepCipherTitle_used-i18n");
+    });
+  });
+
+  describe("runDiagnostics", () => {
+    let mockSteps: MockProxy<RecoveryStep>[];
+
+    beforeEach(() => {
+      // Create mock steps
+      mockSteps = Array(5)
+        .fill(null)
+        .map(() => {
+          const mockStep = mock<RecoveryStep>();
+          mockStep.title = "mockStep";
+          mockStep.runDiagnostics.mockResolvedValue(true);
+          mockStep.canRecover.mockReturnValue(false);
+          return mockStep;
+        });
+
+      // Replace recovery steps with mocks
+      component["recoverySteps"] = mockSteps;
+    });
+
+    it("should not run if already running", async () => {
+      component["status"].set(StepStatus.InProgress);
+      await component.runDiagnostics();
+
+      expect(mockSteps[0].runDiagnostics).not.toHaveBeenCalled();
+    });
+
+    it("should set hasStarted, isRunning and initialize workingData", async () => {
+      await component.runDiagnostics();
+
+      expect(component.hasStarted()).toBe(true);
+      expect(component["workingData"]).toBeDefined();
+      expect(component["workingData"]?.userId).toBeNull();
+      expect(component["workingData"]?.userKey).toBeNull();
+    });
+
+    it("should run diagnostics for all steps", async () => {
+      await component.runDiagnostics();
+
+      mockSteps.forEach((step) => {
+        expect(step.runDiagnostics).toHaveBeenCalledWith(
+          component["workingData"],
+          expect.anything(),
+        );
+      });
+    });
+
+    it("should mark steps as completed when diagnostics succeed", async () => {
+      await component.runDiagnostics();
+
+      const steps = component.steps();
+      steps.forEach((step) => {
+        expect(step.status).toBe(StepStatus.Completed);
+      });
+    });
+
+    it("should mark steps as failed when diagnostics return false", async () => {
+      mockSteps[2].runDiagnostics.mockResolvedValue(false);
+
+      await component.runDiagnostics();
+
+      const steps = component.steps();
+      expect(steps[2].status).toBe(StepStatus.Failed);
+    });
+
+    it("should mark steps as failed when diagnostics throw error", async () => {
+      mockSteps[3].runDiagnostics.mockRejectedValue(new Error("Test error"));
+
+      await component.runDiagnostics();
+
+      const steps = component.steps();
+      expect(steps[3].status).toBe(StepStatus.Failed);
+      expect(steps[3].message).toBe("Test error");
+    });
+
+    it("should continue diagnostics even if a step fails", async () => {
+      mockSteps[1].runDiagnostics.mockRejectedValue(new Error("Step 1 failed"));
+      mockSteps[3].runDiagnostics.mockResolvedValue(false);
+
+      await component.runDiagnostics();
+
+      // All steps should have been called despite failures
+      mockSteps.forEach((step) => {
+        expect(step.runDiagnostics).toHaveBeenCalled();
+      });
+    });
+
+    it("should set hasIssues to true when a step can recover", async () => {
+      mockSteps[2].runDiagnostics.mockResolvedValue(false);
+      mockSteps[2].canRecover.mockReturnValue(true);
+
+      await component.runDiagnostics();
+
+      expect(component.hasIssues()).toBe(true);
+    });
+
+    it("should set hasIssues to false when no step can recover", async () => {
+      mockSteps.forEach((step) => {
+        step.runDiagnostics.mockResolvedValue(true);
+        step.canRecover.mockReturnValue(false);
+      });
+
+      await component.runDiagnostics();
+
+      expect(component.hasIssues()).toBe(false);
+    });
+
+    it("should set diagnosticsCompleted and status to completed when complete", async () => {
+      await component.runDiagnostics();
+
+      expect(component.diagnosticsCompleted()).toBe(true);
+      expect(component.status()).toBe(StepStatus.Completed);
+    });
+  });
+
+  describe("runRecovery", () => {
+    let mockSteps: MockProxy<RecoveryStep>[];
+    let mockWorkingData: RecoveryWorkingData;
+
+    beforeEach(() => {
+      mockWorkingData = {
+        userId: mockUserId,
+        userKey: null as any,
+        isPrivateKeyCorrupt: false,
+        encryptedPrivateKey: null,
+        ciphers: [],
+        folders: [],
+      };
+
+      mockSteps = Array(5)
+        .fill(null)
+        .map(() => {
+          const mockStep = mock<RecoveryStep>();
+          mockStep.title = "mockStep";
+          mockStep.canRecover.mockReturnValue(false);
+          mockStep.runRecovery.mockResolvedValue();
+          mockStep.runDiagnostics.mockResolvedValue(true);
+          return mockStep;
+        });
+
+      component["recoverySteps"] = mockSteps;
+      component["workingData"] = mockWorkingData;
+    });
+
+    it("should not run if already running", async () => {
+      component["status"].set(StepStatus.InProgress);
+      await component.runRecovery();
+
+      expect(mockSteps[0].runRecovery).not.toHaveBeenCalled();
+    });
+
+    it("should not run if workingData is null", async () => {
+      component["workingData"] = null;
+      await component.runRecovery();
+
+      expect(mockSteps[0].runRecovery).not.toHaveBeenCalled();
+    });
+
+    it("should only run recovery for steps that can recover", async () => {
+      mockSteps[1].canRecover.mockReturnValue(true);
+      mockSteps[3].canRecover.mockReturnValue(true);
+
+      await component.runRecovery();
+
+      expect(mockSteps[0].runRecovery).not.toHaveBeenCalled();
+      expect(mockSteps[1].runRecovery).toHaveBeenCalled();
+      expect(mockSteps[2].runRecovery).not.toHaveBeenCalled();
+      expect(mockSteps[3].runRecovery).toHaveBeenCalled();
+      expect(mockSteps[4].runRecovery).not.toHaveBeenCalled();
+    });
+
+    it("should set recoveryCompleted and status when successful", async () => {
+      mockSteps[1].canRecover.mockReturnValue(true);
+
+      await component.runRecovery();
+
+      expect(component.recoveryCompleted()).toBe(true);
+      expect(component.status()).toBe(StepStatus.Completed);
+    });
+
+    it("should set status to failed if recovery is cancelled", async () => {
+      mockSteps[1].canRecover.mockReturnValue(true);
+      mockSteps[1].runRecovery.mockRejectedValue(new Error("User cancelled"));
+
+      await component.runRecovery();
+
+      expect(component.status()).toBe(StepStatus.Failed);
+      expect(component.recoveryCompleted()).toBe(false);
+    });
+
+    it("should re-run diagnostics after recovery completes", async () => {
+      mockSteps[1].canRecover.mockReturnValue(true);
+
+      await component.runRecovery();
+
+      // Diagnostics should be called twice: once for initial diagnostic scan
+      mockSteps.forEach((step) => {
+        expect(step.runDiagnostics).toHaveBeenCalledWith(mockWorkingData, expect.anything());
+      });
+    });
+
+    it("should update hasIssues after re-running diagnostics", async () => {
+      // Setup initial state with an issue
+      mockSteps[1].canRecover.mockReturnValue(true);
+      mockSteps[1].runDiagnostics.mockResolvedValue(false);
+
+      // After recovery completes, the issue should be fixed
+      mockSteps[1].runRecovery.mockImplementation(() => {
+        // Simulate recovery fixing the issue
+        mockSteps[1].canRecover.mockReturnValue(false);
+        mockSteps[1].runDiagnostics.mockResolvedValue(true);
+        return Promise.resolve();
+      });
+
+      await component.runRecovery();
+
+      // Verify hasIssues is updated after re-running diagnostics
+      expect(component.hasIssues()).toBe(false);
+    });
+  });
+
+  describe("saveDiagnosticLogs", () => {
+    it("should call fileDownloadService with log content", () => {
+      component.saveDiagnosticLogs();
+
+      expect(mockFileDownloadService.download).toHaveBeenCalledWith({
+        fileName: expect.stringContaining("data-recovery-logs-"),
+        blobData: expect.any(String),
+        blobOptions: { type: "text/plain" },
+      });
+    });
+
+    it("should include timestamp in filename", () => {
+      component.saveDiagnosticLogs();
+
+      const downloadCall = mockFileDownloadService.download.mock.calls[0][0];
+      expect(downloadCall.fileName).toMatch(/data-recovery-logs-\d{4}-\d{2}-\d{2}T.*\.txt/);
+    });
+  });
+});
diff --git a/apps/web/src/app/key-management/data-recovery/data-recovery.component.ts b/apps/web/src/app/key-management/data-recovery/data-recovery.component.ts
new file mode 100644
index 00000000000..31179dfb062
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/data-recovery.component.ts
@@ -0,0 +1,208 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, inject, signal } from "@angular/core";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
+import { FileDownloadService } from "@bitwarden/common/platform/abstractions/file-download/file-download.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { CipherEncryptionService } from "@bitwarden/common/vault/abstractions/cipher-encryption.service";
+import { FolderApiServiceAbstraction } from "@bitwarden/common/vault/abstractions/folder/folder-api.service.abstraction";
+import { ButtonModule, DialogService } from "@bitwarden/components";
+import { KeyService, UserAsymmetricKeysRegenerationService } from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { SharedModule } from "../../shared";
+
+import { LogRecorder } from "./log-recorder";
+import {
+  SyncStep,
+  UserInfoStep,
+  RecoveryStep,
+  PrivateKeyStep,
+  RecoveryWorkingData,
+  FolderStep,
+  CipherStep,
+} from "./steps";
+
+export const StepStatus = Object.freeze({
+  NotStarted: 0,
+  InProgress: 1,
+  Completed: 2,
+  Failed: 3,
+} as const);
+export type StepStatus = (typeof StepStatus)[keyof typeof StepStatus];
+
+interface StepState {
+  title: string;
+  status: StepStatus;
+  message?: string;
+}
+
+@Component({
+  selector: "app-data-recovery",
+  templateUrl: "data-recovery.component.html",
+  standalone: true,
+  imports: [JslibModule, ButtonModule, CommonModule, SharedModule],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class DataRecoveryComponent {
+  protected readonly StepStatus = StepStatus;
+
+  private i18nService = inject(I18nService);
+  private apiService = inject(ApiService);
+  private accountService = inject(AccountService);
+  private keyService = inject(KeyService);
+  private folderApiService = inject(FolderApiServiceAbstraction);
+  private cipherEncryptService = inject(CipherEncryptionService);
+  private dialogService = inject(DialogService);
+  private privateKeyRegenerationService = inject(UserAsymmetricKeysRegenerationService);
+  private cryptoFunctionService = inject(CryptoFunctionService);
+  private logService = inject(LogService);
+  private fileDownloadService = inject(FileDownloadService);
+
+  private logger: LogRecorder = new LogRecorder(this.logService);
+  private recoverySteps: RecoveryStep[] = [
+    new UserInfoStep(this.accountService, this.keyService),
+    new SyncStep(this.apiService),
+    new PrivateKeyStep(
+      this.privateKeyRegenerationService,
+      this.dialogService,
+      this.cryptoFunctionService,
+    ),
+    new FolderStep(this.folderApiService, this.dialogService),
+    new CipherStep(this.apiService, this.cipherEncryptService, this.dialogService),
+  ];
+  private workingData: RecoveryWorkingData | null = null;
+
+  readonly status = signal<StepStatus>(StepStatus.NotStarted);
+  readonly hasStarted = signal(false);
+  readonly diagnosticsCompleted = signal(false);
+  readonly recoveryCompleted = signal(false);
+  readonly steps = signal<StepState[]>(
+    this.recoverySteps.map((step) => ({
+      title: this.i18nService.t(step.title),
+      status: StepStatus.NotStarted,
+    })),
+  );
+  readonly hasIssues = signal(false);
+
+  runDiagnostics = async () => {
+    if (this.status() === StepStatus.InProgress) {
+      return;
+    }
+
+    this.hasStarted.set(true);
+    this.status.set(StepStatus.InProgress);
+    this.diagnosticsCompleted.set(false);
+
+    this.logger.record("Starting diagnostics...");
+    this.workingData = {
+      userId: null,
+      userKey: null,
+      isPrivateKeyCorrupt: false,
+      encryptedPrivateKey: null,
+      ciphers: [],
+      folders: [],
+    };
+
+    await this.runDiagnosticsInternal();
+
+    this.status.set(StepStatus.Completed);
+    this.diagnosticsCompleted.set(true);
+  };
+
+  private async runDiagnosticsInternal() {
+    if (!this.workingData) {
+      this.logger.record("No working data available");
+      return;
+    }
+
+    const currentSteps = this.steps();
+    let hasAnyFailures = false;
+
+    for (let i = 0; i < this.recoverySteps.length; i++) {
+      const step = this.recoverySteps[i];
+      currentSteps[i].status = StepStatus.InProgress;
+      this.steps.set([...currentSteps]);
+
+      this.logger.record(`Running diagnostics for step: ${step.title}`);
+      try {
+        const success = await step.runDiagnostics(this.workingData, this.logger);
+        currentSteps[i].status = success ? StepStatus.Completed : StepStatus.Failed;
+        if (!success) {
+          hasAnyFailures = true;
+        }
+        this.steps.set([...currentSteps]);
+        this.logger.record(`Diagnostics completed for step: ${step.title}`);
+      } catch (error) {
+        currentSteps[i].status = StepStatus.Failed;
+        currentSteps[i].message = (error as Error).message;
+        this.steps.set([...currentSteps]);
+        this.logger.record(
+          `Diagnostics failed for step: ${step.title} with error: ${(error as Error).message}`,
+        );
+        hasAnyFailures = true;
+      }
+    }
+
+    if (hasAnyFailures) {
+      this.logger.record("Diagnostics completed with errors");
+    } else {
+      this.logger.record("Diagnostics completed successfully");
+    }
+
+    // Check if any recovery can be performed
+    const canRecoverAnyStep = this.recoverySteps.some((step) => step.canRecover(this.workingData!));
+    this.hasIssues.set(canRecoverAnyStep);
+  }
+
+  runRecovery = async () => {
+    if (this.status() === StepStatus.InProgress || !this.workingData) {
+      return;
+    }
+
+    this.status.set(StepStatus.InProgress);
+    this.recoveryCompleted.set(false);
+
+    this.logger.record("Starting recovery process...");
+
+    try {
+      for (let i = 0; i < this.recoverySteps.length; i++) {
+        const step = this.recoverySteps[i];
+        if (step.canRecover(this.workingData)) {
+          this.logger.record(`Running recovery for step: ${step.title}`);
+          await step.runRecovery(this.workingData, this.logger);
+        }
+      }
+
+      this.logger.record("Recovery process completed");
+      this.recoveryCompleted.set(true);
+
+      // Re-run diagnostics after recovery
+      this.logger.record("Re-running diagnostics to verify recovery...");
+      await this.runDiagnosticsInternal();
+
+      this.status.set(StepStatus.Completed);
+    } catch (error) {
+      this.logger.record(`Recovery process cancelled or failed: ${(error as Error).message}`);
+      this.status.set(StepStatus.Failed);
+    }
+  };
+
+  saveDiagnosticLogs = () => {
+    const logs = this.logger.getLogs();
+    const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const filename = `data-recovery-logs-${timestamp}.txt`;
+
+    const logContent = logs.join("\n");
+    this.fileDownloadService.download({
+      fileName: filename,
+      blobData: logContent,
+      blobOptions: { type: "text/plain" },
+    });
+
+    this.logger.record("Diagnostic logs saved");
+  };
+}
diff --git a/apps/web/src/app/key-management/data-recovery/log-recorder.ts b/apps/web/src/app/key-management/data-recovery/log-recorder.ts
new file mode 100644
index 00000000000..1bca90de48d
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/log-recorder.ts
@@ -0,0 +1,19 @@
+import { LogService } from "@bitwarden/logging";
+
+/**
+ * Record logs during the data recovery process. This only keeps them in memory and does not persist them anywhere.
+ */
+export class LogRecorder {
+  private logs: string[] = [];
+
+  constructor(private logService: LogService) {}
+
+  record(message: string) {
+    this.logs.push(message);
+    this.logService.info(`[DataRecovery] ${message}`);
+  }
+
+  getLogs(): string[] {
+    return [...this.logs];
+  }
+}
diff --git a/apps/web/src/app/key-management/data-recovery/steps/cipher-step.ts b/apps/web/src/app/key-management/data-recovery/steps/cipher-step.ts
new file mode 100644
index 00000000000..34e8cbdc9f3
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/cipher-step.ts
@@ -0,0 +1,81 @@
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { CipherEncryptionService } from "@bitwarden/common/vault/abstractions/cipher-encryption.service";
+import { DialogService } from "@bitwarden/components";
+
+import { LogRecorder } from "../log-recorder";
+
+import { RecoveryStep, RecoveryWorkingData } from "./recovery-step";
+
+export class CipherStep implements RecoveryStep {
+  title = "recoveryStepCipherTitle";
+
+  private undecryptableCipherIds: string[] = [];
+
+  constructor(
+    private apiService: ApiService,
+    private cipherService: CipherEncryptionService,
+    private dialogService: DialogService,
+  ) {}
+
+  async runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean> {
+    if (!workingData.userId) {
+      logger.record("Missing user ID");
+      return false;
+    }
+
+    this.undecryptableCipherIds = [];
+    for (const cipher of workingData.ciphers) {
+      try {
+        await this.cipherService.decrypt(cipher, workingData.userId);
+      } catch {
+        logger.record(`Cipher ID ${cipher.id} was undecryptable`);
+        this.undecryptableCipherIds.push(cipher.id);
+      }
+    }
+    logger.record(`Found ${this.undecryptableCipherIds.length} undecryptable ciphers`);
+
+    return this.undecryptableCipherIds.length == 0;
+  }
+
+  canRecover(workingData: RecoveryWorkingData): boolean {
+    return this.undecryptableCipherIds.length > 0;
+  }
+
+  async runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
+    // Recovery means deleting the broken ciphers.
+    if (this.undecryptableCipherIds.length === 0) {
+      logger.record("No undecryptable ciphers to recover");
+      return;
+    }
+
+    logger.record(`Showing confirmation dialog for ${this.undecryptableCipherIds.length} ciphers`);
+
+    const confirmed = await this.dialogService.openSimpleDialog({
+      title: { key: "recoveryDeleteCiphersTitle" },
+      content: { key: "recoveryDeleteCiphersDesc" },
+      acceptButtonText: { key: "ok" },
+      cancelButtonText: { key: "cancel" },
+      type: "danger",
+    });
+
+    if (!confirmed) {
+      logger.record("User cancelled cipher deletion");
+      throw new Error("Cipher recovery cancelled by user");
+    }
+
+    logger.record(`Deleting ${this.undecryptableCipherIds.length} ciphers`);
+
+    for (const cipherId of this.undecryptableCipherIds) {
+      try {
+        await this.apiService.deleteCipher(cipherId);
+        logger.record(`Deleted cipher ${cipherId}`);
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.record(`Failed to delete cipher ${cipherId}: ${errorMessage}`);
+        throw error;
+      }
+    }
+
+    logger.record(`Successfully deleted ${this.undecryptableCipherIds.length} ciphers`);
+  }
+}
diff --git a/apps/web/src/app/key-management/data-recovery/steps/folder-step.ts b/apps/web/src/app/key-management/data-recovery/steps/folder-step.ts
new file mode 100644
index 00000000000..bc0ae31efba
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/folder-step.ts
@@ -0,0 +1,97 @@
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { FolderApiServiceAbstraction } from "@bitwarden/common/vault/abstractions/folder/folder-api.service.abstraction";
+import { DialogService } from "@bitwarden/components";
+import { PureCrypto } from "@bitwarden/sdk-internal";
+
+import { LogRecorder } from "../log-recorder";
+
+import { RecoveryStep, RecoveryWorkingData } from "./recovery-step";
+
+export class FolderStep implements RecoveryStep {
+  title = "recoveryStepFoldersTitle";
+
+  private undecryptableFolderIds: string[] = [];
+
+  constructor(
+    private folderService: FolderApiServiceAbstraction,
+    private dialogService: DialogService,
+  ) {}
+
+  async runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean> {
+    if (!workingData.userKey) {
+      logger.record("Missing user key");
+      return false;
+    }
+
+    this.undecryptableFolderIds = [];
+    for (const folder of workingData.folders) {
+      if (!folder.name?.encryptedString) {
+        logger.record(`Folder ID ${folder.id} has no name`);
+        this.undecryptableFolderIds.push(folder.id);
+        continue;
+      }
+      try {
+        await SdkLoadService.Ready;
+        PureCrypto.symmetric_decrypt_string(
+          folder.name.encryptedString,
+          workingData.userKey.toEncoded(),
+        );
+      } catch {
+        logger.record(`Folder name for folder ID ${folder.id} was undecryptable`);
+        this.undecryptableFolderIds.push(folder.id);
+      }
+    }
+    logger.record(`Found ${this.undecryptableFolderIds.length} undecryptable folders`);
+
+    return this.undecryptableFolderIds.length == 0;
+  }
+
+  canRecover(workingData: RecoveryWorkingData): boolean {
+    return this.undecryptableFolderIds.length > 0;
+  }
+
+  async runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
+    // Recovery means deleting the broken folders.
+    if (this.undecryptableFolderIds.length === 0) {
+      logger.record("No undecryptable folders to recover");
+      return;
+    }
+
+    if (!workingData.userId) {
+      logger.record("Missing user ID");
+      throw new Error("Missing user ID");
+    }
+
+    logger.record(`Showing confirmation dialog for ${this.undecryptableFolderIds.length} folders`);
+
+    const confirmed = await this.dialogService.openSimpleDialog({
+      title: { key: "recoveryDeleteFoldersTitle" },
+      content: { key: "recoveryDeleteFoldersDesc" },
+      acceptButtonText: { key: "ok" },
+      cancelButtonText: { key: "cancel" },
+      type: "danger",
+    });
+
+    if (!confirmed) {
+      logger.record("User cancelled folder deletion");
+      throw new Error("Folder recovery cancelled by user");
+    }
+
+    logger.record(`Deleting ${this.undecryptableFolderIds.length} folders`);
+
+    for (const folderId of this.undecryptableFolderIds) {
+      try {
+        await this.folderService.delete(folderId, workingData.userId);
+        logger.record(`Deleted folder ${folderId}`);
+      } catch (error) {
+        logger.record(`Failed to delete folder ${folderId}: ${error}`);
+      }
+    }
+
+    logger.record(`Successfully deleted ${this.undecryptableFolderIds.length} folders`);
+  }
+
+  getUndecryptableFolderIds(): string[] {
+    return this.undecryptableFolderIds;
+  }
+}
diff --git a/apps/web/src/app/key-management/data-recovery/steps/index.ts b/apps/web/src/app/key-management/data-recovery/steps/index.ts
new file mode 100644
index 00000000000..caf3cdb34ef
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/index.ts
@@ -0,0 +1,6 @@
+export * from "./sync-step";
+export * from "./user-info-step";
+export * from "./recovery-step";
+export * from "./private-key-step";
+export * from "./folder-step";
+export * from "./cipher-step";
diff --git a/apps/web/src/app/key-management/data-recovery/steps/private-key-step.ts b/apps/web/src/app/key-management/data-recovery/steps/private-key-step.ts
new file mode 100644
index 00000000000..82c20c466b8
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/private-key-step.ts
@@ -0,0 +1,93 @@
+import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { EncryptionType } from "@bitwarden/common/platform/enums";
+import { DialogService } from "@bitwarden/components";
+import { UserAsymmetricKeysRegenerationService } from "@bitwarden/key-management";
+import { PureCrypto } from "@bitwarden/sdk-internal";
+
+import { LogRecorder } from "../log-recorder";
+
+import { RecoveryStep, RecoveryWorkingData } from "./recovery-step";
+
+export class PrivateKeyStep implements RecoveryStep {
+  title = "recoveryStepPrivateKeyTitle";
+
+  constructor(
+    private privateKeyRegenerationService: UserAsymmetricKeysRegenerationService,
+    private dialogService: DialogService,
+    private cryptoFunctionService: CryptoFunctionService,
+  ) {}
+
+  async runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean> {
+    if (!workingData.userId || !workingData.userKey) {
+      logger.record("Missing user ID or user key");
+      return false;
+    }
+
+    // Make sure the private key decrypts properly and is not somehow encrypted by a different user key / broken during key rotation.
+    const encryptedPrivateKey = workingData.encryptedPrivateKey;
+    if (!encryptedPrivateKey) {
+      logger.record("No encrypted private key found");
+      return false;
+    }
+    logger.record("Private key length: " + encryptedPrivateKey.length);
+    let privateKey: Uint8Array;
+    try {
+      await SdkLoadService.Ready;
+      privateKey = PureCrypto.unwrap_decapsulation_key(
+        encryptedPrivateKey,
+        workingData.userKey.toEncoded(),
+      );
+    } catch {
+      logger.record("Private key was un-decryptable");
+      workingData.isPrivateKeyCorrupt = true;
+      return false;
+    }
+
+    // Make sure the contained private key can be parsed and the public key can be derived. If not, then the private key may be corrupt / generated with an incompatible ASN.1 representation / with incompatible padding.
+    try {
+      const publicKey = await this.cryptoFunctionService.rsaExtractPublicKey(privateKey);
+      logger.record("Public key length: " + publicKey.length);
+    } catch {
+      logger.record("Public key could not be derived; private key is corrupt");
+      workingData.isPrivateKeyCorrupt = true;
+      return false;
+    }
+
+    return true;
+  }
+
+  canRecover(workingData: RecoveryWorkingData): boolean {
+    // Only support recovery on V1 users.
+    return (
+      workingData.isPrivateKeyCorrupt &&
+      workingData.userKey !== null &&
+      workingData.userKey.inner().type === EncryptionType.AesCbc256_HmacSha256_B64
+    );
+  }
+
+  async runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
+    // The recovery step is to replace the key pair. Currently, this only works if the user is not using emergency access or is part of an organization.
+    // This is because this will break emergency access enrollments / organization memberships / provider memberships.
+    logger.record("Showing confirmation dialog for private key replacement");
+
+    const confirmed = await this.dialogService.openSimpleDialog({
+      title: { key: "recoveryReplacePrivateKeyTitle" },
+      content: { key: "recoveryReplacePrivateKeyDesc" },
+      acceptButtonText: { key: "ok" },
+      cancelButtonText: { key: "cancel" },
+      type: "danger",
+    });
+
+    if (!confirmed) {
+      logger.record("User cancelled private key replacement");
+      throw new Error("Private key recovery cancelled by user");
+    }
+
+    logger.record("Replacing private key");
+    await this.privateKeyRegenerationService.regenerateUserPublicKeyEncryptionKeyPair(
+      workingData.userId!,
+    );
+    logger.record("Private key replaced successfully");
+  }
+}
diff --git a/apps/web/src/app/key-management/data-recovery/steps/recovery-step.ts b/apps/web/src/app/key-management/data-recovery/steps/recovery-step.ts
new file mode 100644
index 00000000000..265d7c68284
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/recovery-step.ts
@@ -0,0 +1,43 @@
+import { WrappedPrivateKey } from "@bitwarden/common/key-management/types";
+import { UserKey } from "@bitwarden/common/types/key";
+import { Cipher } from "@bitwarden/common/vault/models/domain/cipher";
+import { Folder } from "@bitwarden/common/vault/models/domain/folder";
+import { UserId } from "@bitwarden/user-core";
+
+import { LogRecorder } from "../log-recorder";
+
+/**
+ * A recovery step performs diagnostics and recovery actions on a specific domain, such as ciphers.
+ */
+export abstract class RecoveryStep {
+  /** Title of the recovery step, as an i18n key. */
+  abstract title: string;
+
+  /**
+   * Runs diagnostics on the provided working data.
+   * Returns true if no issues were found, false otherwise.
+   */
+  abstract runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean>;
+
+  /**
+   * Returns whether recovery can be performed
+   */
+  abstract canRecover(workingData: RecoveryWorkingData): boolean;
+
+  /**
+   * Performs recovery on the provided working data.
+   */
+  abstract runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void>;
+}
+
+/**
+ * Data used during the recovery process, passed between steps.
+ */
+export type RecoveryWorkingData = {
+  userId: UserId | null;
+  userKey: UserKey | null;
+  encryptedPrivateKey: WrappedPrivateKey | null;
+  isPrivateKeyCorrupt: boolean;
+  ciphers: Cipher[];
+  folders: Folder[];
+};
diff --git a/apps/web/src/app/key-management/data-recovery/steps/sync-step.ts b/apps/web/src/app/key-management/data-recovery/steps/sync-step.ts
new file mode 100644
index 00000000000..f0adb1e0b46
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/sync-step.ts
@@ -0,0 +1,43 @@
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { CipherData } from "@bitwarden/common/vault/models/data/cipher.data";
+import { FolderData } from "@bitwarden/common/vault/models/data/folder.data";
+import { Cipher } from "@bitwarden/common/vault/models/domain/cipher";
+import { Folder } from "@bitwarden/common/vault/models/domain/folder";
+
+import { LogRecorder } from "../log-recorder";
+
+import { RecoveryStep, RecoveryWorkingData } from "./recovery-step";
+
+export class SyncStep implements RecoveryStep {
+  title = "recoveryStepSyncTitle";
+
+  constructor(private apiService: ApiService) {}
+
+  async runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean> {
+    // The intent of this step is to fetch the latest data from the server. Diagnostics does not
+    // ever run on local data but only remote data that is recent.
+    const response = await this.apiService.getSync();
+
+    workingData.ciphers = response.ciphers.map((c) => new Cipher(new CipherData(c)));
+    logger.record(`Fetched ${workingData.ciphers.length} ciphers from server`);
+
+    workingData.folders = response.folders.map((f) => new Folder(new FolderData(f)));
+    logger.record(`Fetched ${workingData.folders.length} folders from server`);
+
+    workingData.encryptedPrivateKey =
+      response.profile?.accountKeys?.publicKeyEncryptionKeyPair?.wrappedPrivateKey ?? null;
+    logger.record(
+      `Fetched encrypted private key of length ${workingData.encryptedPrivateKey?.length ?? 0} from server`,
+    );
+
+    return true;
+  }
+
+  canRecover(workingData: RecoveryWorkingData): boolean {
+    return false;
+  }
+
+  runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
+    return Promise.resolve();
+  }
+}
diff --git a/apps/web/src/app/key-management/data-recovery/steps/user-info-step.ts b/apps/web/src/app/key-management/data-recovery/steps/user-info-step.ts
new file mode 100644
index 00000000000..9565b1da73b
--- /dev/null
+++ b/apps/web/src/app/key-management/data-recovery/steps/user-info-step.ts
@@ -0,0 +1,49 @@
+import { firstValueFrom } from "rxjs";
+
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { EncryptionType } from "@bitwarden/common/platform/enums";
+import { KeyService } from "@bitwarden/key-management";
+
+import { LogRecorder } from "../log-recorder";
+
+import { RecoveryStep, RecoveryWorkingData } from "./recovery-step";
+
+export class UserInfoStep implements RecoveryStep {
+  title = "recoveryStepUserInfoTitle";
+
+  constructor(
+    private accountService: AccountService,
+    private keyService: KeyService,
+  ) {}
+
+  async runDiagnostics(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<boolean> {
+    const activeAccount = await firstValueFrom(this.accountService.activeAccount$);
+    if (!activeAccount) {
+      logger.record("No active account found");
+      return false;
+    }
+    const userId = activeAccount.id;
+    workingData.userId = userId;
+    logger.record(`User ID: ${userId}`);
+
+    const userKey = await firstValueFrom(this.keyService.userKey$(userId));
+    if (!userKey) {
+      logger.record("No user key found");
+      return false;
+    }
+    workingData.userKey = userKey;
+    logger.record(
+      `User encryption type: ${userKey.inner().type === EncryptionType.AesCbc256_HmacSha256_B64 ? "V1" : userKey.inner().type === EncryptionType.CoseEncrypt0 ? "Cose" : "Unknown"}`,
+    );
+
+    return true;
+  }
+
+  canRecover(workingData: RecoveryWorkingData): boolean {
+    return false;
+  }
+
+  runRecovery(workingData: RecoveryWorkingData, logger: LogRecorder): Promise<void> {
+    return Promise.resolve();
+  }
+}
diff --git a/apps/web/src/app/key-management/key-connector/remove-password.component.html b/apps/web/src/app/key-management/key-connector/remove-password.component.html
deleted file mode 100644
index aae660ce504..00000000000
--- a/apps/web/src/app/key-management/key-connector/remove-password.component.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<div *ngIf="loading" class="tw-text-center">
-  <i
-    class="bwi bwi-spinner bwi-spin bwi-2x tw-text-muted"
-    title="{{ 'loading' | i18n }}"
-    aria-hidden="true"
-  ></i>
-  <span class="tw-sr-only">{{ "loading" | i18n }}</span>
-</div>
-
-<div *ngIf="!loading">
-  <p>{{ "removeMasterPasswordForOrganizationUserKeyConnector" | i18n }}</p>
-  <p class="tw-mb-0">{{ "organizationName" | i18n }}:</p>
-  <p class="tw-text-muted tw-mb-6">{{ organization.name }}</p>
-  <p class="tw-mb-0">{{ "keyConnectorDomain" | i18n }}:</p>
-  <p class="tw-text-muted tw-mb-6">{{ organization.keyConnectorUrl }}</p>
-
-  <button
-    bitButton
-    type="button"
-    buttonType="primary"
-    class="tw-w-full tw-mb-2"
-    [bitAction]="convert"
-    [block]="true"
-  >
-    {{ "removeMasterPassword" | i18n }}
-  </button>
-  <button
-    bitButton
-    type="button"
-    buttonType="secondary"
-    class="tw-w-full"
-    [bitAction]="leave"
-    [block]="true"
-  >
-    {{ "leaveOrganization" | i18n }}
-  </button>
-</div>
diff --git a/apps/web/src/app/key-management/key-connector/remove-password.component.ts b/apps/web/src/app/key-management/key-connector/remove-password.component.ts
deleted file mode 100644
index d9fea9409f8..00000000000
--- a/apps/web/src/app/key-management/key-connector/remove-password.component.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { Component } from "@angular/core";
-
-import { RemovePasswordComponent as BaseRemovePasswordComponent } from "@bitwarden/key-management-ui";
-
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
-@Component({
-  selector: "app-remove-password",
-  templateUrl: "remove-password.component.html",
-  standalone: false,
-})
-export class RemovePasswordComponent extends BaseRemovePasswordComponent {}
diff --git a/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.spec.ts b/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.spec.ts
index b790fb8409a..f4b50b4a772 100644
--- a/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.spec.ts
+++ b/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.spec.ts
@@ -1096,6 +1096,9 @@ describe("KeyRotationService", () => {
       mockKeyService.userSigningKey$.mockReturnValue(
         new BehaviorSubject(TEST_VECTOR_SIGNING_KEY_V2 as WrappedSigningKey),
       );
+      mockKeyService.userSignedPublicKey$.mockReturnValue(
+        new BehaviorSubject(TEST_VECTOR_SIGNED_PUBLIC_KEY_V2 as SignedPublicKey),
+      );
       mockSecurityStateService.accountSecurityState$.mockReturnValue(
         new BehaviorSubject(TEST_VECTOR_SECURITY_STATE_V2 as SignedSecurityState),
       );
@@ -1140,6 +1143,7 @@ describe("KeyRotationService", () => {
           publicKeyEncryptionKeyPair: {
             wrappedPrivateKey: TEST_VECTOR_PRIVATE_KEY_V2,
             publicKey: Utils.fromB64ToArray(TEST_VECTOR_PUBLIC_KEY_V2) as UnsignedPublicKey,
+            signedPublicKey: TEST_VECTOR_SIGNED_PUBLIC_KEY_V2 as SignedPublicKey,
           },
           signingKey: TEST_VECTOR_SIGNING_KEY_V2 as WrappedSigningKey,
           securityState: TEST_VECTOR_SECURITY_STATE_V2 as SignedSecurityState,
diff --git a/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.ts b/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.ts
index 168dbe7442e..b9bd23b12de 100644
--- a/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.ts
+++ b/apps/web/src/app/key-management/key-rotation/user-key-rotation.service.ts
@@ -10,6 +10,7 @@ import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-st
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { SecurityStateService } from "@bitwarden/common/key-management/security-state/abstractions/security-state.service";
 import {
+  SignedPublicKey,
   SignedSecurityState,
   UnsignedPublicKey,
   WrappedPrivateKey,
@@ -308,9 +309,11 @@ export class UserKeyRotationService {
       userId: asUuid(userId),
       kdfParams: kdfConfig.toSdkConfig(),
       email: email,
-      privateKey: cryptographicStateParameters.publicKeyEncryptionKeyPair.wrappedPrivateKey,
-      signingKey: undefined,
-      securityState: undefined,
+      accountCryptographicState: {
+        V1: {
+          private_key: cryptographicStateParameters.publicKeyEncryptionKeyPair.wrappedPrivateKey,
+        },
+      },
       method: {
         decryptedKey: { decrypted_user_key: cryptographicStateParameters.userKey.toBase64() },
       },
@@ -334,9 +337,15 @@ export class UserKeyRotationService {
       userId: asUuid(userId),
       kdfParams: kdfConfig.toSdkConfig(),
       email: email,
-      privateKey: cryptographicStateParameters.publicKeyEncryptionKeyPair.wrappedPrivateKey,
-      signingKey: cryptographicStateParameters.signingKey,
-      securityState: cryptographicStateParameters.securityState,
+      accountCryptographicState: {
+        V2: {
+          private_key: cryptographicStateParameters.publicKeyEncryptionKeyPair.wrappedPrivateKey,
+          signing_key: cryptographicStateParameters.signingKey,
+          security_state: cryptographicStateParameters.securityState,
+          signed_public_key:
+            cryptographicStateParameters.publicKeyEncryptionKeyPair.signedPublicKey,
+        },
+      },
       method: {
         decryptedKey: { decrypted_user_key: cryptographicStateParameters.userKey.toBase64() },
       },
@@ -632,6 +641,10 @@ export class UserKeyRotationService {
         this.securityStateService.accountSecurityState$(user.id),
         "User security state",
       );
+      const signedPublicKey = await this.firstValueFromOrThrow(
+        this.keyService.userSignedPublicKey$(user.id),
+        "User signed public key",
+      );
 
       return {
         masterKeyKdfConfig,
@@ -642,6 +655,7 @@ export class UserKeyRotationService {
           publicKeyEncryptionKeyPair: {
             wrappedPrivateKey: currentUserKeyWrappedPrivateKey,
             publicKey: publicKey,
+            signedPublicKey: signedPublicKey!,
           },
           signingKey: signingKey!,
           securityState: securityState!,
@@ -679,6 +693,7 @@ export type V2CryptographicStateParameters = {
   publicKeyEncryptionKeyPair: {
     wrappedPrivateKey: WrappedPrivateKey;
     publicKey: UnsignedPublicKey;
+    signedPublicKey: SignedPublicKey;
   };
   signingKey: WrappedSigningKey;
   securityState: SignedSecurityState;
diff --git a/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-settings-component.service.ts b/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-settings-component.service.ts
deleted file mode 100644
index 61836c98252..00000000000
--- a/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-settings-component.service.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { defer, Observable, of } from "rxjs";
-
-import {
-  VaultTimeout,
-  VaultTimeoutOption,
-  VaultTimeoutStringType,
-} from "@bitwarden/common/key-management/vault-timeout";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { SessionTimeoutSettingsComponentService } from "@bitwarden/key-management-ui";
-
-export class WebSessionTimeoutSettingsComponentService
-  implements SessionTimeoutSettingsComponentService
-{
-  availableTimeoutOptions$: Observable<VaultTimeoutOption[]> = defer(() => {
-    const options: VaultTimeoutOption[] = [
-      { name: this.i18nService.t("oneMinute"), value: 1 },
-      { name: this.i18nService.t("fiveMinutes"), value: 5 },
-      { name: this.i18nService.t("fifteenMinutes"), value: 15 },
-      { name: this.i18nService.t("thirtyMinutes"), value: 30 },
-      { name: this.i18nService.t("oneHour"), value: 60 },
-      { name: this.i18nService.t("fourHours"), value: 240 },
-      { name: this.i18nService.t("onRefresh"), value: VaultTimeoutStringType.OnRestart },
-    ];
-
-    if (this.platformUtilsService.isDev()) {
-      options.push({ name: this.i18nService.t("never"), value: VaultTimeoutStringType.Never });
-    }
-
-    return of(options);
-  });
-
-  constructor(
-    private readonly i18nService: I18nService,
-    private readonly platformUtilsService: PlatformUtilsService,
-  ) {}
-
-  onTimeoutSave(_: VaultTimeout): void {}
-}
diff --git a/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.spec.ts b/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.spec.ts
new file mode 100644
index 00000000000..40eb3e77d43
--- /dev/null
+++ b/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.spec.ts
@@ -0,0 +1,115 @@
+import { mock } from "jest-mock-extended";
+
+import {
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+
+import { WebSessionTimeoutTypeService } from "./web-session-timeout-type.service";
+
+describe("WebSessionTimeoutTypeService", () => {
+  let service: WebSessionTimeoutTypeService;
+  let mockPlatformUtilsService: jest.Mocked<PlatformUtilsService>;
+
+  beforeEach(() => {
+    mockPlatformUtilsService = mock<PlatformUtilsService>();
+    service = new WebSessionTimeoutTypeService(mockPlatformUtilsService);
+  });
+
+  describe("isAvailable", () => {
+    it("should return false for Immediately", async () => {
+      const result = await service.isAvailable(VaultTimeoutNumberType.Immediately);
+
+      expect(result).toBe(false);
+    });
+
+    it.each([VaultTimeoutStringType.OnRestart, VaultTimeoutStringType.Custom])(
+      "should return true for always available type: %s",
+      async (timeoutType) => {
+        const result = await service.isAvailable(timeoutType);
+
+        expect(result).toBe(true);
+      },
+    );
+
+    it.each([VaultTimeoutNumberType.OnMinute, VaultTimeoutNumberType.EightHours])(
+      "should return true for numeric timeout type: %s",
+      async (timeoutType) => {
+        const result = await service.isAvailable(timeoutType);
+
+        expect(result).toBe(true);
+      },
+    );
+
+    it.each([
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnLocked,
+    ])("should return false for unavailable timeout type: %s", async (timeoutType) => {
+      const result = await service.isAvailable(timeoutType);
+
+      expect(result).toBe(false);
+    });
+
+    describe("Never availability", () => {
+      it("should return true when in dev mode", async () => {
+        mockPlatformUtilsService.isDev.mockReturnValue(true);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.Never);
+
+        expect(result).toBe(true);
+        expect(mockPlatformUtilsService.isDev).toHaveBeenCalled();
+      });
+
+      it("should return false when not in dev mode", async () => {
+        mockPlatformUtilsService.isDev.mockReturnValue(false);
+
+        const result = await service.isAvailable(VaultTimeoutStringType.Never);
+
+        expect(result).toBe(false);
+        expect(mockPlatformUtilsService.isDev).toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe("getOrPromoteToAvailable", () => {
+    it.each([
+      VaultTimeoutNumberType.OnMinute,
+      VaultTimeoutNumberType.EightHours,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.Never,
+      VaultTimeoutStringType.Custom,
+    ])("should return the original type when it is available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(true);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(timeoutType);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+
+    it("should return OnMinute when Immediately is not available", async () => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(VaultTimeoutNumberType.Immediately);
+
+      expect(result).toBe(VaultTimeoutNumberType.OnMinute);
+      expect(service.isAvailable).toHaveBeenCalledWith(VaultTimeoutNumberType.Immediately);
+    });
+
+    it.each([
+      VaultTimeoutStringType.OnIdle,
+      VaultTimeoutStringType.OnSleep,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.Never,
+    ])("should return OnRestart when type is not available: %s", async (timeoutType) => {
+      jest.spyOn(service, "isAvailable").mockResolvedValue(false);
+
+      const result = await service.getOrPromoteToAvailable(timeoutType);
+
+      expect(result).toBe(VaultTimeoutStringType.OnRestart);
+      expect(service.isAvailable).toHaveBeenCalledWith(timeoutType);
+    });
+  });
+});
diff --git a/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.ts b/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.ts
new file mode 100644
index 00000000000..458befc29a7
--- /dev/null
+++ b/apps/web/src/app/key-management/session-timeout/services/web-session-timeout-type.service.ts
@@ -0,0 +1,44 @@
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
+import {
+  isVaultTimeoutTypeNumeric,
+  VaultTimeout,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+
+export class WebSessionTimeoutTypeService implements SessionTimeoutTypeService {
+  constructor(private readonly platformUtilsService: PlatformUtilsService) {}
+
+  async isAvailable(type: VaultTimeout): Promise<boolean> {
+    switch (type) {
+      case VaultTimeoutNumberType.Immediately:
+        return false;
+      case VaultTimeoutStringType.OnRestart:
+      case VaultTimeoutStringType.Custom:
+        return true;
+      case VaultTimeoutStringType.Never:
+        return this.platformUtilsService.isDev();
+      default:
+        if (isVaultTimeoutTypeNumeric(type)) {
+          return true;
+        }
+        break;
+    }
+
+    return false;
+  }
+
+  async getOrPromoteToAvailable(type: VaultTimeout): Promise<VaultTimeout> {
+    const available = await this.isAvailable(type);
+    if (!available) {
+      switch (type) {
+        case VaultTimeoutNumberType.Immediately:
+          return VaultTimeoutNumberType.OnMinute;
+        default:
+          return VaultTimeoutStringType.OnRestart;
+      }
+    }
+    return type;
+  }
+}
diff --git a/apps/web/src/app/oss-routing.module.ts b/apps/web/src/app/oss-routing.module.ts
index b40b9143991..e3c9da635f9 100644
--- a/apps/web/src/app/oss-routing.module.ts
+++ b/apps/web/src/app/oss-routing.module.ts
@@ -51,7 +51,7 @@ import {
 import { canAccessEmergencyAccess } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { AnonLayoutWrapperComponent, AnonLayoutWrapperData } from "@bitwarden/components";
-import { LockComponent } from "@bitwarden/key-management-ui";
+import { LockComponent, RemovePasswordComponent } from "@bitwarden/key-management-ui";
 import { premiumInterestRedirectGuard } from "@bitwarden/web-vault/app/vault/guards/premium-interest-redirect/premium-interest-redirect.guard";
 
 import { flagEnabled, Flags } from "../utils/flags";
@@ -78,8 +78,8 @@ import { freeTrialTextResolver } from "./billing/trial-initiation/complete-trial
 import { EnvironmentSelectorComponent } from "./components/environment-selector/environment-selector.component";
 import { RouteDataProperties } from "./core";
 import { ReportsModule } from "./dirt/reports";
+import { DataRecoveryComponent } from "./key-management/data-recovery/data-recovery.component";
 import { ConfirmKeyConnectorDomainComponent } from "./key-management/key-connector/confirm-key-connector-domain.component";
-import { RemovePasswordComponent } from "./key-management/key-connector/remove-password.component";
 import { FrontendLayoutComponent } from "./layouts/frontend-layout.component";
 import { UserLayoutComponent } from "./layouts/user-layout.component";
 import { RequestSMAccessComponent } from "./secrets-manager/secrets-manager-landing/request-sm-access.component";
@@ -544,9 +544,9 @@ const routes: Routes = [
         canActivate: [authGuard],
         data: {
           pageTitle: {
-            key: "removeMasterPassword",
+            key: "verifyYourOrganization",
           },
-          titleId: "removeMasterPassword",
+          titleId: "verifyYourOrganization",
           pageIcon: LockIcon,
         } satisfies RouteDataProperties & AnonLayoutWrapperData,
       },
@@ -556,9 +556,9 @@ const routes: Routes = [
         canActivate: [],
         data: {
           pageTitle: {
-            key: "confirmKeyConnectorDomain",
+            key: "verifyYourOrganization",
           },
-          titleId: "confirmKeyConnectorDomain",
+          titleId: "verifyYourOrganization",
           pageIcon: DomainIcon,
         } satisfies RouteDataProperties & AnonLayoutWrapperData,
       },
@@ -696,6 +696,12 @@ const routes: Routes = [
             path: "security",
             loadChildren: () => SecurityRoutingModule,
           },
+          {
+            path: "data-recovery",
+            component: DataRecoveryComponent,
+            canActivate: [canAccessFeature(FeatureFlag.DataRecoveryTool)],
+            data: { titleId: "dataRecovery" } satisfies RouteDataProperties,
+          },
           {
             path: "domain-rules",
             component: DomainRulesComponent,
diff --git a/apps/web/src/app/settings/preferences.component.html b/apps/web/src/app/settings/preferences.component.html
index a2e90dd5889..cdcb8973602 100644
--- a/apps/web/src/app/settings/preferences.component.html
+++ b/apps/web/src/app/settings/preferences.component.html
@@ -17,12 +17,12 @@
         {{ "vaultTimeoutActionPolicyInEffect" | i18n: (policy.action | i18n) }}
       </span>
     </bit-callout>
-    <bit-session-timeout-input
+    <bit-session-timeout-input-legacy
       [vaultTimeoutOptions]="vaultTimeoutOptions"
       [formControl]="form.controls.vaultTimeout"
       ngDefaultControl
     >
-    </bit-session-timeout-input>
+    </bit-session-timeout-input-legacy>
     <ng-container *ngIf="availableVaultTimeoutActions$ | async as availableVaultTimeoutActions">
       <bit-radio-group
         formControlName="vaultTimeoutAction"
diff --git a/apps/web/src/app/settings/preferences.component.ts b/apps/web/src/app/settings/preferences.component.ts
index 4b63e346ea8..03540232e02 100644
--- a/apps/web/src/app/settings/preferences.component.ts
+++ b/apps/web/src/app/settings/preferences.component.ts
@@ -33,7 +33,7 @@ import { Theme, ThemeTypes } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { ThemeStateService } from "@bitwarden/common/platform/theming/theme-state.service";
 import { DialogService } from "@bitwarden/components";
-import { SessionTimeoutInputComponent } from "@bitwarden/key-management-ui";
+import { SessionTimeoutInputLegacyComponent } from "@bitwarden/key-management-ui";
 import { PermitCipherDetailsPopoverComponent } from "@bitwarden/vault";
 
 import { HeaderModule } from "../layouts/header/header.module";
@@ -52,8 +52,8 @@ import { SharedModule } from "../shared";
   imports: [
     SharedModule,
     HeaderModule,
-    SessionTimeoutInputComponent,
     PermitCipherDetailsPopoverComponent,
+    SessionTimeoutInputLegacyComponent,
   ],
 })
 export class PreferencesComponent implements OnInit, OnDestroy {
diff --git a/apps/web/src/app/shared/loose-components.module.ts b/apps/web/src/app/shared/loose-components.module.ts
index 0fff13f428c..f096ef6a292 100644
--- a/apps/web/src/app/shared/loose-components.module.ts
+++ b/apps/web/src/app/shared/loose-components.module.ts
@@ -7,7 +7,6 @@ import { VerifyRecoverDeleteComponent } from "../auth/verify-recover-delete.comp
 import { FreeBitwardenFamiliesComponent } from "../billing/members/free-bitwarden-families.component";
 import { SponsoredFamiliesComponent } from "../billing/settings/sponsored-families.component";
 import { SponsoringOrgRowComponent } from "../billing/settings/sponsoring-org-row.component";
-import { RemovePasswordComponent } from "../key-management/key-connector/remove-password.component";
 import { HeaderModule } from "../layouts/header/header.module";
 import { OrganizationBadgeModule } from "../vault/individual-vault/organization-badge/organization-badge.module";
 import { PipesModule } from "../vault/individual-vault/pipes/pipes.module";
@@ -21,7 +20,6 @@ import { SharedModule } from "./shared.module";
   declarations: [
     RecoverDeleteComponent,
     RecoverTwoFactorComponent,
-    RemovePasswordComponent,
     SponsoredFamiliesComponent,
     FreeBitwardenFamiliesComponent,
     SponsoringOrgRowComponent,
@@ -31,7 +29,6 @@ import { SharedModule } from "./shared.module";
   exports: [
     RecoverDeleteComponent,
     RecoverTwoFactorComponent,
-    RemovePasswordComponent,
     SponsoredFamiliesComponent,
     VerifyEmailTokenComponent,
     VerifyRecoverDeleteComponent,
diff --git a/apps/web/src/app/tools/send/send-access/send-access-file.component.html b/apps/web/src/app/tools/send/send-access/send-access-file.component.html
index 82880407809..8cbe6a975ef 100644
--- a/apps/web/src/app/tools/send/send-access/send-access-file.component.html
+++ b/apps/web/src/app/tools/send/send-access/send-access-file.component.html
@@ -1,4 +1,4 @@
-<p>{{ send.file.fileName }}</p>
+<p class="tw-text-wrap tw-break-all">{{ send.file.fileName }}</p>
 <button bitButton type="button" buttonType="primary" [bitAction]="download" [block]="true">
   <i class="bwi bwi-download" aria-hidden="true"></i>
   {{ "downloadAttachments" | i18n }} ({{ send.file.sizeName }})
diff --git a/apps/web/src/app/tools/send/send.component.html b/apps/web/src/app/tools/send/send.component.html
index b8538606aec..e593f5c1176 100644
--- a/apps/web/src/app/tools/send/send.component.html
+++ b/apps/web/src/app/tools/send/send.component.html
@@ -80,13 +80,15 @@
       </div>
     </div>
   </div>
-  <div class="tw-col-span-9">
+  <div class="tw-col-span-9 tw-@container/send-table">
     <!--Listing Table-->
     <bit-table [dataSource]="dataSource" *ngIf="filteredSends && filteredSends.length">
       <ng-container header>
         <tr>
           <th bitCell bitSortable="name" default>{{ "name" | i18n }}</th>
-          <th bitCell bitSortable="deletionDate">{{ "deletionDate" | i18n }}</th>
+          <th bitCell bitSortable="deletionDate" class="@lg/send-table:tw-table-cell tw-hidden">
+            {{ "deletionDate" | i18n }}
+          </th>
           <th bitCell>{{ "options" | i18n }}</th>
         </tr>
       </ng-container>
@@ -148,8 +150,14 @@
               </ng-container>
             </div>
           </td>
-          <td bitCell class="tw-text-muted" (click)="editSend(s)" class="tw-cursor-pointer">
-            <small bitTypography="body2" appStopProp>{{ s.deletionDate | date: "medium" }}</small>
+          <td
+            bitCell
+            (click)="editSend(s)"
+            class="tw-text-muted tw-cursor-pointer @lg/send-table:tw-table-cell tw-hidden"
+          >
+            <small bitTypography="body2" appStopProp>
+              {{ s.deletionDate | date: "medium" }}
+            </small>
           </td>
           <td bitCell class="tw-w-0 tw-text-right">
             <button
diff --git a/apps/web/src/app/vault/components/setup-extension/setup-extension.component.html b/apps/web/src/app/vault/components/setup-extension/setup-extension.component.html
index a4b21915620..1976321b4ee 100644
--- a/apps/web/src/app/vault/components/setup-extension/setup-extension.component.html
+++ b/apps/web/src/app/vault/components/setup-extension/setup-extension.component.html
@@ -2,7 +2,7 @@
   *ngIf="state === SetupExtensionState.Loading"
   class="bwi bwi-spinner bwi-spin bwi-3x tw-text-muted"
   aria-hidden="true"
-  [title]="'loading' | i18n"
+  [appA11yTitle]="'loading' | i18n"
 ></i>
 
 <section *ngIf="state === SetupExtensionState.NeedsExtension" class="tw-text-center tw-mt-4">
diff --git a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html
index c8732154ef4..d56c9d15cff 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html
+++ b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html
@@ -203,10 +203,22 @@
         {{ "eventLogs" | i18n }}
       </button>
       @if (showArchiveButton) {
-        <button bitMenuItem (click)="archive()" type="button">
-          <i class="bwi bwi-fw bwi-archive" aria-hidden="true"></i>
-          {{ "archiveVerb" | i18n }}
-        </button>
+        @if (userCanArchive) {
+          <button bitMenuItem (click)="archive()" type="button">
+            <i class="bwi bwi-fw bwi-archive" aria-hidden="true"></i>
+            {{ "archiveVerb" | i18n }}
+          </button>
+        }
+        @if (!userCanArchive) {
+          <button bitMenuItem (click)="badge.promptForPremium($event)" type="button">
+            <i class="bwi bwi-fw bwi-archive" aria-hidden="true"></i>
+            {{ "archiveVerb" | i18n }}
+            <!-- Hide app-premium badge from accessibility tools as it results in a button within a button -->
+            <div slot="end" class="-tw-mt-0.5" aria-hidden>
+              <app-premium-badge #badge></app-premium-badge>
+            </div>
+          </button>
+        }
       }
 
       @if (showUnArchiveButton) {
diff --git a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.spec.ts b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.spec.ts
index d5f7b54f37a..9378ee54e51 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.spec.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.spec.ts
@@ -72,6 +72,7 @@ describe("VaultCipherRowComponent", () => {
 
     fixture = TestBed.createComponent(VaultCipherRowComponent);
     component = fixture.componentInstance;
+    fixture.componentRef.setInput("archiveEnabled", false);
     overlayContainer = TestBed.inject(OverlayContainer);
   });
 
diff --git a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.ts b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.ts
index 4ea062db8d1..92c49ac218a 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.ts
@@ -8,6 +8,7 @@ import {
   OnInit,
   Output,
   ViewChild,
+  input,
 } from "@angular/core";
 
 import { CollectionView } from "@bitwarden/admin-console/common";
@@ -101,8 +102,10 @@ export class VaultCipherRowComponent<C extends CipherViewLike> implements OnInit
   // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
   // eslint-disable-next-line @angular-eslint/prefer-signals
   @Input() userCanArchive: boolean;
+  /** Archive feature is enabled */
+  readonly archiveEnabled = input.required<boolean>();
   /**
-   * Enforge Org Data Ownership Policy Status
+   * Enforce Org Data Ownership Policy Status
    */
   // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
   // eslint-disable-next-line @angular-eslint/prefer-signals
@@ -142,16 +145,21 @@ export class VaultCipherRowComponent<C extends CipherViewLike> implements OnInit
   }
 
   protected get showArchiveButton() {
+    if (!this.archiveEnabled()) {
+      return false;
+    }
+
     return (
-      this.userCanArchive &&
-      !CipherViewLikeUtils.isArchived(this.cipher) &&
-      !CipherViewLikeUtils.isDeleted(this.cipher) &&
-      !this.cipher.organizationId
+      !CipherViewLikeUtils.isArchived(this.cipher) && !CipherViewLikeUtils.isDeleted(this.cipher)
     );
   }
 
   // If item is archived always show unarchive button, even if user is not premium
   protected get showUnArchiveButton() {
+    if (!this.archiveEnabled()) {
+      return false;
+    }
+
     return CipherViewLikeUtils.isArchived(this.cipher);
   }
 
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.component.html b/apps/web/src/app/vault/components/vault-items/vault-items.component.html
index cb2af9a64e5..70c44e80a39 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.component.html
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.component.html
@@ -179,6 +179,7 @@
           (onEvent)="event($event)"
           [userCanArchive]="userCanArchive"
           [enforceOrgDataOwnershipPolicy]="enforceOrgDataOwnershipPolicy"
+          [archiveEnabled]="archiveFeatureEnabled$ | async"
         ></tr>
       </ng-container>
     </ng-template>
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.component.spec.ts b/apps/web/src/app/vault/components/vault-items/vault-items.component.spec.ts
index 902fc2eb5a2..1eccb4c49ce 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.component.spec.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.component.spec.ts
@@ -4,6 +4,7 @@ import { of } from "rxjs";
 
 import { CollectionView } from "@bitwarden/admin-console/common";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { CipherArchiveService } from "@bitwarden/common/vault/abstractions/cipher-archive.service";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { CipherAuthorizationService } from "@bitwarden/common/vault/services/cipher-authorization.service";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
@@ -54,6 +55,12 @@ describe("VaultItemsComponent", () => {
             t: (key: string) => key,
           },
         },
+        {
+          provide: CipherArchiveService,
+          useValue: {
+            hasArchiveFlagEnabled$: of(true),
+          },
+        },
       ],
     });
 
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.component.ts b/apps/web/src/app/vault/components/vault-items/vault-items.component.ts
index 3ab643927f1..a935314eb3a 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.component.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.component.ts
@@ -7,6 +7,7 @@ import { Observable, combineLatest, map, of, startWith, switchMap } from "rxjs";
 
 import { CollectionView, Unassigned, CollectionAdminView } from "@bitwarden/admin-console/common";
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { CipherArchiveService } from "@bitwarden/common/vault/abstractions/cipher-archive.service";
 import { CipherAuthorizationService } from "@bitwarden/common/vault/services/cipher-authorization.service";
 import {
   RestrictedCipherType,
@@ -145,9 +146,12 @@ export class VaultItemsComponent<C extends CipherViewLike> {
   protected disableMenu$: Observable<boolean>;
   private restrictedTypes: RestrictedCipherType[] = [];
 
+  protected archiveFeatureEnabled$ = this.cipherArchiveService.hasArchiveFlagEnabled$;
+
   constructor(
     protected cipherAuthorizationService: CipherAuthorizationService,
     protected restrictedItemTypesService: RestrictedItemTypesService,
+    protected cipherArchiveService: CipherArchiveService,
   ) {
     this.canDeleteSelected$ = this.selection.changed.pipe(
       startWith(null),
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.module.ts b/apps/web/src/app/vault/components/vault-items/vault-items.module.ts
index a3a92559878..a7c264114b9 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.module.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.module.ts
@@ -3,6 +3,7 @@ import { CommonModule } from "@angular/common";
 import { NgModule } from "@angular/core";
 import { RouterModule } from "@angular/router";
 
+import { PremiumBadgeComponent } from "@bitwarden/angular/billing/components/premium-badge";
 import { ScrollLayoutDirective, TableModule } from "@bitwarden/components";
 import { CopyCipherFieldDirective } from "@bitwarden/vault";
 
@@ -29,6 +30,7 @@ import { VaultItemsComponent } from "./vault-items.component";
     PipesModule,
     CopyCipherFieldDirective,
     ScrollLayoutDirective,
+    PremiumBadgeComponent,
   ],
   declarations: [VaultItemsComponent, VaultCipherRowComponent, VaultCollectionRowComponent],
   exports: [VaultItemsComponent],
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts b/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts
index 043ae900b40..d973fbcbbc7 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.stories.ts
@@ -30,6 +30,7 @@ import {
 import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+import { CipherArchiveService } from "@bitwarden/common/vault/abstractions/cipher-archive.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
 import { AttachmentView } from "@bitwarden/common/vault/models/view/attachment.view";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
@@ -143,6 +144,12 @@ export default {
             isCipherRestricted: () => false, // No restrictions for this story
           },
         },
+        {
+          provide: CipherArchiveService,
+          useValue: {
+            hasArchiveFlagEnabled$: of(true),
+          },
+        },
       ],
     }),
     applicationConfig({
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
index 82f71e50ce6..234b227c76f 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
@@ -19,8 +19,10 @@ import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstractions/billing-api.service.abstraction";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { UserId } from "@bitwarden/common/types/guid";
 import { CipherArchiveService } from "@bitwarden/common/vault/abstractions/cipher-archive.service";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { PremiumUpgradePromptService } from "@bitwarden/common/vault/abstractions/premium-upgrade-prompt.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { RestrictedItemTypesService } from "@bitwarden/common/vault/services/restricted-item-types.service";
@@ -167,6 +169,7 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
     protected restrictedItemTypesService: RestrictedItemTypesService,
     protected cipherService: CipherService,
     protected cipherArchiveService: CipherArchiveService,
+    private premiumUpgradePromptService: PremiumUpgradePromptService,
   ) {}
 
   async ngOnInit(): Promise<void> {
@@ -249,14 +252,20 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
   };
 
   async buildAllFilters(): Promise<VaultFilterList> {
-    const hasArchiveFlag = await firstValueFrom(this.cipherArchiveService.hasArchiveFlagEnabled$());
+    const [userId, showArchive] = await firstValueFrom(
+      combineLatest([
+        this.accountService.activeAccount$.pipe(getUserId),
+        this.cipherArchiveService.hasArchiveFlagEnabled$,
+      ]),
+    );
+
     const builderFilter = {} as VaultFilterList;
     builderFilter.organizationFilter = await this.addOrganizationFilter();
     builderFilter.typeFilter = await this.addTypeFilter();
     builderFilter.folderFilter = await this.addFolderFilter();
     builderFilter.collectionFilter = await this.addCollectionFilter();
-    if (hasArchiveFlag) {
-      builderFilter.archiveFilter = await this.addArchiveFilter();
+    if (showArchive) {
+      builderFilter.archiveFilter = await this.addArchiveFilter(userId);
     }
     builderFilter.trashFilter = await this.addTrashFilter();
     return builderFilter;
@@ -416,7 +425,18 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
     return trashFilterSection;
   }
 
-  protected async addArchiveFilter(): Promise<VaultFilterSection> {
+  protected async addArchiveFilter(userId: UserId): Promise<VaultFilterSection> {
+    const [hasArchivedCiphers, userHasPremium] = await firstValueFrom(
+      combineLatest([
+        this.cipherArchiveService
+          .archivedCiphers$(userId)
+          .pipe(map((archivedCiphers) => archivedCiphers.length > 0)),
+        this.cipherArchiveService.userHasPremium$(userId),
+      ]),
+    );
+
+    const promptForPremiumOnFilter = !userHasPremium && !hasArchivedCiphers;
+
     const archiveFilterSection: VaultFilterSection = {
       data$: this.vaultFilterService.buildTypeTree(
         {
@@ -439,6 +459,12 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
         isSelectable: true,
       },
       action: this.applyTypeFilter as (filterNode: TreeNode<VaultFilterType>) => Promise<void>,
+      premiumOptions: {
+        showBadgeForNonPremium: true,
+        blockFilterAction: promptForPremiumOnFilter
+          ? async () => await this.premiumUpgradePromptService.promptForPremium()
+          : undefined,
+      },
     };
     return archiveFilterSection;
   }
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.html b/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.html
index f7078d2a67a..66f14dcf2f6 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.html
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.html
@@ -105,6 +105,9 @@
                 *ngComponentOutlet="optionsInfo.component; injector: createInjector(f.node)"
               ></ng-container>
             </ng-container>
+            <ng-container *ngIf="premiumFeature">
+              <app-premium-badge></app-premium-badge>
+            </ng-container>
           </span>
         </span>
         <ul
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.ts b/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.ts
index 6ea2ad469b1..6443e143980 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/shared/components/vault-filter-section.component.ts
@@ -98,6 +98,11 @@ export class VaultFilterSectionComponent implements OnInit, OnDestroy {
   }
 
   async onFilterSelect(filterNode: TreeNode<VaultFilterType>) {
+    if (this.section?.premiumOptions?.blockFilterAction) {
+      await this.section.premiumOptions.blockFilterAction();
+      return;
+    }
+
     await this.section?.action(filterNode);
   }
 
@@ -125,6 +130,10 @@ export class VaultFilterSectionComponent implements OnInit, OnDestroy {
     return this.section?.options;
   }
 
+  get premiumFeature() {
+    return this.section?.premiumOptions?.showBadgeForNonPremium;
+  }
+
   get divider() {
     return this.section?.divider;
   }
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/shared/vault-filter-shared.module.ts b/apps/web/src/app/vault/individual-vault/vault-filter/shared/vault-filter-shared.module.ts
index c8becac8ef5..190ace6db63 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/shared/vault-filter-shared.module.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/shared/vault-filter-shared.module.ts
@@ -1,5 +1,6 @@
 import { NgModule } from "@angular/core";
 
+import { PremiumBadgeComponent } from "@bitwarden/angular/billing/components/premium-badge";
 import { SearchModule } from "@bitwarden/components";
 
 import { SharedModule } from "../../../../shared";
@@ -7,7 +8,7 @@ import { SharedModule } from "../../../../shared";
 import { VaultFilterSectionComponent } from "./components/vault-filter-section.component";
 
 @NgModule({
-  imports: [SharedModule, SearchModule],
+  imports: [SharedModule, SearchModule, PremiumBadgeComponent],
   declarations: [VaultFilterSectionComponent],
   exports: [SharedModule, VaultFilterSectionComponent, SearchModule],
 })
diff --git a/apps/web/src/app/vault/individual-vault/vault.component.html b/apps/web/src/app/vault/individual-vault/vault.component.html
index 711a34413b5..522b63c21fd 100644
--- a/apps/web/src/app/vault/individual-vault/vault.component.html
+++ b/apps/web/src/app/vault/individual-vault/vault.component.html
@@ -34,6 +34,16 @@
     <bit-callout type="warning" *ngIf="activeFilter.isDeleted">
       {{ trashCleanupWarning }}
     </bit-callout>
+    <bit-callout
+      type="info"
+      [title]="'premiumSubscriptionEnded' | i18n"
+      *ngIf="showSubscriptionEndedMessaging$ | async"
+    >
+      <p>{{ "premiumSubscriptionEndedDesc" | i18n }}</p>
+      <a routerLink="/settings/subscription/premium" bitButton buttonType="primary">{{
+        "restartPremium" | i18n
+      }}</a>
+    </bit-callout>
     <app-vault-items
       #vaultItems
       [ciphers]="ciphers"
diff --git a/apps/web/src/app/vault/individual-vault/vault.component.ts b/apps/web/src/app/vault/individual-vault/vault.component.ts
index 8122e96eb64..d7cfb2e3bfa 100644
--- a/apps/web/src/app/vault/individual-vault/vault.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault.component.ts
@@ -110,6 +110,8 @@ import {
   VaultFilter,
   FolderFilter,
   OrganizationFilter,
+  VaultItemsTransferService,
+  DefaultVaultItemsTransferService,
 } from "@bitwarden/vault";
 import { UnifiedUpgradePromptService } from "@bitwarden/web-vault/app/billing/individual/upgrade/services";
 import { OrganizationWarningsModule } from "@bitwarden/web-vault/app/billing/organizations/warnings/organization-warnings.module";
@@ -181,6 +183,7 @@ type EmptyStateMap = Record<EmptyStateType, EmptyStateItem>;
     RoutedVaultFilterService,
     RoutedVaultFilterBridgeService,
     DefaultCipherFormConfigService,
+    { provide: VaultItemsTransferService, useClass: DefaultVaultItemsTransferService },
   ],
 })
 export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestroy {
@@ -229,13 +232,6 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
     .pipe(map((a) => a?.id))
     .pipe(switchMap((id) => this.organizationService.organizations$(id)));
 
-  protected userCanArchive$ = this.accountService.activeAccount$.pipe(
-    getUserId,
-    switchMap((userId) => {
-      return this.cipherArchiveService.userCanArchive$(userId);
-    }),
-  );
-
   emptyState$ = combineLatest([
     this.currentSearchText$,
     this.routedVaultFilterService.filter$,
@@ -294,14 +290,28 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
     }),
   );
 
-  protected enforceOrgDataOwnershipPolicy$ = this.accountService.activeAccount$.pipe(
-    getUserId,
+  private userId$ = this.accountService.activeAccount$.pipe(getUserId);
+
+  protected enforceOrgDataOwnershipPolicy$ = this.userId$.pipe(
     switchMap((userId) =>
       this.policyService.policyAppliesToUser$(PolicyType.OrganizationDataOwnership, userId),
     ),
   );
 
-  private userId$ = this.accountService.activeAccount$.pipe(getUserId);
+  protected userCanArchive$ = this.userId$.pipe(
+    switchMap((userId) => {
+      return this.cipherArchiveService.userCanArchive$(userId);
+    }),
+  );
+
+  protected showSubscriptionEndedMessaging$ = this.userId$.pipe(
+    switchMap((userId) =>
+      combineLatest([
+        this.routedVaultFilterBridgeService.activeFilter$,
+        this.cipherArchiveService.showSubscriptionEndedMessaging$(userId),
+      ]).pipe(map(([activeFilter, showMessaging]) => activeFilter.isArchived && showMessaging)),
+    ),
+  );
 
   constructor(
     private syncService: SyncService,
@@ -340,6 +350,7 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
     private premiumUpgradePromptService: PremiumUpgradePromptService,
     private autoConfirmService: AutomaticUserConfirmationService,
     private configService: ConfigService,
+    private vaultItemTransferService: VaultItemsTransferService,
   ) {}
 
   async ngOnInit() {
@@ -437,13 +448,13 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
       allowedCiphers$,
       filter$,
       this.currentSearchText$,
-      this.cipherArchiveService.hasArchiveFlagEnabled$(),
+      this.cipherArchiveService.hasArchiveFlagEnabled$,
     ]).pipe(
       filter(([ciphers, filter]) => ciphers != undefined && filter != undefined),
-      concatMap(async ([ciphers, filter, searchText, archiveEnabled]) => {
+      concatMap(async ([ciphers, filter, searchText, showArchiveVault]) => {
         const failedCiphers =
           (await firstValueFrom(this.cipherService.failedToDecryptCiphers$(activeUserId))) ?? [];
-        const filterFunction = createFilterFunction(filter, archiveEnabled);
+        const filterFunction = createFilterFunction(filter, showArchiveVault);
         // Append any failed to decrypt ciphers to the top of the cipher list
         const allCiphers = [...failedCiphers, ...ciphers];
 
@@ -635,6 +646,8 @@ export class VaultComponent<C extends CipherViewLike> implements OnInit, OnDestr
     void this.unifiedUpgradePromptService.displayUpgradePromptConditionally();
 
     this.setupAutoConfirm();
+
+    void this.vaultItemTransferService.enforceOrganizationDataOwnership(activeUserId);
   }
 
   ngOnDestroy() {
diff --git a/apps/web/src/locales/af/messages.json b/apps/web/src/locales/af/messages.json
index 0fc3ebe06d9..923e65fbf99 100644
--- a/apps/web/src/locales/af/messages.json
+++ b/apps/web/src/locales/af/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GG geënkripteerde berging vir lêeraanhegsels."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Bykomende berging (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Leer meer"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ar/messages.json b/apps/web/src/locales/ar/messages.json
index acd669d462e..4999534a5f6 100644
--- a/apps/web/src/locales/ar/messages.json
+++ b/apps/web/src/locales/ar/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "تخزين إضافي (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "معرفة المزيد"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/az/messages.json b/apps/web/src/locales/az/messages.json
index 9fa7411f199..409d2a4edde 100644
--- a/apps/web/src/locales/az/messages.json
+++ b/apps/web/src/locales/az/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "Fayl qoşmaları üçün 1 GB şifrələnmiş saxlama sahəsi."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey və Duo kimi mülkiyyətçi iki addımlı giriş seçimləri."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Əlavə saxlama sahəsi (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Daha ətraflı"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Güncəlləmə ayarları"
+  },
   "deleteRecoverDesc": {
     "message": "Hesabınızı geri qaytarmaq və silmək üçün e-poçtunuzu aşağıda daxil edin."
   },
@@ -11668,7 +11704,7 @@
     "message": "Bitwarden uzantısı quraşdırıldı!"
   },
   "bitwardenExtensionIsInstalled": {
-    "message": "Bitwarden extension is installed!"
+    "message": "Bitwarden uzantısı quraşdırıldı!"
   },
   "openExtensionToAutofill": {
     "message": "Giriş etmək üçün uzantını aç və avto-doldurmağa başla."
@@ -11685,11 +11721,11 @@
     "description": "This will be displayed as part of a larger sentence. The whole sentence reads: 'For tips on getting started with Bitwarden visit the Learning Center and Help Center'"
   },
   "openExtensionFromToolbarPart1": {
-    "message": "If the extension didn't open, you may need to open Bitwarden from the icon ",
+    "message": "Uzantı açılmasa, alət çubuğundakı ikondan Bitwarden-i açmağınız ",
     "description": "This will be used as part of a larger sentence, broken up to include the Bitwarden icon. The full sentence will read 'If the extension didn't open, you may need to open Bitwarden from the icon [Bitwarden Icon] on the toolbar.'"
   },
   "openExtensionFromToolbarPart2": {
-    "message": " on the toolbar.",
+    "message": " lazımdır.",
     "description": "This will be used as part of a larger sentence, broken up to include the Bitwarden icon. The full sentence will read 'If the extension didn't open, you may need to open Bitwarden from the icon [Bitwarden Icon] on the toolbar.'"
   },
   "gettingStartedWithBitwardenPart3": {
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Şifrələmə ayarlarınızı güncəlləyin"
   },
-  "updateSettings": {
-    "message": "Güncəlləmə ayarları"
-  },
   "algorithm": {
     "message": "Alqoritm"
   },
@@ -12173,6 +12206,6 @@
     "message": "Davam etmək istədiyinizə əminsiniz?"
   },
   "userVerificationFailed": {
-    "message": "User verification failed."
+    "message": "İstifadəçi doğrulaması uğursuz oldu."
   }
 }
diff --git a/apps/web/src/locales/be/messages.json b/apps/web/src/locales/be/messages.json
index 20142bf95d1..d0de973f30f 100644
--- a/apps/web/src/locales/be/messages.json
+++ b/apps/web/src/locales/be/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашыфраванага сховішча для далучаных файлаў."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Прапрыетарныя варыянты двухэтапнага ўваходу, такія як YubiKey, FIDO U2F і Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Дадатковая сховішча (ГБ)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Даведацца больш"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Увядзіце адрас сваёй электроннай ніжэй, каб аднавіць і выдаліць ваш уліковы запіс."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/bg/messages.json b/apps/web/src/locales/bg/messages.json
index 3267ebc3385..e058bdee1bd 100644
--- a/apps/web/src/locales/bg/messages.json
+++ b/apps/web/src/locales/bg/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB пространство за файлове, които се шифрират."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ пространство за файлове, които се шифрират.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Частно двустепенно удостоверяване чрез YubiKey и Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Вашият абонамент за платения план е приключил"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Ако искате отново да получите достъп до архива си, трябва да подновите платения си абонамент. Ако редактирате данните за архивиран елемент преди подновяването, той ще бъде върнат в трезора."
+  },
+  "restartPremium": {
+    "message": "Подновяване на платения абонамент"
+  },
   "additionalStorageGb": {
     "message": "Допълнително място [GB]"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Научете повече"
   },
+  "migrationsFailed": {
+    "message": "Възникна грешка при обновяването на настройките за шифроване."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновете настройките си за шифроване"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новите препоръчани настройки за шифроване ще подобрят сигурността на акаунта Ви. Въведете главната си парола, за да ги обновите сега."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Потвърдете самоличността си, за да продължите"
+  },
+  "enterYourMasterPassword": {
+    "message": "Въведете главната си парола"
+  },
+  "updateSettings": {
+    "message": "Обновяване на настройките"
+  },
   "deleteRecoverDesc": {
     "message": "Въведете адреса на електронната си поща, за да възстановите и да изтриете абонамента си."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Обновете настройките си за шифроване"
   },
-  "updateSettings": {
-    "message": "Обновяване на настройките"
-  },
   "algorithm": {
     "message": "Алгоритъм"
   },
diff --git a/apps/web/src/locales/bn/messages.json b/apps/web/src/locales/bn/messages.json
index f302bd08e24..915f2bff970 100644
--- a/apps/web/src/locales/bn/messages.json
+++ b/apps/web/src/locales/bn/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "ফাইল সংযুক্তির জন্য ১ জিবি এনক্রিপ্টেড স্থান।"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "আরও জানুন"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/bs/messages.json b/apps/web/src/locales/bs/messages.json
index dce29d875db..4c3005bda33 100644
--- a/apps/web/src/locales/bs/messages.json
+++ b/apps/web/src/locales/bs/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ca/messages.json b/apps/web/src/locales/ca/messages.json
index dc3f4994c67..8b3e85e936e 100644
--- a/apps/web/src/locales/ca/messages.json
+++ b/apps/web/src/locales/ca/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB d'emmagatzematge xifrat per als fitxers adjunts."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opcions propietàries de doble factor com ara YubiKey i Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Emmagatzematge suplementari (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Més informació"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Introduïu la vostra adreça de correu electrònic a continuació per recuperar i eliminar el vostre compte."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/cs/messages.json b/apps/web/src/locales/cs/messages.json
index b4016223c73..aceb40291df 100644
--- a/apps/web/src/locales/cs/messages.json
+++ b/apps/web/src/locales/cs/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrovaného úložiště pro přílohy."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrovaného úložiště pro přílohy.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Volby proprietálních dvoufázových přihlášení jako je YubiKey a Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Vaše předplatné Premium skončilo"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Chcete-li získat přístup k Vašemu archivu, restartujte předplatné Premium. Pokud upravíte detaily archivované položky před restartováním, bude přesunuta zpět do Vašeho trezoru."
+  },
+  "restartPremium": {
+    "message": "Restartovat Premium"
+  },
   "additionalStorageGb": {
     "message": "Další úložiště (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Dozvědět se více"
   },
+  "migrationsFailed": {
+    "message": "Došlo k chybě při aktualizaci nastavení šifrování."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Aktualizovat nastavení šifrování"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Nové doporučené nastavení šifrování zlepší bezpečnost Vašeho účtu. Pokud chcete aktualizovat nyní, zadejte hlavní heslo."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Pro pokračování potvrďte svou identitu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Zadejte své hlavní heslo"
+  },
+  "updateSettings": {
+    "message": "Aktualizovat nastavení"
+  },
   "deleteRecoverDesc": {
     "message": "Zadejte svou e-mailovou adresu níže pro obnovení a smazání účtu."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Aktualizujte nastavení šifrování"
   },
-  "updateSettings": {
-    "message": "Aktualizovat nastavení"
-  },
   "algorithm": {
     "message": "Algoritmus"
   },
diff --git a/apps/web/src/locales/cy/messages.json b/apps/web/src/locales/cy/messages.json
index 46876fa947c..108b1ebe23a 100644
--- a/apps/web/src/locales/cy/messages.json
+++ b/apps/web/src/locales/cy/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/da/messages.json b/apps/web/src/locales/da/messages.json
index 0316c1d2f0c..904dc69a0e3 100644
--- a/apps/web/src/locales/da/messages.json
+++ b/apps/web/src/locales/da/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB krypteret lager til vedhæftede filer."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietære totrins-login muligheder, såsom YubiKey og Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Ekstra lagerplads (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Få mere at vide"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Indtast din e-mailadresse nedenfor for at gendanne og slette din konto."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/de/messages.json b/apps/web/src/locales/de/messages.json
index b2eb06a720e..6c354cd9064 100644
--- a/apps/web/src/locales/de/messages.json
+++ b/apps/web/src/locales/de/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB verschlüsselter Speicherplatz für Dateianhänge."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietäre Optionen für die Zwei-Faktor Authentifizierung wie YubiKey und Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Zusätzlicher Speicher (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Erfahre mehr"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Einstellungen aktualisieren"
+  },
   "deleteRecoverDesc": {
     "message": "Geben Sie hier Ihre E-Mail-Adresse ein, um Ihr Konto wiederherzustellen und zu löschen."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Aktualisiere deine Verschlüsselungseinstellungen"
   },
-  "updateSettings": {
-    "message": "Einstellungen aktualisieren"
-  },
   "algorithm": {
     "message": "Algorithmus"
   },
diff --git a/apps/web/src/locales/el/messages.json b/apps/web/src/locales/el/messages.json
index 3a23bb286ea..f6e8abfd612 100644
--- a/apps/web/src/locales/el/messages.json
+++ b/apps/web/src/locales/el/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB κρυπτογραφημένο αποθηκευτικό χώρο για συνημμένα αρχεία."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Επιπλέον χώρος αποθήκευσης (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Μάθετε περισσότερα"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Εισάγετε την παρακάτω διεύθυνση email για να ανακτήσετε και να διαγράψετε το λογαριασμό σας."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json
index 90468c61d5c..3b0554547c5 100644
--- a/apps/web/src/locales/en/messages.json
+++ b/apps/web/src/locales/en/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4612,6 +4630,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -5137,9 +5173,21 @@
     "message": "Fix",
     "description": "This is a verb. ex. 'Fix The Car'"
   },
+  "fixEncryption": {
+    "message": "Fix encryption"
+  },
+  "fixEncryptionTooltip": {
+    "message": "This file is using an outdated encryption method."
+  },
+  "attachmentUpdated": {
+    "message": "Attachment updated"
+  },
   "oldAttachmentsNeedFixDesc": {
     "message": "There are old file attachments in your vault that need to be fixed before you can rotate your account's encryption key."
   },
+  "itemsTransferred": {
+    "message": "Items transferred"
+  },
   "yourAccountsFingerprint": {
     "message": "Your account's fingerprint phrase",
     "description": "A 'fingerprint phrase' is a unique word phrase (similar to a passphrase) that a user can use to authenticate their public key with another user, for the purposes of sharing."
@@ -6421,6 +6469,32 @@
   "bulkReinviteMessage": {
     "message": "Reinvited successfully"
   },
+  "bulkReinviteSuccessToast": {
+    "message": "$COUNT$ users re-invited",
+    "placeholders": {
+      "count": {
+        "content": "$1",
+        "example": "12"
+      }
+    }
+  },
+  "bulkReinviteLimitedSuccessToast": {
+    "message": "$LIMIT$ of $SELECTEDCOUNT$ users re-invited. $EXCLUDEDCOUNT$ were not invited due to the $LIMIT$ invite limit.",
+    "placeholders": {
+      "limit": {
+        "content": "$1",
+        "example": "4,000"
+      },
+      "selectedCount": {
+        "content": "$2",
+        "example": "4,005"
+      },
+      "excludedCount": {
+        "content": "$3",
+        "example": "5"
+      }
+    }
+  },
   "bulkRemovedMessage": {
     "message": "Removed successfully"
   },
@@ -6741,8 +6815,8 @@
   "vaultTimeoutRangeError": {
     "message": "Vault timeout is not within allowed range."
   },
-  "disablePersonalVaultExport": {
-    "message": "Remove individual vault export"
+  "disableExport": {
+    "message": "Remove export"
   },
   "disablePersonalVaultExportDescription": {
     "message": "Do not allow members to export data from their individual vault."
@@ -7062,9 +7136,6 @@
   "invalidVerificationCode": {
     "message": "Invalid verification code"
   },
-  "removeMasterPasswordForOrganizationUserKeyConnector": {
-    "message": "A master password is no longer required for members of the following organization. Please confirm the domain below with your organization administrator."
-  },
   "keyConnectorDomain": {
     "message": "Key Connector domain"
   },
@@ -7122,8 +7193,8 @@
   "enabledSso": {
     "message": "SSO turned on"
   },
-  "disabledSso": {
-    "message": "SSO turned on"
+  "ssoTurnedOff": {
+    "message": "SSO turned off"
   },
   "emailMustLoginWithSso": {
     "message": "$EMAIL$ must login with Single Sign-on",
@@ -9416,6 +9487,9 @@
   "ssoLoginIsRequired": {
     "message": "SSO login is required"
   },
+  "emailRequiredForSsoLogin": {
+    "message": "Email is required for SSO"
+  },
   "selectedRegionFlag": {
     "message": "Selected region flag"
   },
@@ -11929,8 +12003,8 @@
   "familiesMembership": {
     "message": "Families membership"
   },
-  "planDescPremium": {
-    "message": "Complete online security"
+  "advancedOnlineSecurity": {
+    "message": "Advanced online security"
   },
   "planDescFamiliesV2": {
     "message": "Premium security for your family"
@@ -12170,6 +12244,45 @@
       }
     }
   },
+  "removeMasterPasswordForOrgUserKeyConnector":{
+    "message": "Your organization is no longer using master passwords to log into Bitwarden. To continue, verify the organization and domain."
+  },
+  "continueWithLogIn": {
+    "message": "Continue with log in"
+  },
+  "doNotContinue": {
+    "message": "Do not continue"
+  },
+  "domain": {
+    "message": "Domain"
+  },
+  "keyConnectorDomainTooltip": {
+    "message": "This domain will store your account encryption keys, so make sure you trust it. If you're not sure, check with your admin."
+  },
+  "verifyYourOrganization": {
+    "message": "Verify your organization to log in"
+  },
+  "organizationVerified":{
+    "message": "Organization verified"
+  },
+  "domainVerified":{
+    "message": "Domain verified"
+  },
+  "leaveOrganizationContent": {
+    "message": "If you don't verify your organization, your access to the organization will be revoked."
+  },
+  "leaveNow": {
+    "message": "Leave now"
+  },
+  "verifyYourDomainToLogin": {
+    "message": "Verify your domain to log in"
+  },
+  "verifyYourDomainDescription": {
+    "message": "To continue with log in, verify this domain."
+  },
+  "confirmKeyConnectorOrganizationUserDescription": {
+    "message": "To continue with log in, verify the organization and domain."
+  },
   "confirmNoSelectedCriticalApplicationsTitle": {
     "message": "No critical applications are selected"
   },
@@ -12178,5 +12291,139 @@
   },
   "userVerificationFailed": {
     "message": "User verification failed."
+  },
+  "recoveryDeleteCiphersTitle": {
+    "message": "Delete unrecoverable vault items"
+  },
+  "recoveryDeleteCiphersDesc": {
+    "message": "Some of your vault items could not be recovered. Do you want to delete these unrecoverable items from your vault?"
+  },
+  "recoveryDeleteFoldersTitle": {
+    "message": "Delete unrecoverable folders"
+  },
+  "recoveryDeleteFoldersDesc": {
+    "message": "Some of your folders could not be recovered. Do you want to delete these unrecoverable folders from your vault?"
+  },
+  "recoveryReplacePrivateKeyTitle": {
+    "message": "Replace encryption key"
+  },
+  "recoveryReplacePrivateKeyDesc": {
+    "message": "Your public-key encryption key pair could not be recovered. Do you want to replace your encryption key with a new key pair? This will require you to set up existing emergency-access and organization memberships again."
+  },
+  "recoveryStepSyncTitle": {
+    "message": "Synchronizing data"
+  },
+  "recoveryStepPrivateKeyTitle": {
+    "message": "Verifying encryption key integrity"
+  },
+  "recoveryStepUserInfoTitle": {
+    "message": "Verifying user information"
+  },
+  "recoveryStepCipherTitle": {
+    "message": "Verifying vault item integrity"
+  },
+  "recoveryStepFoldersTitle": {
+    "message": "Verifying folder integrity"
+  },
+  "dataRecoveryTitle": {
+    "message": "Data Recovery and Diagnostics"
+  },
+  "dataRecoveryDescription": {
+    "message": "Use the data recovery tool to diagnose and repair issues with your account. After running diagnostics you have the option to save diagnostic logs for support and the option to repair any detected issues."
+  },
+  "runDiagnostics": {
+    "message": "Run Diagnostics"
+  },
+  "repairIssues": {
+    "message": "Repair Issues"
+  },
+  "saveDiagnosticLogs": {
+    "message": "Save Diagnostic Logs"
+  },
+  "sessionTimeoutSettingsManagedByOrganization": {
+    "message": "This setting is managed by your organization."
+  },
+  "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes": {
+    "message": "Your organization has set the maximum session timeout to $HOURS$ hour(s) and $MINUTES$ minute(s).",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "8"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "2"
+      }
+    }
+  },
+  "sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart": {
+    "message": "Your organization has set the default session timeout to On browser refresh."
+  },
+  "sessionTimeoutSettingsPolicyMaximumError": {
+    "message": "Maximum timeout cannot exceed $HOURS$ hour(s) and $MINUTES$ minute(s)",
+    "placeholders": {
+      "hours": {
+        "content": "$1",
+        "example": "5"
+      },
+      "minutes": {
+        "content": "$2",
+        "example": "5"
+      }
+    }
+  },
+  "sessionTimeoutOnRestart": {
+    "message": "On browser refresh"
+  },
+  "sessionTimeoutSettingsSetUnlockMethodToChangeTimeoutAction": {
+    "message": "Set an unlock method to change your timeout action"
+  },
+  "leaveConfirmationDialogTitle": {
+    "message": "Are you sure you want to leave?"
+  },
+  "leaveConfirmationDialogContentOne": {
+    "message": "By declining, your personal items will stay in your account, but you'll lose access to shared items and organization features."
+  },
+  "leaveConfirmationDialogContentTwo": {
+    "message": "Contact your admin to regain access."
+  },
+  "leaveConfirmationDialogConfirmButton": {
+    "message": "Leave $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"
+      }
+    }
+  },
+   "howToManageMyVault": {
+    "message": "How do I manage my vault?"
+  },
+  "transferItemsToOrganizationTitle": {
+    "message": "Transfer items to $ORGANIZATION$",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "transferItemsToOrganizationContent": {
+    "message": "$ORGANIZATION$ is requiring all items to be owned by the organization for security and compliance. Click accept to transfer ownership of your items.",
+    "placeholders": {
+      "organization": {
+        "content": "$1",
+        "example": "My Org Name"  
+      }
+    }
+  },
+  "acceptTransfer": {
+    "message": "Accept transfer"
+  },
+  "declineAndLeave": {
+    "message": "Decline and leave"
+  },
+  "whyAmISeeingThis": {
+    "message": "Why am I seeing this?"
   }
 }
diff --git a/apps/web/src/locales/en_GB/messages.json b/apps/web/src/locales/en_GB/messages.json
index 643601f54fe..be621369c77 100644
--- a/apps/web/src/locales/en_GB/messages.json
+++ b/apps/web/src/locales/en_GB/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/en_IN/messages.json b/apps/web/src/locales/en_IN/messages.json
index 29271d771d2..aafb9a01f3e 100644
--- a/apps/web/src/locales/en_IN/messages.json
+++ b/apps/web/src/locales/en_IN/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/eo/messages.json b/apps/web/src/locales/eo/messages.json
index da4490d0495..220d9492c67 100644
--- a/apps/web/src/locales/eo/messages.json
+++ b/apps/web/src/locales/eo/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB ĉifrita stokado por dosieraj aldonaĵoj."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Aldona Stokado (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Lernu pli"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enigu vian retpoŝtan adreson sube por rekuperi kaj forigi vian konton."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/es/messages.json b/apps/web/src/locales/es/messages.json
index ac5ca868b0f..b0a3716cf60 100644
--- a/apps/web/src/locales/es/messages.json
+++ b/apps/web/src/locales/es/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB de almacenamiento de archivos cifrados."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opciones de inicio de sesión con autenticación de dos pasos propietarios como YubiKey y Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Almacenamiento adicional (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Más información"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Introduce tu correo electrónico debajo para recuperar y eliminar tu cuenta."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/et/messages.json b/apps/web/src/locales/et/messages.json
index 186c0f1f256..1388e25bc13 100644
--- a/apps/web/src/locales/et/messages.json
+++ b/apps/web/src/locales/et/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB ulatuses krüpteeritud salvestusruum."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Eraomanduses kaheastmelise logimise valikud, nagu näiteks YubiKey ja Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Lisaruum (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Rohkem teavet"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Sisesta e-posti aadress oma konto taastamiseks ja kustutamiseks."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/eu/messages.json b/apps/web/src/locales/eu/messages.json
index e494c663b74..c2fa69d56b8 100644
--- a/apps/web/src/locales/eu/messages.json
+++ b/apps/web/src/locales/eu/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "Eranskinentzako 1GB-eko zifratutako biltegia."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Biltegi gehigarria (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Gehiago ikasi"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Sartu zure emaila jarraian, zure kontua berreskuratu eta ezabatzeko."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/fa/messages.json b/apps/web/src/locales/fa/messages.json
index ff39b14c05f..c8623050394 100644
--- a/apps/web/src/locales/fa/messages.json
+++ b/apps/web/src/locales/fa/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "۱ گیگابایت فضای ذخیره‌سازی رمزنگاری شده برای پرونده‌های پیوست."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "گزینه های ورود اضافی دو مرحله ای مانند YubiKey و Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "ذخیره‌سازی های اضافی (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "بیشتر بدانید"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "نشانی ایمیل خود را در زیر برای بازیابی و حذف حساب خود وارد کنید."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/fi/messages.json b/apps/web/src/locales/fi/messages.json
index 9710db5f285..181c8d4f125 100644
--- a/apps/web/src/locales/fi/messages.json
+++ b/apps/web/src/locales/fi/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 Gt salattua tallennustilaa tiedostoliitteille."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Kaksivaiheisen kirjautumisen erikoisvaihtoehdot, kuten YubiKey ja Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Lisää tallennustilaa (Gt)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Lue lisää"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Kirjoita sähköpostiosoitteesi alle palauttaaksesi ja poistaaksesi tilisi."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/fil/messages.json b/apps/web/src/locales/fil/messages.json
index 85b5797e634..f3542368044 100644
--- a/apps/web/src/locales/fil/messages.json
+++ b/apps/web/src/locales/fil/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1GB na naka-encrypt na storage para sa mga file attachment."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Karagdagang storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Matuto nang higit pa"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Ipasok ang iyong email address sa ibaba upang mabawi at tanggalin ang iyong account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/fr/messages.json b/apps/web/src/locales/fr/messages.json
index 8103dcde46e..e5fcf929f0d 100644
--- a/apps/web/src/locales/fr/messages.json
+++ b/apps/web/src/locales/fr/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 Go de stockage chiffré pour les fichiers joints."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Stockage chiffré de $SIZE$ pour les pièces jointes.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Options de connexion propriétaires à deux facteurs telles que YubiKey et Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Votre abonnement Premium est terminé"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Pour récupérer l'accès à vos archives, redémarrez votre abonnement Premium. Si vous modifiez les détails d'un élément archivé avant de le redémarrer, il sera déplacé dans votre coffre."
+  },
+  "restartPremium": {
+    "message": "Redémarrer Premium"
+  },
   "additionalStorageGb": {
     "message": "Stockage additionnel (Go)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "En savoir plus"
   },
+  "migrationsFailed": {
+    "message": "Une erreur s'est produite lors de la mise à jour des paramètres de chiffrement."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Mettre à jour vos paramètres de chiffrement"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Les nouveaux paramètres de chiffrement recommandés amélioreront la sécurité de votre compte. Entrez votre mot de passe principal pour faire la mise à jour maintenant."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirmez votre identité pour continuer"
+  },
+  "enterYourMasterPassword": {
+    "message": "Entrez votre mot de passe principal"
+  },
+  "updateSettings": {
+    "message": "Mettre à jour les paramètres"
+  },
   "deleteRecoverDesc": {
     "message": "Saisissez votre adresse électronique ci-dessous pour récupérer et supprimer votre compte."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Mettre à jour vos paramètres de chiffrement"
   },
-  "updateSettings": {
-    "message": "Mettre à jour les paramètres"
-  },
   "algorithm": {
     "message": "Algorithme"
   },
diff --git a/apps/web/src/locales/gl/messages.json b/apps/web/src/locales/gl/messages.json
index ce34dee8f42..f7a848bd025 100644
--- a/apps/web/src/locales/gl/messages.json
+++ b/apps/web/src/locales/gl/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/he/messages.json b/apps/web/src/locales/he/messages.json
index 6560e2f2222..d723cb42140 100644
--- a/apps/web/src/locales/he/messages.json
+++ b/apps/web/src/locales/he/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 ג'יגה של מקום אחסון מוצפן עבור קבצים מצורפים."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "אפשרויות כניסה דו־שלבית קנייניות כגון YubiKey ו־Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "אחסון נוסף (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "למידע נוסף"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "עדכן הגדרות"
+  },
   "deleteRecoverDesc": {
     "message": "הזן את כתובת האימייל שלך כדי לשחזר ולמחוק את החשבון שלך."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "עדכן את הגדרות ההצפנה שלך"
   },
-  "updateSettings": {
-    "message": "עדכן הגדרות"
-  },
   "algorithm": {
     "message": "אלגוריתם"
   },
diff --git a/apps/web/src/locales/hi/messages.json b/apps/web/src/locales/hi/messages.json
index 67dede6f1e7..1c5a211aaca 100644
--- a/apps/web/src/locales/hi/messages.json
+++ b/apps/web/src/locales/hi/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/hr/messages.json b/apps/web/src/locales/hr/messages.json
index 8c548a71dee..f357718bab0 100644
--- a/apps/web/src/locales/hr/messages.json
+++ b/apps/web/src/locales/hr/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifriranog prostora za pohranu podataka."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Mogućnosti za prijavu u dva koraka kao što su YubiKey i Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Dodatni prostor za pohranu (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Saznaj više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Ažuriraj postavke"
+  },
   "deleteRecoverDesc": {
     "message": "Unesi svoju e-poštu za oporavak i brisanje svojeg računa."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Ažuriraj svoje postakve šifriranja"
   },
-  "updateSettings": {
-    "message": "Ažuriraj postavke"
-  },
   "algorithm": {
     "message": "Algoritam"
   },
diff --git a/apps/web/src/locales/hu/messages.json b/apps/web/src/locales/hu/messages.json
index f626e348e73..3d360541b93 100644
--- a/apps/web/src/locales/hu/messages.json
+++ b/apps/web/src/locales/hu/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB titkosított tárhely a fájlmellékleteknek."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ titkosított tárhely a fájlmellékletekhez.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Saját kétlépcsős bejelentkezési lehetőségek mint a YubiKey és a Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "A Prémium előfizetés véget ért."
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Az archívumhoz hozzáférés visszaszerzéséhez indítsuk újra a Prémium előfizetést. Ha az újraindítás előtt szerkesztjük egy archivált elem adatait, akkor az visszakerül a széfbe."
+  },
+  "restartPremium": {
+    "message": "Prémium előfizetés újraindítása"
+  },
   "additionalStorageGb": {
     "message": "Kiegészítő tárhely (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "További információ"
   },
+  "migrationsFailed": {
+    "message": "Hiba történt a titkosítási beállítások frissítésekor."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "A titkosítási beállítások frissítése"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Az új ajánlott titkosítási beállítások javítják a fiók biztonságát. Adjuk meg a mesterjelszót a frissítéshez most."
+  },
+  "confirmIdentityToContinue": {
+    "message": "A folytatáshoz meg kell erősíteni a személyazonosságot."
+  },
+  "enterYourMasterPassword": {
+    "message": "Mesterjelszó megadása"
+  },
+  "updateSettings": {
+    "message": "Beállítások frissítése"
+  },
   "deleteRecoverDesc": {
     "message": "Az email cím megadása lentebb a fiók helyreállításához és törléséhez."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Frissítsük a titkosítási beállításokat."
   },
-  "updateSettings": {
-    "message": "Beállítások frissítése"
-  },
   "algorithm": {
     "message": "Algoritmus"
   },
diff --git a/apps/web/src/locales/id/messages.json b/apps/web/src/locales/id/messages.json
index 639063ca304..4dc41e8f928 100644
--- a/apps/web/src/locales/id/messages.json
+++ b/apps/web/src/locales/id/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "Penyimpanan terenkripsi 1 GB untuk lampiran file."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opsi login dua langkah eksklusif seperti YubiKey dan Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Tambahan Penyimpanan (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Pelajari lebih lanjut"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Masukkan alamat email Anda di bawah ini untuk memulihkan dan menghapus akun Anda."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/it/messages.json b/apps/web/src/locales/it/messages.json
index 14da6d6be56..459f1dfd3a4 100644
--- a/apps/web/src/locales/it/messages.json
+++ b/apps/web/src/locales/it/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB di spazio di archiviazione crittografato per gli allegati."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opzioni di verifica in due passaggi proprietarie come YubiKey e Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Spazio di archiviazione aggiuntivo (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Ulteriori informazioni"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Aggiorna le impostazioni"
+  },
   "deleteRecoverDesc": {
     "message": "Inserisci la tua email per recuperare ed eliminare il tuo account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Aggiorna le impostazioni di crittografia"
   },
-  "updateSettings": {
-    "message": "Aggiorna le impostazioni"
-  },
   "algorithm": {
     "message": "Algoritmo"
   },
diff --git a/apps/web/src/locales/ja/messages.json b/apps/web/src/locales/ja/messages.json
index 7143e958f99..33535634bc8 100644
--- a/apps/web/src/locales/ja/messages.json
+++ b/apps/web/src/locales/ja/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1GB の暗号化されたファイルストレージ"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey、Duo などのプロプライエタリな2段階認証オプション。"
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "追加ストレージ容量(GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "詳細"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "メールアドレスを入力してアカウントを削除します。"
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ka/messages.json b/apps/web/src/locales/ka/messages.json
index 108df6dcddb..47a46367feb 100644
--- a/apps/web/src/locales/ka/messages.json
+++ b/apps/web/src/locales/ka/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/km/messages.json b/apps/web/src/locales/km/messages.json
index 0d08d207748..608215f8155 100644
--- a/apps/web/src/locales/km/messages.json
+++ b/apps/web/src/locales/km/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/kn/messages.json b/apps/web/src/locales/kn/messages.json
index c3b4fe8ebd3..2f0759ff939 100644
--- a/apps/web/src/locales/kn/messages.json
+++ b/apps/web/src/locales/kn/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "ಫೈಲ್ ಲಗತ್ತುಗಳಿಗಾಗಿ 1 ಜಿಬಿ ಎನ್‌ಕ್ರಿಪ್ಟ್ ಮಾಡಿದ ಸಂಗ್ರಹ."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "ಹೆಚ್ಚುವರಿ ಸಂಗ್ರಹಣೆ (ಜಿಬಿ)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "ಇನ್ನಷ್ಟು ತಿಳಿಯಿರಿ"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "ನಿಮ್ಮ ಖಾತೆಯನ್ನು ಮರುಪಡೆಯಲು ಮತ್ತು ಅಳಿಸಲು ನಿಮ್ಮ ಇಮೇಲ್ ವಿಳಾಸವನ್ನು ಕೆಳಗೆ ನಮೂದಿಸಿ."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ko/messages.json b/apps/web/src/locales/ko/messages.json
index 4063e7c62da..aaef9d378e9 100644
--- a/apps/web/src/locales/ko/messages.json
+++ b/apps/web/src/locales/ko/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1GB의 암호화된 파일 저장소."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey, Duo와 같은 \b상용 2단계 로그인 방법."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "추가 저장소 용량 (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "더 알아보기"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "계정을 복구하거나 삭제하려면 아래에 이메일 주소를 입력하십시오."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/lv/messages.json b/apps/web/src/locales/lv/messages.json
index 120b06b8024..d627835b1f4 100644
--- a/apps/web/src/locales/lv/messages.json
+++ b/apps/web/src/locales/lv/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrētas krātuves datņu pielikumiem."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ šifrētas krātuves datņu pielikumiem.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Tādas slēgtā pirmavota divpakāpju pieteikšanās iespējas kā YubiKey un Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Tavs Premium abonements beidzās"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Lai atgūtu piekļuvi savam arhīvam, jāatsāk Premium abonements. Ja labosi arhivēta vienuma informāciju pirms atsākšanas, tas tiks pārvietots atpakaļ Tavā glabātavā."
+  },
+  "restartPremium": {
+    "message": "Atsākt Premium"
+  },
   "additionalStorageGb": {
     "message": "Papildu krātuve (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Uzzināt vairāk"
   },
+  "migrationsFailed": {
+    "message": "Atgadījās kļūda šifrēšanas iestatījumu atjaunināšanā."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atjaunini savus šifrēšanas iestatījumus"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Jaunie ieteicamie šifrēšanas iestatījumi uzlabos Tava konta drošību. Jāievada sava galvenā parole, lai atjauninātu tagad."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Jāapliecina sava identitāte, lai turpinātu"
+  },
+  "enterYourMasterPassword": {
+    "message": "Jāievada sava galvenā parole"
+  },
+  "updateSettings": {
+    "message": "Atjaunināt Iestatījumus"
+  },
   "deleteRecoverDesc": {
     "message": "Jāievada e-pasta adrese zemāk esošajā laukā, lai atkoptu un izdzēstu savu kontu."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Atjaunini savus šifrēšanas iestatījumus"
   },
-  "updateSettings": {
-    "message": "Atjaunināt Iestatījumus"
-  },
   "algorithm": {
     "message": "Algoritms"
   },
diff --git a/apps/web/src/locales/ml/messages.json b/apps/web/src/locales/ml/messages.json
index 5d7c304216c..8d49e35690e 100644
--- a/apps/web/src/locales/ml/messages.json
+++ b/apps/web/src/locales/ml/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "ഫയൽ അറ്റാച്ചുമെന്റുകൾക്കായി 1 GB എൻക്രിപ്റ്റുചെയ്‌ത സ്റ്റോറേജ്."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional Storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "കൂടുതൽ അറിയുക"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "നിങ്ങളുടെ അക്കൗണ്ട് വീണ്ടെടുക്കുന്നതിനും ഇല്ലാതാക്കുന്നതിനും ചുവടെ നിങ്ങളുടെ ഇമെയിൽ വിലാസം നൽകുക."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/mr/messages.json b/apps/web/src/locales/mr/messages.json
index 82585984958..6ba6661c478 100644
--- a/apps/web/src/locales/mr/messages.json
+++ b/apps/web/src/locales/mr/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/my/messages.json b/apps/web/src/locales/my/messages.json
index 0d08d207748..608215f8155 100644
--- a/apps/web/src/locales/my/messages.json
+++ b/apps/web/src/locales/my/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/nb/messages.json b/apps/web/src/locales/nb/messages.json
index 87664f952a1..042444814e6 100644
--- a/apps/web/src/locales/nb/messages.json
+++ b/apps/web/src/locales/nb/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB med kryptert fillagring."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Ytterligere lagringsplass (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Lær mer"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Skriv inn din E-postadresse nedenfor for å få tilbake tilgangen til og å slette din konto."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ne/messages.json b/apps/web/src/locales/ne/messages.json
index e2e310d7031..31367740728 100644
--- a/apps/web/src/locales/ne/messages.json
+++ b/apps/web/src/locales/ne/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/nl/messages.json b/apps/web/src/locales/nl/messages.json
index fadbaa923d5..333df664f77 100644
--- a/apps/web/src/locales/nl/messages.json
+++ b/apps/web/src/locales/nl/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB versleutelde opslag voor bijlagen."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ versleutelde opslag voor bijlagen.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Gepatenteerde 2 stap login opties zoals YubiKey en Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Je Premium-abonnement is afgelopen"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Herstart je Premium-abonnement om toegang tot je archief te krijgen. Als je de details wijzigt voor een gearchiveerd item voor het opnieuw opstarten, zal het terug naar je kluis worden verplaatst."
+  },
+  "restartPremium": {
+    "message": "Premium herstarten"
+  },
   "additionalStorageGb": {
     "message": "Extra opslagruimte (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Meer informatie"
   },
+  "migrationsFailed": {
+    "message": "Er is een fout opgetreden bij het bijwerken van de versleutelingsinstellingen."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Je versleutelingsinstellingen bijwerken"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nieuwe aanbevolen versleutelingsinstellingen verbeteren de beveiliging van je account. Voer je hoofdwachtwoord in om nu bij te werken."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bevestig je identiteit om door te gaan"
+  },
+  "enterYourMasterPassword": {
+    "message": "Voer je hoofdwachtwoord in"
+  },
+  "updateSettings": {
+    "message": "Instellingen bijwerken"
+  },
   "deleteRecoverDesc": {
     "message": "Voer hieronder je e-mailadres in om je account te herstellen en te verwijderen."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Je versleutelingsinstellingen bijwerken"
   },
-  "updateSettings": {
-    "message": "Instellingen bijwerken"
-  },
   "algorithm": {
     "message": "Algoritme"
   },
diff --git a/apps/web/src/locales/nn/messages.json b/apps/web/src/locales/nn/messages.json
index 8dc4b88b647..32c452cf657 100644
--- a/apps/web/src/locales/nn/messages.json
+++ b/apps/web/src/locales/nn/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/or/messages.json b/apps/web/src/locales/or/messages.json
index 0d08d207748..608215f8155 100644
--- a/apps/web/src/locales/or/messages.json
+++ b/apps/web/src/locales/or/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/pl/messages.json b/apps/web/src/locales/pl/messages.json
index 5db5acc944f..f5e6b898bff 100644
--- a/apps/web/src/locales/pl/messages.json
+++ b/apps/web/src/locales/pl/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB przestrzeni na zaszyfrowane załączniki."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Własnościowe opcje logowania dwuetapowego, takie jak YubiKey i Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Dodatkowa przestrzeń (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Dowiedz się więcej"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Wpisz adres e-mail poniżej, aby odzyskać i usunąć konto."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/pt_BR/messages.json b/apps/web/src/locales/pt_BR/messages.json
index 653518431dc..ff5686cbba8 100644
--- a/apps/web/src/locales/pt_BR/messages.json
+++ b/apps/web/src/locales/pt_BR/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB de armazenamento criptografado para anexo de arquivos."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento criptografado para anexos de arquivo.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opções de autenticação em duas etapas proprietárias como YubiKey e Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Sua assinatura Premium terminou"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Para recuperar o seu acesso ao seu arquivo, retoma sua assinatura Premium. Se editar detalhes de um item arquivado antes de retomar, ele será movido de volta para o seu cofre."
+  },
+  "restartPremium": {
+    "message": "Retomar Premium"
+  },
   "additionalStorageGb": {
     "message": "Armazenamento adicional (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Saiba mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as configurações de criptografia."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize suas configurações de criptografia"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas configurações de criptografia recomendadas melhorarão a segurança da sua conta. Digite sua senha principal para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Digite sua senha principal"
+  },
+  "updateSettings": {
+    "message": "Atualizar configurações"
+  },
   "deleteRecoverDesc": {
     "message": "Digite seu endereço de e-mail abaixo para recuperar e apagar sua conta."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Atualize suas configurações de criptografia"
   },
-  "updateSettings": {
-    "message": "Atualizar configurações"
-  },
   "algorithm": {
     "message": "Algoritmo"
   },
diff --git a/apps/web/src/locales/pt_PT/messages.json b/apps/web/src/locales/pt_PT/messages.json
index 2227710d093..73ba923b416 100644
--- a/apps/web/src/locales/pt_PT/messages.json
+++ b/apps/web/src/locales/pt_PT/messages.json
@@ -1375,7 +1375,7 @@
     "message": "Iniciar sessão com o dispositivo"
   },
   "loginWithDeviceEnabledNote": {
-    "message": "O início de sessão com o dispositivo deve ser ativado nas definições da aplicação Bitwarden. Precisa de outra opção?"
+    "message": "O início de sessão com o dispositivo deve ser ativado nas definições da app Bitwarden. Precisa de outra opção?"
   },
   "needAnotherOptionV1": {
     "message": "Precisa de outra opção?"
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB de armazenamento encriptado para anexos de ficheiros."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ de armazenamento encriptado para anexos de ficheiros.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Opções proprietárias de verificação de dois passos, como YubiKey e Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "A sua subscrição Premium terminou"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Para recuperar o acesso ao seu arquivo, reinicie a sua subscrição Premium. Se editar os detalhes de um item arquivado antes de reiniciar, ele será movido de volta para o seu cofre."
+  },
+  "restartPremium": {
+    "message": "Reiniciar Premium"
+  },
   "additionalStorageGb": {
     "message": "Armazenamento adicional (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Saber mais"
   },
+  "migrationsFailed": {
+    "message": "Ocorreu um erro ao atualizar as definições de encriptação."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Atualize as suas definições de encriptação"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "As novas definições de encriptação recomendadas irão melhorar a segurança da sua conta. Introduza a sua palavra-passe mestra para atualizar agora."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirme a sua identidade para continuar"
+  },
+  "enterYourMasterPassword": {
+    "message": "Introduza a sua palavra-passe mestra"
+  },
+  "updateSettings": {
+    "message": "Atualizar definições"
+  },
   "deleteRecoverDesc": {
     "message": "Introduza o seu endereço de e-mail abaixo para recuperar e eliminar a sua conta."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Atualize as suas definições de encriptação"
   },
-  "updateSettings": {
-    "message": "Atualizar definições"
-  },
   "algorithm": {
     "message": "Algoritmo"
   },
diff --git a/apps/web/src/locales/ro/messages.json b/apps/web/src/locales/ro/messages.json
index c3c2b7d9c4b..8efd88e49aa 100644
--- a/apps/web/src/locales/ro/messages.json
+++ b/apps/web/src/locales/ro/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB stocare criptată pentru fișiere atașate."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Stocare adițională (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Aflați mai multe"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Introduceți adresa de e-mail mai jos pentru a vă recupera și șterge contul."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/ru/messages.json b/apps/web/src/locales/ru/messages.json
index c1b2e3f1dc1..0691b4e654b 100644
--- a/apps/web/src/locales/ru/messages.json
+++ b/apps/web/src/locales/ru/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашифрованного хранилища для вложенных файлов."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Зашифрованного хранилища для вложенных файлов: $SIZE$",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Проприетарные варианты двухэтапной аутентификации, такие как YubiKey или Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Ваша подписка Премиум закончилась"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "Чтобы восстановить доступ к своему архиву, подключите подписку Премиум повторно. Если вы измените сведения об архивированном элементе перед переподключением, он будет перемещен обратно в ваше хранилище."
+  },
+  "restartPremium": {
+    "message": "Переподключить Премиум"
+  },
   "additionalStorageGb": {
     "message": "Дополнительное место (ГБ)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Подробнее"
   },
+  "migrationsFailed": {
+    "message": "Произошла ошибка при обновлении настроек шифрования."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Обновите настройки шифрования"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "Новые рекомендуемые настройки шифрования повысят безопасность вашего аккаунта. Введите мастер-пароль, чтобы обновить сейчас."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Подтвердите вашу личность, чтобы продолжить"
+  },
+  "enterYourMasterPassword": {
+    "message": "Введите ваш мастер-пароль"
+  },
+  "updateSettings": {
+    "message": "Обновить настройки"
+  },
   "deleteRecoverDesc": {
     "message": "Введите свой адрес email, чтобы восстановить и удалить ваш аккаунт."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Обновите настройки шифрования"
   },
-  "updateSettings": {
-    "message": "Обновить настройки"
-  },
   "algorithm": {
     "message": "Алгоритм"
   },
diff --git a/apps/web/src/locales/si/messages.json b/apps/web/src/locales/si/messages.json
index 03f68be3c03..d4c4d143600 100644
--- a/apps/web/src/locales/si/messages.json
+++ b/apps/web/src/locales/si/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/sk/messages.json b/apps/web/src/locales/sk/messages.json
index 3e19422e07e..70578e5bf59 100644
--- a/apps/web/src/locales/sk/messages.json
+++ b/apps/web/src/locales/sk/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB šifrovaného úložiska pre prílohy."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietárne možnosti dvojstupňového prihlásenia ako napríklad YubiKey a Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Dodatočné úložisko (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Zistiť viac"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Zadajte vašu emailovú adresu ak chcete obnoviť a zrušiť vaše konto."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/sl/messages.json b/apps/web/src/locales/sl/messages.json
index 09a882fe7e5..10c734ec6b7 100644
--- a/apps/web/src/locales/sl/messages.json
+++ b/apps/web/src/locales/sl/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Dodatna hramba (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Več o tem"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/sr_CS/messages.json b/apps/web/src/locales/sr_CS/messages.json
index 367d4ddbace..0f8a2760370 100644
--- a/apps/web/src/locales/sr_CS/messages.json
+++ b/apps/web/src/locales/sr_CS/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Saznaj više"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/sr_CY/messages.json b/apps/web/src/locales/sr_CY/messages.json
index aea5a1d9733..f1f7dd3ca73 100644
--- a/apps/web/src/locales/sr_CY/messages.json
+++ b/apps/web/src/locales/sr_CY/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1ГБ шифровано складиште за прилоге."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Приоритарне опције пријаве у два корака као што су YubiKey и Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Додатно складиште (ГБ)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Сазнај више"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Ажурирај подешавања"
+  },
   "deleteRecoverDesc": {
     "message": "Унесите свој имејл да бисте опоравили и избрисали налог."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Ажурирајте своје поставке за шифровање"
   },
-  "updateSettings": {
-    "message": "Ажурирај подешавања"
-  },
   "algorithm": {
     "message": "Алгоритам"
   },
diff --git a/apps/web/src/locales/sv/messages.json b/apps/web/src/locales/sv/messages.json
index 6432029d219..7f1275ee75c 100644
--- a/apps/web/src/locales/sv/messages.json
+++ b/apps/web/src/locales/sv/messages.json
@@ -236,7 +236,7 @@
     "message": "Applikationer markerade som kritiska"
   },
   "criticalApplicationsMarkedSuccess": {
-    "message": "$COUNT$ applications marked as critical",
+    "message": "$COUNT$ applikationer markerade som kritiska",
     "placeholders": {
       "count": {
         "content": "$1",
@@ -269,7 +269,7 @@
     "message": "These members have access to vulnerable items for critical applications."
   },
   "membersWithAtRiskPasswords": {
-    "message": "Members with at-risk passwords"
+    "message": "Medlemmar med lösenord i riskzonen"
   },
   "membersWillReceiveSecurityTask": {
     "message": "Members of your organization will be assigned a task to change vulnerable passwords. They’ll receive a notification within their Bitwarden browser extension."
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB krypterad lagring."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Premium-alternativ för tvåstegsverifiering, såsom YubiKey och Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Starta om Premium"
+  },
   "additionalStorageGb": {
     "message": "Ytterligare lagring (GB)"
   },
@@ -4482,7 +4500,7 @@
     "message": "Sammanställer insikter..."
   },
   "loadingProgress": {
-    "message": "Loading progress"
+    "message": "Inläsningsförlopp"
   },
   "thisMightTakeFewMinutes": {
     "message": "Detta kan ta några minuter."
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Läs mer"
   },
+  "migrationsFailed": {
+    "message": "Ett fel inträffade när krypteringsinställningarna skulle uppdateras."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Uppdatera dina krypteringsinställningar"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "De nya rekommenderade krypteringsinställningarna kommer att förbättra säkerheten för ditt konto. Ange ditt huvudlösenord för att uppdatera nu."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Bekräfta din identitet för att fortsätta"
+  },
+  "enterYourMasterPassword": {
+    "message": "Ange ditt huvudlösenord"
+  },
+  "updateSettings": {
+    "message": "Uppdatera inställningar"
+  },
   "deleteRecoverDesc": {
     "message": "Ange din e-postadress nedan för att återställa och radera ditt konto."
   },
@@ -6614,7 +6650,7 @@
     "message": "Ditt huvudlösenord uppfyller inte en eller flera av organisationens policyer. För att få tillgång till valvet måste du uppdatera ditt huvudlösenord nu. Om du fortsätter loggas du ut från din nuvarande session och måste logga in igen. Aktiva sessioner på andra enheter kan fortsätta att vara aktiva i upp till en timme."
   },
   "automaticAppLoginWithSSO": {
-    "message": "Automatic login with SSO"
+    "message": "Automatisk inloggning med SSO"
   },
   "automaticAppLoginWithSSODesc": {
     "message": "Extend SSO security and convenience to unmanaged apps. When users launch an app from your identity provider, their login details are automatically filled and submitted, creating a one-click, secure flow from the identity provider to the app."
@@ -7393,7 +7429,7 @@
     "message": "Åtkomst nekad. Du har inte behörighet att visa den här sidan."
   },
   "noPageAccess": {
-    "message": "You do not have access to this page"
+    "message": "Du har inte tillgång till denna sida"
   },
   "masterPassword": {
     "message": "Huvudlösenord"
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Uppdatera dina krypteringsinställningar"
   },
-  "updateSettings": {
-    "message": "Uppdatera inställningar"
-  },
   "algorithm": {
     "message": "Algoritm"
   },
diff --git a/apps/web/src/locales/ta/messages.json b/apps/web/src/locales/ta/messages.json
index d6154ae9fcb..98970962d69 100644
--- a/apps/web/src/locales/ta/messages.json
+++ b/apps/web/src/locales/ta/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "கோப்பு இணைப்புகளுக்கு 1 GB என்க்ரிப்ட் செய்யப்பட்ட சேமிப்பகம்."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey மற்றும் Duo போன்ற தனியுரிம இரண்டு-படி உள்நுழைவு விருப்பங்கள்."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "கூடுதல் சேமிப்பகம் (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "மேலும் அறிக"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "உங்கள் கணக்கை மீட்டு நீக்க, கீழே உங்கள் மின்னஞ்சல் முகவரியை உள்ளிடவும்."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/te/messages.json b/apps/web/src/locales/te/messages.json
index 0d08d207748..608215f8155 100644
--- a/apps/web/src/locales/te/messages.json
+++ b/apps/web/src/locales/te/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/th/messages.json b/apps/web/src/locales/th/messages.json
index fca56729464..c20cc2e5d8c 100644
--- a/apps/web/src/locales/th/messages.json
+++ b/apps/web/src/locales/th/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 GB encrypted storage for file attachments."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Proprietary two-step login options such as YubiKey and Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Additional storage (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Learn more"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Enter your email address below to recover and delete your account."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/tr/messages.json b/apps/web/src/locales/tr/messages.json
index 70136be6086..829c0ca17dc 100644
--- a/apps/web/src/locales/tr/messages.json
+++ b/apps/web/src/locales/tr/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "Dosya ekleri için 1 GB şifrelenmiş depolama."
   },
+  "premiumSignUpStorageV2": {
+    "message": "Dosya ekleri için $SIZE$ şifrelenmiş depolama.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "YubiKey ve Duo gibi marka bazlı iki aşamalı giriş seçenekleri."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Ek depolama alanı (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Daha fazla bilgi al"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Ayarları güncelle"
+  },
   "deleteRecoverDesc": {
     "message": "Hesabınızı kurtarmak ve silmek için e-posta adresinizi yazın."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Şifreleme ayarlarınızı güncelleyin"
   },
-  "updateSettings": {
-    "message": "Ayarları güncelle"
-  },
   "algorithm": {
     "message": "Algoritma"
   },
diff --git a/apps/web/src/locales/uk/messages.json b/apps/web/src/locales/uk/messages.json
index 1ccabaeddfb..be571b0c146 100644
--- a/apps/web/src/locales/uk/messages.json
+++ b/apps/web/src/locales/uk/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1 ГБ зашифрованого сховища для файлів."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Додаткові можливості двоетапної авторизації, як-от YubiKey та Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Додаткове сховище (ГБ)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Докладніше"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Update settings"
+  },
   "deleteRecoverDesc": {
     "message": "Введіть свою адресу е-пошти внизу, щоб відновити і видалити обліковий запис."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Update your encryption settings"
   },
-  "updateSettings": {
-    "message": "Update settings"
-  },
   "algorithm": {
     "message": "Algorithm"
   },
diff --git a/apps/web/src/locales/vi/messages.json b/apps/web/src/locales/vi/messages.json
index 370ca0f5ad4..35e7db50023 100644
--- a/apps/web/src/locales/vi/messages.json
+++ b/apps/web/src/locales/vi/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "1GB bộ nhớ lưu trữ được mã hóa cho các tệp đính kèm."
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "Các tùy chọn xác minh hai bước như YubiKey và Duo."
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "Dung lượng lưu trữ bổ sung (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "Tìm hiểu thêm"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "Cập nhật cài đặt"
+  },
   "deleteRecoverDesc": {
     "message": "Nhập địa chỉ email của bạn vào bên dưới để khôi phục và xóa tài khoản của bạn."
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "Cập nhật cài đặt mã hóa của bạn"
   },
-  "updateSettings": {
-    "message": "Cập nhật cài đặt"
-  },
   "algorithm": {
     "message": "Thuật toán"
   },
diff --git a/apps/web/src/locales/zh_CN/messages.json b/apps/web/src/locales/zh_CN/messages.json
index 53ec5f10185..7d898c79952 100644
--- a/apps/web/src/locales/zh_CN/messages.json
+++ b/apps/web/src/locales/zh_CN/messages.json
@@ -3060,7 +3060,16 @@
     "message": "将您的账户升级为高级会员，将解锁一些强大的附加功能。"
   },
   "premiumSignUpStorage": {
-    "message": "1 GB 文件附件加密存储。"
+    "message": "1 GB 文件附件加密存储空间。"
+  },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ 文件附件加密存储空间。",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
   },
   "premiumSignUpTwoStepOptions": {
     "message": "专有的两步登录选项，如 YubiKey 和 Duo。"
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "附加存储 (GB)"
   },
@@ -3350,7 +3368,7 @@
     "message": "GB 存储空间将增加"
   },
   "gbStorageRemove": {
-    "message": "GB 存储空间将删除"
+    "message": "GB 存储空间将移除"
   },
   "storageAddNote": {
     "message": "添加存储空间将会调整计费总金额，并立即通过您的付款方式进行扣款。第一笔费用将按当前计费周期的剩余时间按比例分配。"
@@ -3541,7 +3559,7 @@
     "message": "创建不限数量的集合"
   },
   "gbEncryptedFileStorage": {
-    "message": "$SIZE$ 加密文件存储",
+    "message": "$SIZE$ 加密文件存储空间",
     "placeholders": {
       "size": {
         "content": "$1",
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "进一步了解"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "更新设置"
+  },
   "deleteRecoverDesc": {
     "message": "请在下面输入您的电子邮箱地址以恢复和删除您的账户。"
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "更新您的加密设置"
   },
-  "updateSettings": {
-    "message": "更新设置"
-  },
   "algorithm": {
     "message": "算法"
   },
diff --git a/apps/web/src/locales/zh_TW/messages.json b/apps/web/src/locales/zh_TW/messages.json
index 19456fed39d..95c345f74d7 100644
--- a/apps/web/src/locales/zh_TW/messages.json
+++ b/apps/web/src/locales/zh_TW/messages.json
@@ -3062,6 +3062,15 @@
   "premiumSignUpStorage": {
     "message": "用於檔案附件的 1 GB 的加密檔案儲存空間。"
   },
+  "premiumSignUpStorageV2": {
+    "message": "$SIZE$ encrypted storage for file attachments.",
+    "placeholders": {
+      "size": {
+        "content": "$1",
+        "example": "1 GB"
+      }
+    }
+  },
   "premiumSignUpTwoStepOptions": {
     "message": "專有的兩步驟登入選項，例如 YubiKey 和 Duo。"
   },
@@ -3124,6 +3133,15 @@
       }
     }
   },
+  "premiumSubscriptionEnded": {
+    "message": "Your Premium subscription ended"
+  },
+  "premiumSubscriptionEndedDesc": {
+    "message": "To regain access to your archive, restart your Premium subscription. If you edit details for an archived item before restarting, it'll be moved back into your vault."
+  },
+  "restartPremium": {
+    "message": "Restart Premium"
+  },
   "additionalStorageGb": {
     "message": "額外儲存空間 (GB)"
   },
@@ -4608,6 +4626,24 @@
   "learnMore": {
     "message": "深入了解"
   },
+  "migrationsFailed": {
+    "message": "An error occurred updating the encryption settings."
+  },
+  "updateEncryptionSettingsTitle": {
+    "message": "Update your encryption settings"
+  },
+  "updateEncryptionSettingsDesc": {
+    "message": "The new recommended encryption settings will improve your account security. Enter your master password to update now."
+  },
+  "confirmIdentityToContinue": {
+    "message": "Confirm your identity to continue"
+  },
+  "enterYourMasterPassword": {
+    "message": "Enter your master password"
+  },
+  "updateSettings": {
+    "message": "更新設定"
+  },
   "deleteRecoverDesc": {
     "message": "請在下方輸入您的電子郵件地址以復原及刪除您的帳戶。"
   },
@@ -12093,9 +12129,6 @@
   "updateYourEncryptionSettings": {
     "message": "更新您的加密設定"
   },
-  "updateSettings": {
-    "message": "更新設定"
-  },
   "algorithm": {
     "message": "演算法"
   },
diff --git a/bitwarden_license/bit-web/src/app/admin-console/organizations/organizations-routing.module.ts b/bitwarden_license/bit-web/src/app/admin-console/organizations/organizations-routing.module.ts
index 08ee8bb3b1f..602becadd2f 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/organizations/organizations-routing.module.ts
+++ b/bitwarden_license/bit-web/src/app/admin-console/organizations/organizations-routing.module.ts
@@ -2,7 +2,10 @@ import { NgModule } from "@angular/core";
 import { RouterModule, Routes } from "@angular/router";
 
 import { authGuard } from "@bitwarden/angular/auth/guards";
-import { canAccessSettingsTab } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
+import {
+  canAccessAccessIntelligence,
+  canAccessSettingsTab,
+} from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { isEnterpriseOrgGuard } from "@bitwarden/web-vault/app/admin-console/organizations/guards/is-enterprise-org.guard";
 import { organizationPermissionsGuard } from "@bitwarden/web-vault/app/admin-console/organizations/guards/org-permissions.guard";
 import { OrganizationLayoutComponent } from "@bitwarden/web-vault/app/admin-console/organizations/layouts/organization-layout.component";
@@ -79,7 +82,7 @@ const routes: Routes = [
       },
       {
         path: "access-intelligence",
-        canActivate: [organizationPermissionsGuard((org) => org.canAccessReports)],
+        canActivate: [organizationPermissionsGuard(canAccessAccessIntelligence)],
         loadChildren: () =>
           import("../../dirt/access-intelligence/access-intelligence.module").then(
             (m) => m.AccessIntelligenceModule,
diff --git a/bitwarden_license/bit-web/src/app/admin-console/policies/policy-edit-definitions/disable-personal-vault-export.component.ts b/bitwarden_license/bit-web/src/app/admin-console/policies/policy-edit-definitions/disable-personal-vault-export.component.ts
index 0f0fc5f358d..5a9b36912c9 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/policies/policy-edit-definitions/disable-personal-vault-export.component.ts
+++ b/bitwarden_license/bit-web/src/app/admin-console/policies/policy-edit-definitions/disable-personal-vault-export.component.ts
@@ -8,7 +8,7 @@ import {
 import { SharedModule } from "@bitwarden/web-vault/app/shared";
 
 export class DisablePersonalVaultExportPolicy extends BasePolicyEditDefinition {
-  name = "disablePersonalVaultExport";
+  name = "disableExport";
   description = "disablePersonalVaultExportDescription";
   type = PolicyType.DisablePersonalVaultExport;
   component = DisablePersonalVaultExportPolicyComponent;
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.html b/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.html
index 2ab82bd837b..ce89b3c068d 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.html
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.html
@@ -2,18 +2,20 @@
 @let provider = provider$ | async;
 <app-header [title]="pageTitle">
   <bit-search [placeholder]="'search' | i18n" [formControl]="searchControl"></bit-search>
-  <button
-    bitButton
-    buttonType="primary"
-    type="button"
-    [bitMenuTriggerFor]="clientMenu"
-    [disabled]="isSuspensionActive"
-    [title]="isSuspensionActive ? ('providerIsDisabled' | i18n) : ''"
-    appA11yTitle="{{ 'add' | i18n }}"
-  >
-    <i class="bwi bwi-plus bwi-fw" aria-hidden="true"></i>
-    {{ "add" | i18n }}
-  </button>
+  @if (provider?.type === ProviderUserType.ProviderAdmin) {
+    <button
+      bitButton
+      buttonType="primary"
+      type="button"
+      [bitMenuTriggerFor]="clientMenu"
+      [disabled]="isSuspensionActive"
+      [title]="isSuspensionActive ? ('providerIsDisabled' | i18n) : ''"
+      appA11yTitle="{{ 'add' | i18n }}"
+    >
+      <i class="bwi bwi-plus bwi-fw" aria-hidden="true"></i>
+      {{ "add" | i18n }}
+    </button>
+  }
   <bit-menu #clientMenu>
     <button
       type="button"
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.ts b/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.ts
index eed3db87396..4e128a79369 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.ts
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/clients/manage-clients.component.ts
@@ -21,8 +21,6 @@ import { AccountService } from "@bitwarden/common/auth/abstractions/account.serv
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstractions";
 import { PlanResponse } from "@bitwarden/common/billing/models/response/plan.response";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
 import {
@@ -100,19 +98,11 @@ export class ManageClientsComponent implements OnInit, OnDestroy {
     ),
   );
 
-  protected providerPortalTakeover$ = this.configService.getFeatureFlag$(
-    FeatureFlag.PM21821_ProviderPortalTakeover,
-  );
-
   protected suspensionActive$ = combineLatest([
     this.isAdminOrServiceUser$,
-    this.providerPortalTakeover$,
     this.provider$.pipe(map((provider) => provider?.enabled ?? false)),
   ]).pipe(
-    map(
-      ([isAdminOrServiceUser, portalTakeoverEnabled, providerEnabled]) =>
-        isAdminOrServiceUser && portalTakeoverEnabled && !providerEnabled,
-    ),
+    map(([isAdminOrServiceUser, providerEnabled]) => isAdminOrServiceUser && !providerEnabled),
   );
 
   private destroy$ = new Subject<void>();
@@ -127,7 +117,6 @@ export class ManageClientsComponent implements OnInit, OnDestroy {
     private validationService: ValidationService,
     private webProviderService: WebProviderService,
     private billingNotificationService: BillingNotificationService,
-    private configService: ConfigService,
     private accountService: AccountService,
     private providerApiService: ProviderApiServiceAbstraction,
   ) {}
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/manage/members.component.ts b/bitwarden_license/bit-web/src/app/admin-console/providers/manage/members.component.ts
index 268a82ac12f..6e9209be882 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/manage/members.component.ts
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/manage/members.component.ts
@@ -19,6 +19,8 @@ import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { assertNonNullish } from "@bitwarden/common/auth/utils";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { ListResponse } from "@bitwarden/common/models/response/list.response";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
@@ -27,6 +29,8 @@ import { DialogRef, DialogService, ToastService } from "@bitwarden/components";
 import { KeyService } from "@bitwarden/key-management";
 import { BaseMembersComponent } from "@bitwarden/web-vault/app/admin-console/common/base-members.component";
 import {
+  CloudBulkReinviteLimit,
+  MaxCheckedCount,
   peopleFilter,
   PeopleTableDataSource,
 } from "@bitwarden/web-vault/app/admin-console/common/people-table-data-source";
@@ -56,7 +60,7 @@ class MembersTableDataSource extends PeopleTableDataSource<ProviderUser> {
 })
 export class MembersComponent extends BaseMembersComponent<ProviderUser> {
   accessEvents = false;
-  dataSource = new MembersTableDataSource();
+  dataSource: MembersTableDataSource;
   loading = true;
   providerId: string;
   rowHeight = 70;
@@ -81,6 +85,8 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
     private providerService: ProviderService,
     private router: Router,
     private accountService: AccountService,
+    private configService: ConfigService,
+    private environmentService: EnvironmentService,
   ) {
     super(
       apiService,
@@ -94,6 +100,8 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
       toastService,
     );
 
+    this.dataSource = new MembersTableDataSource(this.configService, this.environmentService);
+
     combineLatest([
       this.activatedRoute.parent.params,
       this.activatedRoute.queryParams.pipe(first()),
@@ -134,10 +142,12 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
       return;
     }
 
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
     const dialogRef = BulkConfirmDialogComponent.open(this.dialogService, {
       data: {
         providerId: this.providerId,
-        users: this.dataSource.getCheckedUsers(),
+        users: users,
       },
     });
 
@@ -150,10 +160,28 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
       return;
     }
 
-    const checkedUsers = this.dataSource.getCheckedUsers();
-    const checkedInvitedUsers = checkedUsers.filter(
-      (user) => user.status === ProviderUserStatusType.Invited,
-    );
+    let users: ProviderUser[];
+    if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+      users = this.dataSource.getCheckedUsersInVisibleOrder();
+    } else {
+      users = this.dataSource.getCheckedUsers();
+    }
+
+    const allInvitedUsers = users.filter((user) => user.status === ProviderUserStatusType.Invited);
+
+    // Capture the original count BEFORE enforcing the limit
+    const originalInvitedCount = allInvitedUsers.length;
+
+    // When feature flag is enabled, limit invited users and uncheck the excess
+    let checkedInvitedUsers: ProviderUser[];
+    if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+      checkedInvitedUsers = this.dataSource.limitAndUncheckExcess(
+        allInvitedUsers,
+        CloudBulkReinviteLimit,
+      );
+    } else {
+      checkedInvitedUsers = allInvitedUsers;
+    }
 
     if (checkedInvitedUsers.length <= 0) {
       this.toastService.showToast({
@@ -165,20 +193,50 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
     }
 
     try {
-      const request = this.apiService.postManyProviderUserReinvite(
-        this.providerId,
-        new ProviderUserBulkRequest(checkedInvitedUsers.map((user) => user.id)),
-      );
+      // When feature flag is enabled, show toast instead of dialog
+      if (this.dataSource.isIncreasedBulkLimitEnabled()) {
+        await this.apiService.postManyProviderUserReinvite(
+          this.providerId,
+          new ProviderUserBulkRequest(checkedInvitedUsers.map((user) => user.id)),
+        );
 
-      const dialogRef = BulkStatusComponent.open(this.dialogService, {
-        data: {
-          users: checkedUsers,
-          filteredUsers: checkedInvitedUsers,
-          request,
-          successfulMessage: this.i18nService.t("bulkReinviteMessage"),
-        },
-      });
-      await lastValueFrom(dialogRef.closed);
+        const selectedCount = originalInvitedCount;
+        const invitedCount = checkedInvitedUsers.length;
+
+        if (selectedCount > CloudBulkReinviteLimit) {
+          const excludedCount = selectedCount - CloudBulkReinviteLimit;
+          this.toastService.showToast({
+            variant: "success",
+            message: this.i18nService.t(
+              "bulkReinviteLimitedSuccessToast",
+              CloudBulkReinviteLimit.toLocaleString(),
+              selectedCount.toLocaleString(),
+              excludedCount.toLocaleString(),
+            ),
+          });
+        } else {
+          this.toastService.showToast({
+            variant: "success",
+            message: this.i18nService.t("bulkReinviteSuccessToast", invitedCount.toString()),
+          });
+        }
+      } else {
+        // Feature flag disabled - show legacy dialog
+        const request = this.apiService.postManyProviderUserReinvite(
+          this.providerId,
+          new ProviderUserBulkRequest(checkedInvitedUsers.map((user) => user.id)),
+        );
+
+        const dialogRef = BulkStatusComponent.open(this.dialogService, {
+          data: {
+            users: users,
+            filteredUsers: checkedInvitedUsers,
+            request,
+            successfulMessage: this.i18nService.t("bulkReinviteMessage"),
+          },
+        });
+        await lastValueFrom(dialogRef.closed);
+      }
     } catch (error) {
       this.validationService.showError(error);
     }
@@ -193,10 +251,12 @@ export class MembersComponent extends BaseMembersComponent<ProviderUser> {
       return;
     }
 
+    const users = this.dataSource.getCheckedUsersWithLimit(MaxCheckedCount);
+
     const dialogRef = BulkRemoveDialogComponent.open(this.dialogService, {
       data: {
         providerId: this.providerId,
-        users: this.dataSource.getCheckedUsers(),
+        users: users,
       },
     });
 
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.html b/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.html
index ab4aaa6bd69..15536b22ae6 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.html
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.html
@@ -12,7 +12,7 @@
       route="clients"
     >
       <i
-        *ngIf="!provider.enabled && (providerPortalTakeover$ | async)"
+        *ngIf="!provider.enabled"
         slot="end"
         class="bwi bwi-exclamation-triangle tw-text-danger"
         title="{{ 'providerIsDisabled' | i18n }}"
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.ts b/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.ts
index 2e0cf2163a4..65f85616dfa 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.ts
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/providers-layout.component.ts
@@ -13,8 +13,6 @@ import { ProviderType } from "@bitwarden/common/admin-console/enums";
 import { Provider } from "@bitwarden/common/admin-console/models/domain/provider";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { IconModule } from "@bitwarden/components";
 import { NonIndividualSubscriber } from "@bitwarden/web-vault/app/billing/types";
 import { TaxIdWarningComponent } from "@bitwarden/web-vault/app/billing/warnings/components";
@@ -48,7 +46,6 @@ export class ProvidersLayoutComponent implements OnInit, OnDestroy {
   protected canAccessBilling$: Observable<boolean>;
 
   protected clientsTranslationKey$: Observable<string>;
-  protected providerPortalTakeover$: Observable<boolean>;
 
   protected subscriber$: Observable<NonIndividualSubscriber>;
   protected getTaxIdWarning$: () => Observable<TaxIdWarningType>;
@@ -56,7 +53,6 @@ export class ProvidersLayoutComponent implements OnInit, OnDestroy {
   constructor(
     private route: ActivatedRoute,
     private providerService: ProviderService,
-    private configService: ConfigService,
     private providerWarningsService: ProviderWarningsService,
     private accountService: AccountService,
   ) {}
@@ -101,10 +97,6 @@ export class ProvidersLayoutComponent implements OnInit, OnDestroy {
       )
       .subscribe();
 
-    this.providerPortalTakeover$ = this.configService.getFeatureFlag$(
-      FeatureFlag.PM21821_ProviderPortalTakeover,
-    );
-
     this.subscriber$ = this.provider$.pipe(
       map((provider) => ({
         type: "provider",
diff --git a/bitwarden_license/bit-web/src/app/admin-console/providers/verify-recover-delete-provider.component.html b/bitwarden_license/bit-web/src/app/admin-console/providers/verify-recover-delete-provider.component.html
index e1f99122b22..6965dbe8198 100644
--- a/bitwarden_license/bit-web/src/app/admin-console/providers/verify-recover-delete-provider.component.html
+++ b/bitwarden_license/bit-web/src/app/admin-console/providers/verify-recover-delete-provider.component.html
@@ -1,5 +1,5 @@
 <h2 class="tw-text-center tw-mb-4">{{ "deleteProvider" | i18n }}</h2>
-<app-callout type="warning">{{ "deleteProviderWarning" | i18n }}</app-callout>
+<bit-callout type="warning">{{ "deleteProviderWarning" | i18n }}</bit-callout>
 <p class="tw-text-center">
   <strong>{{ name }}</strong>
 </p>
diff --git a/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.spec.ts b/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.spec.ts
index 0eb25bff524..b3e4cd9bcc7 100644
--- a/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.spec.ts
+++ b/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.spec.ts
@@ -5,7 +5,6 @@ import { of } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { Provider } from "@bitwarden/common/admin-console/models/domain/provider";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { ProviderId } from "@bitwarden/common/types/guid";
@@ -21,7 +20,6 @@ describe("ProviderWarningsService", () => {
   let service: ProviderWarningsService;
   let activatedRoute: MockProxy<ActivatedRoute>;
   let apiService: MockProxy<ApiService>;
-  let configService: MockProxy<ConfigService>;
   let dialogService: MockProxy<DialogService>;
   let i18nService: MockProxy<I18nService>;
   let router: MockProxy<Router>;
@@ -42,7 +40,6 @@ describe("ProviderWarningsService", () => {
   beforeEach(() => {
     activatedRoute = mock<ActivatedRoute>();
     apiService = mock<ApiService>();
-    configService = mock<ConfigService>();
     dialogService = mock<DialogService>();
     i18nService = mock<I18nService>();
     router = mock<Router>();
@@ -72,7 +69,6 @@ describe("ProviderWarningsService", () => {
         ProviderWarningsService,
         { provide: ActivatedRoute, useValue: activatedRoute },
         { provide: ApiService, useValue: apiService },
-        { provide: ConfigService, useValue: configService },
         { provide: DialogService, useValue: dialogService },
         { provide: I18nService, useValue: i18nService },
         { provide: Router, useValue: router },
@@ -211,22 +207,7 @@ describe("ProviderWarningsService", () => {
   });
 
   describe("showProviderSuspendedDialog$", () => {
-    it("should not show dialog when feature flag is disabled", (done) => {
-      configService.getFeatureFlag$.mockReturnValue(of(false));
-      apiService.send.mockResolvedValue({
-        Suspension: { Resolution: "add_payment_method" },
-      });
-
-      service.showProviderSuspendedDialog$(provider).subscribe({
-        complete: () => {
-          expect(dialogService.openSimpleDialog).not.toHaveBeenCalled();
-          done();
-        },
-      });
-    });
-
     it("should not show dialog when no suspension warning exists", (done) => {
-      configService.getFeatureFlag$.mockReturnValue(of(true));
       apiService.send.mockResolvedValue({});
 
       service.showProviderSuspendedDialog$(provider).subscribe({
@@ -239,7 +220,6 @@ describe("ProviderWarningsService", () => {
 
     it("should show add payment method dialog with cancellation date", (done) => {
       const cancelsAt = new Date(2024, 11, 31);
-      configService.getFeatureFlag$.mockReturnValue(of(true));
       apiService.send.mockResolvedValue({
         Suspension: {
           Resolution: "add_payment_method",
@@ -282,7 +262,6 @@ describe("ProviderWarningsService", () => {
     });
 
     it("should show add payment method dialog without cancellation date", (done) => {
-      configService.getFeatureFlag$.mockReturnValue(of(true));
       apiService.send.mockResolvedValue({
         Suspension: {
           Resolution: "add_payment_method",
@@ -319,7 +298,6 @@ describe("ProviderWarningsService", () => {
     });
 
     it("should show contact administrator dialog for contact_administrator resolution", (done) => {
-      configService.getFeatureFlag$.mockReturnValue(of(true));
       apiService.send.mockResolvedValue({
         Suspension: {
           Resolution: "contact_administrator",
@@ -343,7 +321,6 @@ describe("ProviderWarningsService", () => {
     });
 
     it("should show contact support dialog with action for contact_support resolution", (done) => {
-      configService.getFeatureFlag$.mockReturnValue(of(true));
       apiService.send.mockResolvedValue({
         Suspension: {
           Resolution: "contact_support",
diff --git a/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.ts b/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.ts
index 89ddf4b4788..7ff36cc2db8 100644
--- a/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.ts
+++ b/bitwarden_license/bit-web/src/app/billing/providers/warnings/services/provider-warnings.service.ts
@@ -2,7 +2,6 @@ import { Injectable } from "@angular/core";
 import { ActivatedRoute, Router } from "@angular/router";
 import {
   BehaviorSubject,
-  combineLatest,
   from,
   lastValueFrom,
   map,
@@ -16,8 +15,6 @@ import {
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { Provider } from "@bitwarden/common/admin-console/models/domain/provider";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { ProviderId } from "@bitwarden/common/types/guid";
@@ -39,7 +36,6 @@ export class ProviderWarningsService {
   constructor(
     private activatedRoute: ActivatedRoute,
     private apiService: ApiService,
-    private configService: ConfigService,
     private dialogService: DialogService,
     private i18nService: I18nService,
     private router: Router,
@@ -61,12 +57,9 @@ export class ProviderWarningsService {
   refreshTaxIdWarning = () => this.refreshTaxIdWarningTrigger.next();
 
   showProviderSuspendedDialog$ = (provider: Provider): Observable<void> =>
-    combineLatest([
-      this.configService.getFeatureFlag$(FeatureFlag.PM21821_ProviderPortalTakeover),
-      this.getWarning$(provider, (response) => response.suspension),
-    ]).pipe(
-      switchMap(async ([providerPortalTakeover, warning]) => {
-        if (!providerPortalTakeover || !warning) {
+    this.getWarning$(provider, (response) => response.suspension).pipe(
+      switchMap(async (warning) => {
+        if (!warning) {
           return;
         }
 
diff --git a/bitwarden_license/bit-web/src/app/dirt/access-intelligence/access-intelligence-routing.module.ts b/bitwarden_license/bit-web/src/app/dirt/access-intelligence/access-intelligence-routing.module.ts
index 4bdc8e25047..85c6dbdd206 100644
--- a/bitwarden_license/bit-web/src/app/dirt/access-intelligence/access-intelligence-routing.module.ts
+++ b/bitwarden_license/bit-web/src/app/dirt/access-intelligence/access-intelligence-routing.module.ts
@@ -1,6 +1,7 @@
 import { NgModule } from "@angular/core";
 import { RouterModule, Routes } from "@angular/router";
 
+import { canAccessAccessIntelligence } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { organizationPermissionsGuard } from "@bitwarden/web-vault/app/admin-console/organizations/guards/org-permissions.guard";
 
 import { RiskInsightsComponent } from "./risk-insights.component";
@@ -8,7 +9,7 @@ import { RiskInsightsComponent } from "./risk-insights.component";
 const routes: Routes = [
   {
     path: "",
-    canActivate: [organizationPermissionsGuard((org) => org.canAccessReports)],
+    canActivate: [organizationPermissionsGuard(canAccessAccessIntelligence)],
     component: RiskInsightsComponent,
     data: {
       titleId: "accessIntelligence",
diff --git a/bitwarden_license/bit-web/src/app/dirt/access-intelligence/shared/app-table-row-scrollable.component.html b/bitwarden_license/bit-web/src/app/dirt/access-intelligence/shared/app-table-row-scrollable.component.html
index 76a03e0c525..0494f77bd46 100644
--- a/bitwarden_license/bit-web/src/app/dirt/access-intelligence/shared/app-table-row-scrollable.component.html
+++ b/bitwarden_license/bit-web/src/app/dirt/access-intelligence/shared/app-table-row-scrollable.component.html
@@ -45,7 +45,11 @@
         tabindex="0"
         [attr.aria-label]="'viewItem' | i18n"
       >
-        <app-vault-icon *ngIf="row.iconCipher" [cipher]="row.iconCipher"></app-vault-icon>
+        <app-vault-icon
+          *ngIf="row.iconCipher"
+          [cipher]="row.iconCipher"
+          [size]="24"
+        ></app-vault-icon>
       </td>
       <td
         class="tw-cursor-pointer"
diff --git a/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.spec.ts b/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.spec.ts
index 694b0f1d1a2..322d383434a 100644
--- a/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.spec.ts
+++ b/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.spec.ts
@@ -7,16 +7,16 @@ import { mock } from "jest-mock-extended";
 import { Observable, of } from "rxjs";
 
 import { PolicyResponse } from "@bitwarden/common/admin-console/models/response/policy.response";
+import {
+  SessionTimeoutAction,
+  SessionTimeoutType,
+} from "@bitwarden/common/key-management/session-timeout";
 import { VaultTimeoutAction } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { DialogRef, DialogService } from "@bitwarden/components";
 
 import { SessionTimeoutConfirmationNeverComponent } from "./session-timeout-confirmation-never.component";
-import {
-  SessionTimeoutAction,
-  SessionTimeoutPolicyComponent,
-  SessionTimeoutType,
-} from "./session-timeout.component";
+import { SessionTimeoutPolicyComponent } from "./session-timeout.component";
 
 // Mock DialogRef, so we can mock "readonly closed" property.
 class MockDialogRef extends DialogRef {
diff --git a/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.ts b/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.ts
index 9c6129f64df..fd541d30408 100644
--- a/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.ts
+++ b/bitwarden_license/bit-web/src/app/key-management/policies/session-timeout.component.ts
@@ -10,26 +10,22 @@ import {
 } from "rxjs";
 
 import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import {
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutAction,
+  SessionTimeoutType,
+} from "@bitwarden/common/key-management/session-timeout";
 import { VaultTimeoutAction } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { DialogService } from "@bitwarden/components";
 import {
-  BasePolicyEditDefinition,
   BasePolicyEditComponent,
+  BasePolicyEditDefinition,
 } from "@bitwarden/web-vault/app/admin-console/organizations/policies";
 import { SharedModule } from "@bitwarden/web-vault/app/shared";
 
 import { SessionTimeoutConfirmationNeverComponent } from "./session-timeout-confirmation-never.component";
 
-export type SessionTimeoutAction = null | "lock" | "logOut";
-export type SessionTimeoutType =
-  | null
-  | "never"
-  | "onAppRestart"
-  | "onSystemLock"
-  | "immediately"
-  | "custom";
-
 export class SessionTimeoutPolicy extends BasePolicyEditDefinition {
   name = "sessionTimeoutPolicyTitle";
   description = "sessionTimeoutPolicyDescription";
@@ -50,9 +46,6 @@ export class SessionTimeoutPolicyComponent
   extends BasePolicyEditComponent
   implements OnInit, OnDestroy
 {
-  private destroy$ = new Subject<void>();
-  private lastConfirmedType$ = new BehaviorSubject<SessionTimeoutType>(null);
-
   actionOptions: { name: string; value: SessionTimeoutAction }[];
   typeOptions: { name: string; value: SessionTimeoutType }[];
   data = this.formBuilder.group({
@@ -74,6 +67,9 @@ export class SessionTimeoutPolicyComponent
     action: new FormControl<SessionTimeoutAction>(null),
   });
 
+  private destroy$ = new Subject<void>();
+  private lastConfirmedType$ = new BehaviorSubject<SessionTimeoutType>(null);
+
   constructor(
     private formBuilder: FormBuilder,
     private i18nService: I18nService,
@@ -123,12 +119,10 @@ export class SessionTimeoutPolicyComponent
   }
 
   protected override loadData() {
-    const minutes: number | null = this.policyResponse?.data?.minutes ?? null;
-    const action: SessionTimeoutAction =
-      this.policyResponse?.data?.action ?? (null satisfies SessionTimeoutAction);
+    const minutes: number | null = this.policyData?.minutes ?? null;
+    const action: SessionTimeoutAction = this.policyData?.action ?? null;
     // For backward compatibility, the "type" field might not exist, hence we initialize it based on the presence of "minutes"
-    const type: SessionTimeoutType =
-      this.policyResponse?.data?.type ?? ((minutes ? "custom" : null) satisfies SessionTimeoutType);
+    const type: SessionTimeoutType = this.policyData?.type ?? (minutes ? "custom" : null);
 
     this.updateFormControls(type);
     this.data.patchValue({
@@ -165,7 +159,11 @@ export class SessionTimeoutPolicyComponent
       type,
       minutes,
       action: this.data.value.action,
-    };
+    } satisfies MaximumSessionTimeoutPolicyData;
+  }
+
+  private get policyData(): MaximumSessionTimeoutPolicyData | null {
+    return this.policyResponse?.data ?? null;
   }
 
   private async confirmTypeChange(newType: SessionTimeoutType): Promise<boolean> {
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 881cd5e1f4d..e8f43d4a9ea 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -197,7 +197,7 @@ export default tseslint.config(
         {
           // uses negative lookahead to whitelist any class that doesn't start with "tw-"
           // in other words: classnames that start with tw- must be valid TailwindCSS classes
-          whitelist: ["(?!(tw)\\-).*"],
+          whitelist: ["(?!(tw)\\-).*", "tw-app-region-drag", "tw-app-region-no-drag"],
         },
       ],
       "tailwindcss/enforces-negative-arbitrary-values": "error",
@@ -349,6 +349,7 @@ export default tseslint.config(
             "file-selector",
             "mfaType.*",
             "filter.*", // Temporary until filters are migrated
+            "tw-app-region*", // Custom utility for native passkey modals
             "tw-@container",
           ],
         },
diff --git a/libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts b/libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts
index fa2a01fe8e1..b4d856309ed 100644
--- a/libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts
+++ b/libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts
@@ -2,7 +2,7 @@
 // @ts-strict-ignore
 import { CommonModule } from "@angular/common";
 import { Component, OnInit } from "@angular/core";
-import { Router, RouterModule } from "@angular/router";
+import { ActivatedRoute, Router, RouterModule } from "@angular/router";
 import { firstValueFrom } from "rxjs";
 
 import { JslibModule } from "@bitwarden/angular/jslib.module";
@@ -19,6 +19,7 @@ import { ClientType } from "@bitwarden/common/enums";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
 import {
@@ -49,6 +50,7 @@ export type State = "assert" | "assertFailed";
 })
 export class LoginViaWebAuthnComponent implements OnInit {
   protected currentState: State = "assert";
+  private shouldAutoClosePopout = false;
 
   protected readonly Icons = {
     TwoFactorAuthSecurityKeyIcon,
@@ -70,6 +72,7 @@ export class LoginViaWebAuthnComponent implements OnInit {
   constructor(
     private webAuthnLoginService: WebAuthnLoginServiceAbstraction,
     private router: Router,
+    private route: ActivatedRoute,
     private logService: LogService,
     private validationService: ValidationService,
     private i18nService: I18nService,
@@ -77,9 +80,14 @@ export class LoginViaWebAuthnComponent implements OnInit {
     private keyService: KeyService,
     private platformUtilsService: PlatformUtilsService,
     private anonLayoutWrapperDataService: AnonLayoutWrapperDataService,
+    private messagingService: MessagingService,
   ) {}
 
   ngOnInit(): void {
+    // Check if we should auto-close the popout after successful authentication
+    this.shouldAutoClosePopout =
+      this.route.snapshot.queryParamMap.get("autoClosePopout") === "true";
+
     // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
     // eslint-disable-next-line @typescript-eslint/no-floating-promises
     this.authenticate();
@@ -120,7 +128,18 @@ export class LoginViaWebAuthnComponent implements OnInit {
       // Only run loginSuccessHandlerService if webAuthn is used for vault decryption.
       const userKey = await firstValueFrom(this.keyService.userKey$(authResult.userId));
       if (userKey) {
-        await this.loginSuccessHandlerService.run(authResult.userId);
+        await this.loginSuccessHandlerService.run(authResult.userId, null);
+      }
+
+      // If autoClosePopout is enabled and we're in a browser extension,
+      // re-open the regular popup and close this popout window
+      if (
+        this.shouldAutoClosePopout &&
+        this.platformUtilsService.getClientType() === ClientType.Browser
+      ) {
+        this.messagingService.send("openPopup");
+        window.close();
+        return;
       }
 
       await this.router.navigate([this.successRoute]);
diff --git a/libs/angular/src/billing/components/premium-badge/premium-badge.component.ts b/libs/angular/src/billing/components/premium-badge/premium-badge.component.ts
index 8890584186d..2ae9c801eec 100644
--- a/libs/angular/src/billing/components/premium-badge/premium-badge.component.ts
+++ b/libs/angular/src/billing/components/premium-badge/premium-badge.component.ts
@@ -14,10 +14,11 @@ import { BadgeModule } from "@bitwarden/components";
       type="button"
       *appNotPremium
       bitBadge
-      variant="success"
+      [variant]="'primary'"
+      class="!tw-text-primary-600 !tw-border-primary-600"
       (click)="promptForPremium($event)"
     >
-      {{ "premium" | i18n }}
+      <i class="bwi bwi-premium tw-pe-1"></i>{{ "upgrade" | i18n }}
     </button>
   `,
   imports: [BadgeModule, JslibModule],
diff --git a/libs/angular/src/billing/components/premium-badge/premium-badge.stories.ts b/libs/angular/src/billing/components/premium-badge/premium-badge.stories.ts
index bf50d16d3c4..f6e45dbd5e1 100644
--- a/libs/angular/src/billing/components/premium-badge/premium-badge.stories.ts
+++ b/libs/angular/src/billing/components/premium-badge/premium-badge.stories.ts
@@ -29,7 +29,7 @@ export default {
           provide: I18nService,
           useFactory: () => {
             return new I18nMockService({
-              premium: "Premium",
+              upgrade: "Upgrade",
             });
           },
         },
diff --git a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.html b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.html
index 3b89d7cf56a..52cd36e9356 100644
--- a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.html
+++ b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.html
@@ -20,33 +20,35 @@
       <div
         class="tw-box-border tw-bg-background tw-text-main tw-size-full tw-flex tw-flex-col tw-px-8 tw-pb-2 tw-w-full tw-max-w-md"
       >
-        <div class="tw-flex tw-items-center tw-justify-between tw-mb-2">
+        <div class="tw-flex tw-items-center tw-justify-between">
           <h3 slot="title" class="tw-m-0" bitTypography="h3">
             {{ "upgradeToPremium" | i18n }}
           </h3>
         </div>
 
         <!-- Tagline with consistent height (exactly 2 lines) -->
-        <div class="tw-mb-6 tw-h-6">
+        <div class="tw-h-6">
           <p bitTypography="helper" class="tw-text-muted tw-m-0 tw-leading-relaxed tw-line-clamp-2">
             {{ cardDetails.tagline }}
           </p>
         </div>
 
         <!-- Price Section -->
-        <div class="tw-mb-6">
-          <div class="tw-flex tw-items-baseline tw-gap-1 tw-flex-wrap">
-            <span class="tw-text-3xl tw-font-medium tw-leading-none tw-m-0">{{
-              cardDetails.price.amount | currency: "$"
-            }}</span>
-            <span bitTypography="helper" class="tw-text-muted">
-              / {{ cardDetails.price.cadence | i18n }}
-            </span>
+        @if (cardDetails.price) {
+          <div class="tw-mt-5">
+            <div class="tw-flex tw-items-baseline tw-gap-1 tw-flex-wrap">
+              <span class="tw-text-3xl tw-font-medium tw-leading-none tw-m-0">{{
+                cardDetails.price.amount | currency: "$"
+              }}</span>
+              <span bitTypography="helper" class="tw-text-muted">
+                / {{ cardDetails.price.cadence | i18n }}
+              </span>
+            </div>
           </div>
-        </div>
+        }
 
         <!-- Button space (always reserved) -->
-        <div class="tw-mb-6 tw-h-12">
+        <div class="tw-my-5 tw-h-12">
           <button
             bitButton
             [buttonType]="cardDetails.button.type"
diff --git a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.spec.ts b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.spec.ts
index 107eb068e76..eff9dcded79 100644
--- a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.spec.ts
+++ b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.spec.ts
@@ -40,6 +40,7 @@ describe("PremiumUpgradeDialogComponent", () => {
       type: "standalone",
       annualPrice: 10,
       annualPricePerAdditionalStorageGB: 4,
+      providedStorageGB: 1,
       features: [
         { key: "feature1", value: "Feature 1" },
         { key: "feature2", value: "Feature 2" },
@@ -58,6 +59,7 @@ describe("PremiumUpgradeDialogComponent", () => {
       users: 6,
       annualPrice: 40,
       annualPricePerAdditionalStorageGB: 4,
+      providedStorageGB: 1,
       features: [{ key: "featureA", value: "Feature A" }],
     },
   };
@@ -204,4 +206,39 @@ describe("PremiumUpgradeDialogComponent", () => {
       });
     });
   });
+
+  describe("self-hosted environment", () => {
+    it("should handle null price data for self-hosted environment", async () => {
+      const selfHostedPremiumTier: PersonalSubscriptionPricingTier = {
+        id: PersonalSubscriptionPricingTierIds.Premium,
+        name: "Premium",
+        description: "Advanced features for power users",
+        availableCadences: [SubscriptionCadenceIds.Annually],
+        passwordManager: {
+          type: "standalone",
+          annualPrice: undefined as any, // self-host will have these prices empty
+          annualPricePerAdditionalStorageGB: undefined as any,
+          providedStorageGB: undefined as any,
+          features: [
+            { key: "feature1", value: "Feature 1" },
+            { key: "feature2", value: "Feature 2" },
+          ],
+        },
+      };
+
+      mockSubscriptionPricingService.getPersonalSubscriptionPricingTiers$.mockReturnValue(
+        of([selfHostedPremiumTier]),
+      );
+
+      const selfHostedFixture = TestBed.createComponent(PremiumUpgradeDialogComponent);
+      const selfHostedComponent = selfHostedFixture.componentInstance;
+      selfHostedFixture.detectChanges();
+
+      const cardDetails = await firstValueFrom(selfHostedComponent["cardDetails$"]);
+
+      expect(cardDetails?.title).toBe("Premium");
+      expect(cardDetails?.price).toBeUndefined();
+      expect(cardDetails?.features).toEqual(["Feature 1", "Feature 2"]);
+    });
+  });
 });
diff --git a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.stories.ts b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.stories.ts
index 7ba09192d3c..92a0a638217 100644
--- a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.stories.ts
+++ b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.stories.ts
@@ -31,6 +31,24 @@ const mockPremiumTier: PersonalSubscriptionPricingTier = {
     type: "standalone",
     annualPrice: 10,
     annualPricePerAdditionalStorageGB: 4,
+    providedStorageGB: 1,
+    features: [
+      { key: "builtInAuthenticator", value: "Built-in authenticator" },
+      { key: "secureFileStorage", value: "Secure file storage" },
+      { key: "emergencyAccess", value: "Emergency access" },
+      { key: "breachMonitoring", value: "Breach monitoring" },
+      { key: "andMoreFeatures", value: "And more!" },
+    ],
+  },
+};
+
+const mockPremiumTierNoPricingData: PersonalSubscriptionPricingTier = {
+  id: PersonalSubscriptionPricingTierIds.Premium,
+  name: "Premium",
+  description: "Complete online security",
+  availableCadences: [SubscriptionCadenceIds.Annually],
+  passwordManager: {
+    type: "standalone",
     features: [
       { key: "builtInAuthenticator", value: "Built-in authenticator" },
       { key: "secureFileStorage", value: "Secure file storage" },
@@ -85,11 +103,11 @@ export default {
             t: (key: string) => {
               switch (key) {
                 case "upgradeNow":
-                  return "Upgrade Now";
+                  return "Upgrade now";
                 case "month":
                   return "month";
                 case "upgradeToPremium":
-                  return "Upgrade To Premium";
+                  return "Upgrade to Premium";
                 default:
                   return key;
               }
@@ -115,3 +133,18 @@ export default {
 
 type Story = StoryObj<PremiumUpgradeDialogComponent>;
 export const Default: Story = {};
+
+export const NoPricingData: Story = {
+  decorators: [
+    moduleMetadata({
+      providers: [
+        {
+          provide: SubscriptionPricingServiceAbstraction,
+          useValue: {
+            getPersonalSubscriptionPricingTiers$: () => of([mockPremiumTierNoPricingData]),
+          },
+        },
+      ],
+    }),
+  ],
+};
diff --git a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.ts b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.ts
index ea9def03bd2..572fe54d2ee 100644
--- a/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.ts
+++ b/libs/angular/src/billing/components/premium-upgrade-dialog/premium-upgrade-dialog.component.ts
@@ -3,12 +3,12 @@ import { CommonModule } from "@angular/common";
 import { ChangeDetectionStrategy, Component } from "@angular/core";
 import { catchError, EMPTY, firstValueFrom, map, Observable } from "rxjs";
 
+import { SubscriptionPricingCardDetails } from "@bitwarden/angular/billing/types/subscription-pricing-card-details";
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { SubscriptionPricingServiceAbstraction } from "@bitwarden/common/billing/abstractions/subscription-pricing.service.abstraction";
 import {
   PersonalSubscriptionPricingTier,
   PersonalSubscriptionPricingTierIds,
-  SubscriptionCadence,
   SubscriptionCadenceIds,
 } from "@bitwarden/common/billing/types/subscription-pricing-tier";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
@@ -16,7 +16,6 @@ import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.servic
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import {
   ButtonModule,
-  ButtonType,
   CenterPositionStrategy,
   DialogModule,
   DialogRef,
@@ -27,14 +26,6 @@ import {
 } from "@bitwarden/components";
 import { LogService } from "@bitwarden/logging";
 
-type CardDetails = {
-  title: string;
-  tagline: string;
-  price: { amount: number; cadence: SubscriptionCadence };
-  button: { text: string; type: ButtonType; icon?: { type: string; position: "before" | "after" } };
-  features: string[];
-};
-
 @Component({
   selector: "billing-premium-upgrade-dialog",
   standalone: true,
@@ -51,9 +42,8 @@ type CardDetails = {
   templateUrl: "./premium-upgrade-dialog.component.html",
 })
 export class PremiumUpgradeDialogComponent {
-  protected cardDetails$: Observable<CardDetails | null> = this.subscriptionPricingService
-    .getPersonalSubscriptionPricingTiers$()
-    .pipe(
+  protected cardDetails$: Observable<SubscriptionPricingCardDetails | null> =
+    this.subscriptionPricingService.getPersonalSubscriptionPricingTiers$().pipe(
       map((tiers) => tiers.find((tier) => tier.id === PersonalSubscriptionPricingTierIds.Premium)),
       map((tier) => this.mapPremiumTierToCardDetails(tier!)),
       catchError((error: unknown) => {
@@ -91,14 +81,18 @@ export class PremiumUpgradeDialogComponent {
     this.dialogRef.close();
   }
 
-  private mapPremiumTierToCardDetails(tier: PersonalSubscriptionPricingTier): CardDetails {
+  private mapPremiumTierToCardDetails(
+    tier: PersonalSubscriptionPricingTier,
+  ): SubscriptionPricingCardDetails {
     return {
       title: tier.name,
       tagline: tier.description,
-      price: {
-        amount: tier.passwordManager.annualPrice / 12,
-        cadence: SubscriptionCadenceIds.Monthly,
-      },
+      price: tier.passwordManager.annualPrice
+        ? {
+            amount: tier.passwordManager.annualPrice / 12,
+            cadence: SubscriptionCadenceIds.Monthly,
+          }
+        : undefined,
       button: {
         text: this.i18nService.t("upgradeNow"),
         type: "primary",
diff --git a/libs/angular/src/billing/components/premium.component.ts b/libs/angular/src/billing/components/premium.component.ts
index 6d0b90385ba..3f53d62e561 100644
--- a/libs/angular/src/billing/components/premium.component.ts
+++ b/libs/angular/src/billing/components/premium.component.ts
@@ -5,6 +5,7 @@ import { firstValueFrom, Observable, switchMap } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { BillingApiServiceAbstraction } from "@bitwarden/common/billing/abstractions";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -16,6 +17,7 @@ import { DialogService, SimpleDialogOptions, ToastService } from "@bitwarden/com
 export class PremiumComponent implements OnInit {
   isPremium$: Observable<boolean>;
   price = 10;
+  storageProvidedGb = 0;
   refreshPromise: Promise<any>;
   cloudWebVaultUrl: string;
 
@@ -29,6 +31,7 @@ export class PremiumComponent implements OnInit {
     billingAccountProfileStateService: BillingAccountProfileStateService,
     private toastService: ToastService,
     accountService: AccountService,
+    private billingApiService: BillingApiServiceAbstraction,
   ) {
     this.isPremium$ = accountService.activeAccount$.pipe(
       switchMap((account) =>
@@ -39,6 +42,9 @@ export class PremiumComponent implements OnInit {
 
   async ngOnInit() {
     this.cloudWebVaultUrl = await firstValueFrom(this.environmentService.cloudWebVaultUrl$);
+    const premiumResponse = await this.billingApiService.getPremiumPlan();
+    this.storageProvidedGb = premiumResponse.storage.provided;
+    this.price = premiumResponse.seat.price;
   }
 
   async refresh() {
diff --git a/libs/angular/src/billing/types/subscription-pricing-card-details.ts b/libs/angular/src/billing/types/subscription-pricing-card-details.ts
new file mode 100644
index 00000000000..9000b10a729
--- /dev/null
+++ b/libs/angular/src/billing/types/subscription-pricing-card-details.ts
@@ -0,0 +1,10 @@
+import { SubscriptionCadence } from "@bitwarden/common/billing/types/subscription-pricing-tier";
+import { ButtonType } from "@bitwarden/components";
+
+export type SubscriptionPricingCardDetails = {
+  title: string;
+  tagline: string;
+  price?: { amount: number; cadence: SubscriptionCadence };
+  button: { text: string; type: ButtonType; icon?: { type: string; position: "before" | "after" } };
+  features: string[];
+};
diff --git a/libs/angular/src/components/callout.component.html b/libs/angular/src/components/callout.component.html
deleted file mode 100644
index 7e352fa0ced..00000000000
--- a/libs/angular/src/components/callout.component.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<bit-callout [icon]="icon" [title]="title" [type]="$any(type)" [useAlertRole]="useAlertRole">
-  <div class="tw-pl-7 tw-m-0" *ngIf="enforcedPolicyOptions">
-    {{ enforcedPolicyMessage }}
-    <ul>
-      <li *ngIf="enforcedPolicyOptions?.minComplexity > 0">
-        {{ "policyInEffectMinComplexity" | i18n: getPasswordScoreAlertDisplay() }}
-      </li>
-      <li *ngIf="enforcedPolicyOptions?.minLength > 0">
-        {{ "policyInEffectMinLength" | i18n: enforcedPolicyOptions?.minLength.toString() }}
-      </li>
-      <li *ngIf="enforcedPolicyOptions?.requireUpper">
-        {{ "policyInEffectUppercase" | i18n }}
-      </li>
-      <li *ngIf="enforcedPolicyOptions?.requireLower">
-        {{ "policyInEffectLowercase" | i18n }}
-      </li>
-      <li *ngIf="enforcedPolicyOptions?.requireNumbers">
-        {{ "policyInEffectNumbers" | i18n }}
-      </li>
-      <li *ngIf="enforcedPolicyOptions?.requireSpecial">
-        {{ "policyInEffectSpecial" | i18n: "!@#$%^&*" }}
-      </li>
-    </ul>
-  </div>
-  <ng-content></ng-content>
-</bit-callout>
diff --git a/libs/angular/src/components/callout.component.ts b/libs/angular/src/components/callout.component.ts
deleted file mode 100644
index 9630b761076..00000000000
--- a/libs/angular/src/components/callout.component.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Component, Input, OnInit } from "@angular/core";
-
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { CalloutTypes } from "@bitwarden/components";
-
-/**
- * @deprecated use the CL's `CalloutComponent` instead
- */
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
-@Component({
-  selector: "app-callout",
-  templateUrl: "callout.component.html",
-  standalone: false,
-})
-export class DeprecatedCalloutComponent implements OnInit {
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() type: CalloutTypes = "info";
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() icon: string;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() title: string;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() enforcedPolicyOptions: MasterPasswordPolicyOptions;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() enforcedPolicyMessage: string;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() useAlertRole = false;
-
-  calloutStyle: string;
-
-  constructor(private i18nService: I18nService) {}
-
-  ngOnInit() {
-    this.calloutStyle = this.type;
-
-    if (this.enforcedPolicyMessage === undefined) {
-      this.enforcedPolicyMessage = this.i18nService.t("masterPasswordPolicyInEffect");
-    }
-  }
-
-  getPasswordScoreAlertDisplay() {
-    if (this.enforcedPolicyOptions == null) {
-      return "";
-    }
-
-    let str: string;
-    switch (this.enforcedPolicyOptions.minComplexity) {
-      case 4:
-        str = this.i18nService.t("strong");
-        break;
-      case 3:
-        str = this.i18nService.t("good");
-        break;
-      default:
-        str = this.i18nService.t("weak");
-        break;
-    }
-    return str + " (" + this.enforcedPolicyOptions.minComplexity + ")";
-  }
-}
diff --git a/libs/angular/src/jslib.module.ts b/libs/angular/src/jslib.module.ts
index 446530a1111..8d222a4aaf9 100644
--- a/libs/angular/src/jslib.module.ts
+++ b/libs/angular/src/jslib.module.ts
@@ -26,7 +26,6 @@ import {
 
 import { TwoFactorIconComponent } from "./auth/components/two-factor-icon.component";
 import { NotPremiumDirective } from "./billing/directives/not-premium.directive";
-import { DeprecatedCalloutComponent } from "./components/callout.component";
 import { A11yInvalidDirective } from "./directives/a11y-invalid.directive";
 import { ApiActionDirective } from "./directives/api-action.directive";
 import { BoxRowDirective } from "./directives/box-row.directive";
@@ -86,7 +85,6 @@ import { IconComponent } from "./vault/components/icon.component";
     A11yInvalidDirective,
     ApiActionDirective,
     BoxRowDirective,
-    DeprecatedCalloutComponent,
     CopyTextDirective,
     CreditCardNumberPipe,
     EllipsisPipe,
@@ -115,7 +113,6 @@ import { IconComponent } from "./vault/components/icon.component";
     AutofocusDirective,
     ToastModule,
     BoxRowDirective,
-    DeprecatedCalloutComponent,
     CopyTextDirective,
     CreditCardNumberPipe,
     EllipsisPipe,
diff --git a/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.abstraction.ts b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.abstraction.ts
new file mode 100644
index 00000000000..565cbb02cf0
--- /dev/null
+++ b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.abstraction.ts
@@ -0,0 +1,9 @@
+import { UserId } from "@bitwarden/common/types/guid";
+
+export abstract class EncryptedMigrationsSchedulerService {
+  /**
+   * Runs migrations for a user if needed, handling both interactive and non-interactive cases
+   * @param userId The user ID to run migrations for
+   */
+  abstract runMigrationsIfNeeded(userId: UserId): Promise<void>;
+}
diff --git a/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.spec.ts b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.spec.ts
new file mode 100644
index 00000000000..76cfbc0bfdd
--- /dev/null
+++ b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.spec.ts
@@ -0,0 +1,270 @@
+import { Router } from "@angular/router";
+import { mock } from "jest-mock-extended";
+import { of } from "rxjs";
+
+import { AccountInfo } from "@bitwarden/common/auth/abstractions/account.service";
+import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { SingleUserState, StateProvider } from "@bitwarden/common/platform/state";
+import { SyncService } from "@bitwarden/common/platform/sync";
+import { FakeAccountService } from "@bitwarden/common/spec";
+import { UserId } from "@bitwarden/common/types/guid";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { LogService } from "@bitwarden/logging";
+
+import {
+  DefaultEncryptedMigrationsSchedulerService,
+  ENCRYPTED_MIGRATION_DISMISSED,
+} from "./encrypted-migrations-scheduler.service";
+import { PromptMigrationPasswordComponent } from "./prompt-migration-password.component";
+
+const SomeUser = "SomeUser" as UserId;
+const AnotherUser = "SomeOtherUser" as UserId;
+const accounts: Record<UserId, AccountInfo> = {
+  [SomeUser]: {
+    name: "some user",
+    email: "some.user@example.com",
+    emailVerified: true,
+  },
+  [AnotherUser]: {
+    name: "some other user",
+    email: "some.other.user@example.com",
+    emailVerified: true,
+  },
+};
+
+describe("DefaultEncryptedMigrationsSchedulerService", () => {
+  let service: DefaultEncryptedMigrationsSchedulerService;
+  const mockAccountService = new FakeAccountService(accounts);
+  const mockAuthService = mock<AuthService>();
+  const mockEncryptedMigrator = mock<EncryptedMigrator>();
+  const mockStateProvider = mock<StateProvider>();
+  const mockSyncService = mock<SyncService>();
+  const mockDialogService = mock<DialogService>();
+  const mockToastService = mock<ToastService>();
+  const mockI18nService = mock<I18nService>();
+  const mockLogService = mock<LogService>();
+  const mockRouter = mock<Router>();
+
+  const mockUserId = "test-user-id" as UserId;
+  const mockMasterPassword = "test-master-password";
+
+  const createMockUserState = <T>(value: T): jest.Mocked<SingleUserState<T>> =>
+    ({
+      state$: of(value),
+      userId: mockUserId,
+      update: jest.fn(),
+      combinedState$: of([mockUserId, value]),
+    }) as any;
+
+  beforeEach(() => {
+    const mockDialogRef = {
+      closed: of(mockMasterPassword),
+    };
+
+    jest.spyOn(PromptMigrationPasswordComponent, "open").mockReturnValue(mockDialogRef as any);
+    mockI18nService.t.mockReturnValue("translated_migrationsFailed");
+    (mockRouter as any)["events"] = of({ url: "/vault" }) as any;
+
+    service = new DefaultEncryptedMigrationsSchedulerService(
+      mockSyncService,
+      mockAccountService,
+      mockStateProvider,
+      mockEncryptedMigrator,
+      mockAuthService,
+      mockLogService,
+      mockDialogService,
+      mockToastService,
+      mockI18nService,
+      mockRouter,
+    );
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("runMigrationsIfNeeded", () => {
+    it("should return early if user is not unlocked", async () => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Locked));
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.needsMigrations).not.toHaveBeenCalled();
+      expect(mockLogService.info).not.toHaveBeenCalled();
+    });
+
+    it("should log and return when no migration is needed", async () => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("noMigrationNeeded");
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.needsMigrations).toHaveBeenCalledWith(mockUserId);
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        `[EncryptedMigrationsScheduler] No migrations needed for user ${mockUserId}`,
+      );
+      expect(mockEncryptedMigrator.runMigrations).not.toHaveBeenCalled();
+    });
+
+    it("should run migrations without interaction when master password is not required", async () => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("needsMigration");
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.needsMigrations).toHaveBeenCalledWith(mockUserId);
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        `[EncryptedMigrationsScheduler] User ${mockUserId} needs migrations with master password`,
+      );
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(mockUserId, null);
+    });
+
+    it("should run migrations with interaction when migration is needed", async () => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("needsMigrationWithMasterPassword");
+      const mockUserState = createMockUserState(null);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.needsMigrations).toHaveBeenCalledWith(mockUserId);
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        `[EncryptedMigrationsScheduler] User ${mockUserId} needs migrations with master password`,
+      );
+      expect(PromptMigrationPasswordComponent.open).toHaveBeenCalledWith(mockDialogService);
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(
+        mockUserId,
+        mockMasterPassword,
+      );
+    });
+  });
+
+  describe("runMigrationsWithoutInteraction", () => {
+    it("should run migrations without master password", async () => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("needsMigration");
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(mockUserId, null);
+      expect(mockLogService.error).not.toHaveBeenCalled();
+    });
+
+    it("should handle errors during migration without interaction", async () => {
+      const mockError = new Error("Migration failed");
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("needsMigration");
+      mockEncryptedMigrator.runMigrations.mockRejectedValue(mockError);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(mockUserId, null);
+      expect(mockLogService.error).toHaveBeenCalledWith(
+        "[EncryptedMigrationsScheduler] Error during migration without interaction",
+        mockError,
+      );
+    });
+  });
+
+  describe("runMigrationsWithInteraction", () => {
+    beforeEach(() => {
+      mockAuthService.authStatusFor$.mockReturnValue(of(AuthenticationStatus.Unlocked));
+      mockEncryptedMigrator.needsMigrations.mockResolvedValue("needsMigrationWithMasterPassword");
+    });
+
+    it("should skip if migration was dismissed recently", async () => {
+      const recentDismissDate = new Date(Date.now() - 12 * 60 * 60 * 1000); // 12 hours ago
+      const mockUserState = createMockUserState(recentDismissDate);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockStateProvider.getUser).toHaveBeenCalledWith(
+        mockUserId,
+        ENCRYPTED_MIGRATION_DISMISSED,
+      );
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        "[EncryptedMigrationsScheduler] Migration prompt dismissed recently, skipping for now.",
+      );
+      expect(PromptMigrationPasswordComponent.open).not.toHaveBeenCalled();
+    });
+
+    it("should prompt for migration if dismissed date is older than 24 hours", async () => {
+      const oldDismissDate = new Date(Date.now() - 25 * 60 * 60 * 1000); // 25 hours ago
+      const mockUserState = createMockUserState(oldDismissDate);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(mockStateProvider.getUser).toHaveBeenCalledWith(
+        mockUserId,
+        ENCRYPTED_MIGRATION_DISMISSED,
+      );
+      expect(PromptMigrationPasswordComponent.open).toHaveBeenCalledWith(mockDialogService);
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(
+        mockUserId,
+        mockMasterPassword,
+      );
+    });
+
+    it("should prompt for migration if no dismiss date exists", async () => {
+      const mockUserState = createMockUserState(null);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(PromptMigrationPasswordComponent.open).toHaveBeenCalledWith(mockDialogService);
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(
+        mockUserId,
+        mockMasterPassword,
+      );
+    });
+
+    it("should set dismiss date when empty password is provided", async () => {
+      const mockUserState = createMockUserState(null);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      const mockDialogRef = {
+        closed: of(""), // Empty password
+      };
+      jest.spyOn(PromptMigrationPasswordComponent, "open").mockReturnValue(mockDialogRef as any);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(PromptMigrationPasswordComponent.open).toHaveBeenCalledWith(mockDialogService);
+      expect(mockEncryptedMigrator.runMigrations).not.toHaveBeenCalled();
+      expect(mockStateProvider.setUserState).toHaveBeenCalledWith(
+        ENCRYPTED_MIGRATION_DISMISSED,
+        expect.any(Date),
+        mockUserId,
+      );
+    });
+
+    it("should handle errors during migration prompt and show toast", async () => {
+      const mockUserState = createMockUserState(null);
+      mockStateProvider.getUser.mockReturnValue(mockUserState);
+
+      const mockError = new Error("Migration failed");
+      mockEncryptedMigrator.runMigrations.mockRejectedValue(mockError);
+
+      await service.runMigrationsIfNeeded(mockUserId);
+
+      expect(PromptMigrationPasswordComponent.open).toHaveBeenCalledWith(mockDialogService);
+      expect(mockEncryptedMigrator.runMigrations).toHaveBeenCalledWith(
+        mockUserId,
+        mockMasterPassword,
+      );
+      expect(mockLogService.error).toHaveBeenCalledWith(
+        "[EncryptedMigrationsScheduler] Error during migration prompt",
+        mockError,
+      );
+      expect(mockToastService.showToast).toHaveBeenCalledWith({
+        variant: "error",
+        message: "translated_migrationsFailed",
+      });
+    });
+  });
+});
diff --git a/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.ts b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.ts
new file mode 100644
index 00000000000..aea838ef4c6
--- /dev/null
+++ b/libs/angular/src/key-management/encrypted-migration/encrypted-migrations-scheduler.service.ts
@@ -0,0 +1,188 @@
+import { NavigationEnd, Router } from "@angular/router";
+import {
+  combineLatest,
+  switchMap,
+  of,
+  firstValueFrom,
+  filter,
+  concatMap,
+  Observable,
+  map,
+} from "rxjs";
+
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { Utils } from "@bitwarden/common/platform/misc/utils";
+import {
+  UserKeyDefinition,
+  ENCRYPTED_MIGRATION_DISK,
+  StateProvider,
+} from "@bitwarden/common/platform/state";
+import { SyncService } from "@bitwarden/common/platform/sync";
+import { UserId } from "@bitwarden/common/types/guid";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { LogService } from "@bitwarden/logging";
+
+import { EncryptedMigrationsSchedulerService } from "./encrypted-migrations-scheduler.service.abstraction";
+import { PromptMigrationPasswordComponent } from "./prompt-migration-password.component";
+
+export const ENCRYPTED_MIGRATION_DISMISSED = new UserKeyDefinition<Date>(
+  ENCRYPTED_MIGRATION_DISK,
+  "encryptedMigrationDismissed",
+  {
+    deserializer: (obj: string) => (obj != null ? new Date(obj) : null),
+    clearOn: [],
+  },
+);
+const DISMISS_TIME_HOURS = 24;
+const VAULT_ROUTES = ["/vault", "/tabs/vault", "/tabs/current"];
+
+/**
+ * This services schedules encrypted migrations for users on clients that are interactive (non-cli), and handles manual interaction,
+ * if it is required by showing a UI prompt. It is only one means of triggering migrations, in case the user stays unlocked for a while,
+ * or regularly logs in without a master-password, when the migrations do require a master-password to run.
+ */
+export class DefaultEncryptedMigrationsSchedulerService
+  implements EncryptedMigrationsSchedulerService
+{
+  isMigrating = false;
+  url$: Observable<string>;
+
+  constructor(
+    private syncService: SyncService,
+    private accountService: AccountService,
+    private stateProvider: StateProvider,
+    private encryptedMigrator: EncryptedMigrator,
+    private authService: AuthService,
+    private logService: LogService,
+    private dialogService: DialogService,
+    private toastService: ToastService,
+    private i18nService: I18nService,
+    private router: Router,
+  ) {
+    this.url$ = this.router.events.pipe(
+      filter((event: any) => event instanceof NavigationEnd),
+      map((event: NavigationEnd) => event.url),
+    );
+
+    // For all accounts, if the auth status changes to unlocked or a sync happens, prompt for migration
+    this.accountService.accounts$
+      .pipe(
+        switchMap((accounts) => {
+          const userIds = Object.keys(accounts) as UserId[];
+
+          if (userIds.length === 0) {
+            return of([]);
+          }
+
+          return combineLatest(
+            userIds.map((userId) =>
+              combineLatest([
+                this.authService.authStatusFor$(userId),
+                this.syncService.lastSync$(userId).pipe(filter((lastSync) => lastSync != null)),
+                this.url$,
+              ]).pipe(
+                filter(
+                  ([authStatus, _date, url]) =>
+                    authStatus === AuthenticationStatus.Unlocked && VAULT_ROUTES.includes(url),
+                ),
+                concatMap(() => this.runMigrationsIfNeeded(userId)),
+              ),
+            ),
+          );
+        }),
+      )
+      .subscribe();
+  }
+
+  async runMigrationsIfNeeded(userId: UserId): Promise<void> {
+    const authStatus = await firstValueFrom(this.authService.authStatusFor$(userId));
+    if (authStatus !== AuthenticationStatus.Unlocked) {
+      return;
+    }
+
+    if (this.isMigrating || this.encryptedMigrator.isRunningMigrations()) {
+      this.logService.info(
+        `[EncryptedMigrationsScheduler] Skipping migration check for user ${userId} because migrations are already in progress`,
+      );
+      return;
+    }
+
+    this.isMigrating = true;
+    switch (await this.encryptedMigrator.needsMigrations(userId)) {
+      case "noMigrationNeeded":
+        this.logService.info(
+          `[EncryptedMigrationsScheduler] No migrations needed for user ${userId}`,
+        );
+        break;
+      case "needsMigrationWithMasterPassword":
+        this.logService.info(
+          `[EncryptedMigrationsScheduler] User ${userId} needs migrations with master password`,
+        );
+        // If the user is unlocked, we can run migrations with the master password
+        await this.runMigrationsWithInteraction(userId);
+        break;
+      case "needsMigration":
+        this.logService.info(
+          `[EncryptedMigrationsScheduler] User ${userId} needs migrations with master password`,
+        );
+        // If the user is unlocked, we can prompt for the master password
+        await this.runMigrationsWithoutInteraction(userId);
+        break;
+    }
+    this.isMigrating = false;
+  }
+
+  private async runMigrationsWithoutInteraction(userId: UserId): Promise<void> {
+    try {
+      await this.encryptedMigrator.runMigrations(userId, null);
+    } catch (error) {
+      this.logService.error(
+        "[EncryptedMigrationsScheduler] Error during migration without interaction",
+        error,
+      );
+    }
+  }
+
+  private async runMigrationsWithInteraction(userId: UserId): Promise<void> {
+    // A dialog can be dismissed for a certain amount of time
+    const dismissedDate = await firstValueFrom(
+      this.stateProvider.getUser(userId, ENCRYPTED_MIGRATION_DISMISSED).state$,
+    );
+    if (dismissedDate != null) {
+      const now = new Date();
+      const timeDiff = now.getTime() - (dismissedDate as Date).getTime();
+      const hoursDiff = timeDiff / (1000 * 60 * 60);
+
+      if (hoursDiff < DISMISS_TIME_HOURS) {
+        this.logService.info(
+          "[EncryptedMigrationsScheduler] Migration prompt dismissed recently, skipping for now.",
+        );
+        return;
+      }
+    }
+
+    try {
+      const dialog = PromptMigrationPasswordComponent.open(this.dialogService);
+      const masterPassword = await firstValueFrom(dialog.closed);
+      if (Utils.isNullOrWhitespace(masterPassword)) {
+        await this.stateProvider.setUserState(ENCRYPTED_MIGRATION_DISMISSED, new Date(), userId);
+      } else {
+        await this.encryptedMigrator.runMigrations(
+          userId,
+          masterPassword === undefined ? null : masterPassword,
+        );
+      }
+    } catch (error) {
+      this.logService.error("[EncryptedMigrationsScheduler] Error during migration prompt", error);
+      // If migrations failed when the user actively was prompted, show a toast
+      this.toastService.showToast({
+        variant: "error",
+        message: this.i18nService.t("migrationsFailed"),
+      });
+    }
+  }
+}
diff --git a/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.html b/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.html
new file mode 100644
index 00000000000..6df08342885
--- /dev/null
+++ b/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.html
@@ -0,0 +1,55 @@
+<form [bitSubmit]="submit" [formGroup]="migrationPasswordForm">
+  <bit-dialog>
+    <div class="tw-font-semibold" bitDialogTitle>
+      {{ "updateEncryptionSettingsTitle" | i18n }}
+    </div>
+    <div bitDialogContent>
+      <p>
+        {{ "updateEncryptionSettingsDesc" | i18n }}
+        <a
+          bitLink
+          href="https://bitwarden.com/help/kdf-algorithms/"
+          target="_blank"
+          rel="noreferrer"
+          aria-label="external link"
+        >
+          {{ "learnMore" | i18n }}
+          <i class="bwi bwi-external-link" aria-hidden="true"></i>
+        </a>
+      </p>
+      <bit-form-field>
+        <bit-label>{{ "masterPass" | i18n }}</bit-label>
+        <bit-hint>{{ "confirmIdentityToContinue" | i18n }}</bit-hint>
+        <input
+          class="tw-font-mono"
+          bitInput
+          type="password"
+          formControlName="masterPassword"
+          [attr.title]="'masterPass' | i18n"
+        />
+        <button
+          type="button"
+          bitIconButton
+          bitSuffix
+          bitPasswordInputToggle
+          [attr.title]="'toggleVisibility' | i18n"
+          [attr.aria-label]="'toggleVisibility' | i18n"
+        ></button>
+      </bit-form-field>
+    </div>
+    <ng-container bitDialogFooter>
+      <button
+        type="submit"
+        bitButton
+        bitFormButton
+        buttonType="primary"
+        [disabled]="migrationPasswordForm.invalid"
+      >
+        <span>{{ "updateSettings" | i18n }}</span>
+      </button>
+      <button type="button" bitButton bitFormButton buttonType="secondary" bitDialogClose>
+        {{ "later" | i18n }}
+      </button>
+    </ng-container>
+  </bit-dialog>
+</form>
diff --git a/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.ts b/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.ts
new file mode 100644
index 00000000000..060901d68fb
--- /dev/null
+++ b/libs/angular/src/key-management/encrypted-migration/prompt-migration-password.component.ts
@@ -0,0 +1,85 @@
+import { CommonModule } from "@angular/common";
+import { Component, inject, ChangeDetectionStrategy } from "@angular/core";
+import { FormBuilder, ReactiveFormsModule, Validators } from "@angular/forms";
+import { filter, firstValueFrom, map } from "rxjs";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
+import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
+import {
+  LinkModule,
+  AsyncActionsModule,
+  ButtonModule,
+  DialogModule,
+  DialogRef,
+  DialogService,
+  FormFieldModule,
+  IconButtonModule,
+} from "@bitwarden/components";
+
+/**
+ * This is a generic prompt to run encryption migrations that require the master password.
+ */
+@Component({
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  templateUrl: "prompt-migration-password.component.html",
+  imports: [
+    DialogModule,
+    LinkModule,
+    CommonModule,
+    JslibModule,
+    ButtonModule,
+    IconButtonModule,
+    ReactiveFormsModule,
+    AsyncActionsModule,
+    FormFieldModule,
+  ],
+})
+export class PromptMigrationPasswordComponent {
+  private dialogRef = inject(DialogRef<string>);
+  private formBuilder = inject(FormBuilder);
+  private uvService = inject(UserVerificationService);
+  private accountService = inject(AccountService);
+
+  migrationPasswordForm = this.formBuilder.group({
+    masterPassword: ["", [Validators.required]],
+  });
+
+  static open(dialogService: DialogService) {
+    return dialogService.open<string>(PromptMigrationPasswordComponent);
+  }
+
+  submit = async () => {
+    const masterPasswordControl = this.migrationPasswordForm.controls.masterPassword;
+
+    if (!masterPasswordControl.value || masterPasswordControl.invalid) {
+      return;
+    }
+
+    const { userId, email } = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(
+        filter((account) => account != null),
+        map((account) => {
+          return {
+            userId: account!.id,
+            email: account!.email,
+          };
+        }),
+      ),
+    );
+
+    if (
+      !(await this.uvService.verifyUserByMasterPassword(
+        { type: VerificationType.MasterPassword, secret: masterPasswordControl.value },
+        userId,
+        email,
+      ))
+    ) {
+      return;
+    }
+
+    // Return the master password to the caller
+    this.dialogRef.close(masterPasswordControl.value);
+  };
+}
diff --git a/libs/angular/src/services/jslib-services.module.ts b/libs/angular/src/services/jslib-services.module.ts
index 1589f5c5f30..816e09fd45d 100644
--- a/libs/angular/src/services/jslib-services.module.ts
+++ b/libs/angular/src/services/jslib-services.module.ts
@@ -1,6 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-import { ErrorHandler, LOCALE_ID, NgModule } from "@angular/core";
+import { APP_INITIALIZER, ErrorHandler, LOCALE_ID, NgModule } from "@angular/core";
+import { Router } from "@angular/router";
 import { Subject } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
@@ -177,11 +178,15 @@ import { EncryptServiceImplementation } from "@bitwarden/common/key-management/c
 import { WebCryptoFunctionService } from "@bitwarden/common/key-management/crypto/services/web-crypto-function.service";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { DeviceTrustService } from "@bitwarden/common/key-management/device-trust/services/device-trust.service.implementation";
+import { DefaultEncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/default-encrypted-migrator";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { DefaultChangeKdfApiService } from "@bitwarden/common/key-management/kdf/change-kdf-api.service";
 import { ChangeKdfApiService } from "@bitwarden/common/key-management/kdf/change-kdf-api.service.abstraction";
-import { DefaultChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf-service";
-import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf-service.abstraction";
+import { DefaultChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf.service";
+import { ChangeKdfService } from "@bitwarden/common/key-management/kdf/change-kdf.service.abstraction";
+import { KeyConnectorApiService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector-api.service";
 import { KeyConnectorService as KeyConnectorServiceAbstraction } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
+import { DefaultKeyConnectorApiService } from "@bitwarden/common/key-management/key-connector/services/default-key-connector-api.service";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/services/key-connector.service";
 import { KeyApiService } from "@bitwarden/common/key-management/keys/services/abstractions/key-api-service.abstraction";
 import { RotateableKeySetService } from "@bitwarden/common/key-management/keys/services/abstractions/rotateable-key-set.service";
@@ -204,6 +209,7 @@ import {
   SendPasswordService,
   DefaultSendPasswordService,
 } from "@bitwarden/common/key-management/sends";
+import { SessionTimeoutTypeService } from "@bitwarden/common/key-management/session-timeout";
 import {
   DefaultVaultTimeoutService,
   DefaultVaultTimeoutSettingsService,
@@ -328,6 +334,7 @@ import { DefaultTaskService, TaskService } from "@bitwarden/common/vault/tasks";
 import {
   AnonLayoutWrapperDataService,
   DefaultAnonLayoutWrapperDataService,
+  DialogService,
   ToastService,
 } from "@bitwarden/components";
 import {
@@ -396,6 +403,8 @@ import { DeviceTrustToastService as DeviceTrustToastServiceAbstraction } from ".
 import { DeviceTrustToastService } from "../auth/services/device-trust-toast.service.implementation";
 import { NoopPremiumInterestStateService } from "../billing/services/premium-interest/noop-premium-interest-state.service";
 import { PremiumInterestStateService } from "../billing/services/premium-interest/premium-interest-state.service.abstraction";
+import { DefaultEncryptedMigrationsSchedulerService } from "../key-management/encrypted-migration/encrypted-migrations-scheduler.service";
+import { EncryptedMigrationsSchedulerService } from "../key-management/encrypted-migration/encrypted-migrations-scheduler.service.abstraction";
 import { FormValidationErrorsService as FormValidationErrorsServiceAbstraction } from "../platform/abstractions/form-validation-errors.service";
 import { DocumentLangSetter } from "../platform/i18n";
 import { FormValidationErrorsService } from "../platform/services/form-validation-errors.service";
@@ -516,6 +525,23 @@ const safeProviders: SafeProvider[] = [
       TokenServiceAbstraction,
     ],
   }),
+  safeProvider({
+    provide: ChangeKdfService,
+    useClass: DefaultChangeKdfService,
+    deps: [ChangeKdfApiService, SdkService],
+  }),
+  safeProvider({
+    provide: EncryptedMigrator,
+    useClass: DefaultEncryptedMigrator,
+    deps: [
+      KdfConfigService,
+      ChangeKdfService,
+      LogService,
+      ConfigService,
+      MasterPasswordServiceAbstraction,
+      SyncService,
+    ],
+  }),
   safeProvider({
     provide: LoginStrategyServiceAbstraction,
     useClass: LoginStrategyService,
@@ -889,6 +915,7 @@ const safeProviders: SafeProvider[] = [
       StateProvider,
       LogService,
       DEFAULT_VAULT_TIMEOUT,
+      SessionTimeoutTypeService,
     ],
   }),
   safeProvider({
@@ -925,7 +952,7 @@ const safeProviders: SafeProvider[] = [
     deps: [
       FolderServiceAbstraction,
       CipherServiceAbstraction,
-      PinServiceAbstraction,
+      KeyGenerationService,
       KeyService,
       EncryptService,
       CryptoFunctionServiceAbstraction,
@@ -945,7 +972,7 @@ const safeProviders: SafeProvider[] = [
     deps: [
       CipherServiceAbstraction,
       VaultExportApiService,
-      PinServiceAbstraction,
+      KeyGenerationService,
       KeyService,
       EncryptService,
       CryptoFunctionServiceAbstraction,
@@ -1330,16 +1357,7 @@ const safeProviders: SafeProvider[] = [
   safeProvider({
     provide: PinServiceAbstraction,
     useClass: PinService,
-    deps: [
-      AccountServiceAbstraction,
-      EncryptService,
-      KdfConfigService,
-      KeyGenerationService,
-      LogService,
-      KeyService,
-      SdkService,
-      PinStateServiceAbstraction,
-    ],
+    deps: [EncryptService, LogService, KeyService, SdkService, PinStateServiceAbstraction],
   }),
   safeProvider({
     provide: WebAuthnLoginPrfKeyServiceAbstraction,
@@ -1473,7 +1491,13 @@ const safeProviders: SafeProvider[] = [
   safeProvider({
     provide: SubscriptionPricingServiceAbstraction,
     useClass: DefaultSubscriptionPricingService,
-    deps: [BillingApiServiceAbstraction, ConfigService, I18nServiceAbstraction, LogService],
+    deps: [
+      BillingApiServiceAbstraction,
+      ConfigService,
+      I18nServiceAbstraction,
+      LogService,
+      EnvironmentService,
+    ],
   }),
   safeProvider({
     provide: OrganizationManagementPreferencesService,
@@ -1665,6 +1689,7 @@ const safeProviders: SafeProvider[] = [
       SsoLoginServiceAbstraction,
       SyncService,
       UserAsymmetricKeysRegenerationService,
+      EncryptedMigrator,
       LogService,
     ],
   }),
@@ -1735,6 +1760,28 @@ const safeProviders: SafeProvider[] = [
       InternalMasterPasswordServiceAbstraction,
     ],
   }),
+  safeProvider({
+    provide: EncryptedMigrationsSchedulerService,
+    useClass: DefaultEncryptedMigrationsSchedulerService,
+    deps: [
+      SyncService,
+      AccountService,
+      StateProvider,
+      EncryptedMigrator,
+      AuthServiceAbstraction,
+      LogService,
+      DialogService,
+      ToastService,
+      I18nServiceAbstraction,
+      Router,
+    ],
+  }),
+  safeProvider({
+    provide: APP_INITIALIZER as SafeInjectionToken<() => Promise<void>>,
+    useFactory: (encryptedMigrationsScheduler: EncryptedMigrationsSchedulerService) => () => {},
+    deps: [EncryptedMigrationsSchedulerService],
+    multi: true,
+  }),
   safeProvider({
     provide: LockService,
     useClass: DefaultLockService,
@@ -1781,6 +1828,11 @@ const safeProviders: SafeProvider[] = [
     useClass: IpcSessionRepository,
     deps: [StateProvider],
   }),
+  safeProvider({
+    provide: KeyConnectorApiService,
+    useClass: DefaultKeyConnectorApiService,
+    deps: [ApiServiceAbstraction],
+  }),
   safeProvider({
     provide: PremiumInterestStateService,
     useClass: NoopPremiumInterestStateService,
diff --git a/libs/angular/src/vault/components/icon.component.html b/libs/angular/src/vault/components/icon.component.html
index 0f14de64e21..5806c728e95 100644
--- a/libs/angular/src/vault/components/icon.component.html
+++ b/libs/angular/src/vault/components/icon.component.html
@@ -1,9 +1,5 @@
 <!-- Applying width and height styles directly to synchronize icon sizing between web/browser/desktop -->
-<div
-  class="tw-flex tw-justify-center tw-items-center"
-  [ngStyle]="coloredIcon() ? { width: '36px', height: '36px' } : {}"
-  aria-hidden="true"
->
+<div class="tw-flex tw-justify-center tw-items-center" [ngStyle]="iconStyle()" aria-hidden="true">
   <ng-container *ngIf="data$ | async as data">
     @if (data.imageEnabled && data.image) {
       <img
@@ -16,7 +12,7 @@
           'tw-invisible tw-absolute': !imageLoaded(),
           'tw-size-6': !coloredIcon(),
         }"
-        [ngStyle]="coloredIcon() ? { width: '36px', height: '36px' } : {}"
+        [ngStyle]="iconStyle()"
         (load)="imageLoaded.set(true)"
         (error)="imageLoaded.set(false)"
       />
@@ -28,7 +24,7 @@
           'tw-bg-illustration-bg-primary tw-rounded-full':
             data.icon?.startsWith('bwi-') && coloredIcon(),
         }"
-        [ngStyle]="coloredIcon() ? { width: '36px', height: '36px' } : {}"
+        [ngStyle]="iconStyle()"
       >
         <i
           class="tw-text-muted bwi bwi-lg {{ data.icon }}"
@@ -36,6 +32,7 @@
             color: coloredIcon() ? 'rgb(var(--color-illustration-outline))' : null,
             width: data.icon?.startsWith('credit-card') && coloredIcon() ? '36px' : null,
             height: data.icon?.startsWith('credit-card') && coloredIcon() ? '30px' : null,
+            fontSize: size() ? size() + 'px' : null,
           }"
         ></i>
       </div>
diff --git a/libs/angular/src/vault/components/icon.component.ts b/libs/angular/src/vault/components/icon.component.ts
index 851cec5656b..1037c9b3974 100644
--- a/libs/angular/src/vault/components/icon.component.ts
+++ b/libs/angular/src/vault/components/icon.component.ts
@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component, input, signal } from "@angular/core";
+import { ChangeDetectionStrategy, Component, computed, input, signal } from "@angular/core";
 import { toObservable } from "@angular/core/rxjs-interop";
 import {
   combineLatest,
@@ -32,8 +32,32 @@ export class IconComponent {
    */
   readonly coloredIcon = input<boolean>(false);
 
+  /**
+   * Optional custom size for the icon in pixels.
+   * When provided, forces explicit dimensions on the icon wrapper to prevent layout collapse at different zoom levels.
+   * If not provided, the wrapper has no explicit dimensions and relies on CSS classes (tw-size-6/24px for images).
+   * This can cause the wrapper to collapse when images are loading/hidden, especially at high browser zoom levels.
+   * Reference: default image size is tw-size-6 (24px), coloredIcon uses 36px.
+   */
+  readonly size = input<number>();
+
   readonly imageLoaded = signal(false);
 
+  /**
+   * Computed style object for icon dimensions.
+   * Centralizes the sizing logic to avoid repetition in the template.
+   */
+  protected readonly iconStyle = computed(() => {
+    if (this.coloredIcon()) {
+      return { width: "36px", height: "36px" };
+    }
+    const size = this.size();
+    if (size) {
+      return { width: size + "px", height: size + "px" };
+    }
+    return {};
+  });
+
   protected data$: Observable<CipherIconDetails>;
 
   constructor(
diff --git a/libs/angular/src/vault/vault-filter/components/vault-filter.component.ts b/libs/angular/src/vault/vault-filter/components/vault-filter.component.ts
index 659db1bb925..f664cff2e8d 100644
--- a/libs/angular/src/vault/vault-filter/components/vault-filter.component.ts
+++ b/libs/angular/src/vault/vault-filter/components/vault-filter.component.ts
@@ -89,7 +89,7 @@ export class VaultFilterComponent implements OnInit {
     this.collections = await this.initCollections();
 
     this.showArchiveVaultFilter = await firstValueFrom(
-      this.cipherArchiveService.hasArchiveFlagEnabled$(),
+      this.cipherArchiveService.hasArchiveFlagEnabled$,
     );
 
     this.isLoaded = true;
diff --git a/libs/auth/src/angular/login-via-auth-request/login-via-auth-request.component.ts b/libs/auth/src/angular/login-via-auth-request/login-via-auth-request.component.ts
index 2436593dfda..040d4d3c121 100644
--- a/libs/auth/src/angular/login-via-auth-request/login-via-auth-request.component.ts
+++ b/libs/auth/src/angular/login-via-auth-request/login-via-auth-request.component.ts
@@ -822,7 +822,7 @@ export class LoginViaAuthRequestComponent implements OnInit, OnDestroy {
   }
 
   private async handleSuccessfulLoginNavigation(userId: UserId) {
-    await this.loginSuccessHandlerService.run(userId);
+    await this.loginSuccessHandlerService.run(userId, null);
     await this.router.navigate(["vault"]);
   }
 }
diff --git a/libs/auth/src/angular/login/default-login-component.service.ts b/libs/auth/src/angular/login/default-login-component.service.ts
index 7f98040d9c2..2d50a0ffeb7 100644
--- a/libs/auth/src/angular/login/default-login-component.service.ts
+++ b/libs/auth/src/angular/login/default-login-component.service.ts
@@ -33,19 +33,27 @@ export class DefaultLoginComponentService implements LoginComponentService {
    */
   async redirectToSsoLogin(email: string): Promise<void | null> {
     // Set the state that we'll need to verify the SSO login when we get the code back
-    const [state, codeChallenge] = await this.setSsoPreLoginState();
-
-    // Set the email address in state. This is used in 2 places:
-    // 1. On the web client, on the SSO component we need the email address to look up
-    //    the org SSO identifier. The email address is passed via query param for the other clients.
-    // 2. On all clients, after authentication on the originating client the SSO component
-    //    will need to look up 2FA Remember token by email.
-    await this.ssoLoginService.setSsoEmail(email);
+    const [state, codeChallenge] = await this.setSsoPreLoginState(email);
 
     // Finally, we redirect to the SSO login page. This will be handled by each client implementation of this service.
     await this.redirectToSso(email, state, codeChallenge);
   }
 
+  /**
+   * Redirects the user to the SSO login page, either via route or in a new browser window.
+   * @param email The email address of the user attempting to log in
+   */
+  async redirectToSsoLoginWithOrganizationSsoIdentifier(
+    email: string,
+    orgSsoIdentifier: string,
+  ): Promise<void | null> {
+    // Set the state that we'll need to verify the SSO login when we get the code back
+    const [state, codeChallenge] = await this.setSsoPreLoginState(email);
+
+    // Finally, we redirect to the SSO login page. This will be handled by each client implementation of this service.
+    await this.redirectToSso(email, state, codeChallenge, orgSsoIdentifier);
+  }
+
   /**
    * No-op implementation of redirectToSso
    */
@@ -53,6 +61,7 @@ export class DefaultLoginComponentService implements LoginComponentService {
     email: string,
     state: string,
     codeChallenge: string,
+    orgSsoIdentifier?: string,
   ): Promise<void> {
     return;
   }
@@ -65,9 +74,9 @@ export class DefaultLoginComponentService implements LoginComponentService {
   }
 
   /**
-   * Sets the state required for verifying SSO login after completion
+   * Set the state that we'll need to verify the SSO login when we get the authorization code back
    */
-  private async setSsoPreLoginState(): Promise<[string, string]> {
+  private async setSsoPreLoginState(email: string): Promise<[string, string]> {
     // Generate SSO params
     const passwordOptions: any = {
       type: "password",
@@ -93,6 +102,13 @@ export class DefaultLoginComponentService implements LoginComponentService {
     await this.ssoLoginService.setSsoState(state);
     await this.ssoLoginService.setCodeVerifier(codeVerifier);
 
+    // Set the email address in state. This is used in 2 places:
+    // 1. On the web client, on the SSO component we need the email address to look up
+    //    the org SSO identifier. The email address is passed via query param for the other clients.
+    // 2. On all clients, after authentication on the originating client the SSO component
+    //    will need to look up 2FA Remember token by email.
+    await this.ssoLoginService.setSsoEmail(email);
+
     return [state, codeChallenge];
   }
 }
diff --git a/libs/auth/src/angular/login/login-component.service.ts b/libs/auth/src/angular/login/login-component.service.ts
index 5ca83c97c5f..b7c2b16ce24 100644
--- a/libs/auth/src/angular/login/login-component.service.ts
+++ b/libs/auth/src/angular/login/login-component.service.ts
@@ -35,6 +35,14 @@ export abstract class LoginComponentService {
    */
   redirectToSsoLogin: (email: string) => Promise<void | null>;
 
+  /**
+   * Redirects the user to the SSO login page with organization SSO identifier, either via route or in a new browser window.
+   */
+  redirectToSsoLoginWithOrganizationSsoIdentifier: (
+    email: string,
+    orgSsoIdentifier: string | null | undefined,
+  ) => Promise<void | null>;
+
   /**
    * Shows the back button.
    */
diff --git a/libs/auth/src/angular/login/login.component.ts b/libs/auth/src/angular/login/login.component.ts
index 0b011b5641f..8e688f3f830 100644
--- a/libs/auth/src/angular/login/login.component.ts
+++ b/libs/auth/src/angular/login/login.component.ts
@@ -381,8 +381,26 @@ export class LoginComponent implements OnInit, OnDestroy {
       return;
     }
 
+    // redirect to SSO if ssoOrganizationIdentifier is present in token response
+    if (authResult.requiresSso) {
+      const email = this.formGroup?.value?.email;
+      if (!email) {
+        this.toastService.showToast({
+          variant: "error",
+          title: this.i18nService.t("errorOccurred"),
+          message: this.i18nService.t("emailRequiredForSsoLogin"),
+        });
+        return;
+      }
+      await this.loginComponentService.redirectToSsoLoginWithOrganizationSsoIdentifier(
+        email,
+        authResult.ssoOrganizationIdentifier,
+      );
+      return;
+    }
+
     // User logged in successfully so execute side effects
-    await this.loginSuccessHandlerService.run(authResult.userId);
+    await this.loginSuccessHandlerService.run(authResult.userId, authResult.masterPassword);
 
     // Determine where to send the user next
     // The AuthGuard will handle routing to change-password based on state
diff --git a/libs/auth/src/angular/new-device-verification/new-device-verification.component.ts b/libs/auth/src/angular/new-device-verification/new-device-verification.component.ts
index c3d6ff5d1fe..726cfd7b3b5 100644
--- a/libs/auth/src/angular/new-device-verification/new-device-verification.component.ts
+++ b/libs/auth/src/angular/new-device-verification/new-device-verification.component.ts
@@ -152,9 +152,7 @@ export class NewDeviceVerificationComponent implements OnInit, OnDestroy {
         return;
       }
 
-      // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-      // eslint-disable-next-line @typescript-eslint/no-floating-promises
-      this.loginSuccessHandlerService.run(authResult.userId);
+      await this.loginSuccessHandlerService.run(authResult.userId, authResult.masterPassword);
 
       // TODO: PM-22663 use the new service to handle routing.
       const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
diff --git a/libs/auth/src/angular/registration/registration-finish/registration-finish.component.ts b/libs/auth/src/angular/registration/registration-finish/registration-finish.component.ts
index 19e7c1feabd..99eaa2404d9 100644
--- a/libs/auth/src/angular/registration/registration-finish/registration-finish.component.ts
+++ b/libs/auth/src/angular/registration/registration-finish/registration-finish.component.ts
@@ -206,7 +206,10 @@ export class RegistrationFinishComponent implements OnInit, OnDestroy {
         return;
       }
 
-      await this.loginSuccessHandlerService.run(authenticationResult.userId);
+      await this.loginSuccessHandlerService.run(
+        authenticationResult.userId,
+        authenticationResult.masterPassword ?? null,
+      );
 
       if (this.premiumInterest) {
         await this.premiumInterestStateService.setPremiumInterest(
diff --git a/libs/auth/src/angular/sso/sso.component.ts b/libs/auth/src/angular/sso/sso.component.ts
index bf618ba39f4..d0cc2bd83e5 100644
--- a/libs/auth/src/angular/sso/sso.component.ts
+++ b/libs/auth/src/angular/sso/sso.component.ts
@@ -437,7 +437,7 @@ export class SsoComponent implements OnInit {
 
       // Everything after the 2FA check is considered a successful login
       // Just have to figure out where to send the user
-      await this.loginSuccessHandlerService.run(authResult.userId);
+      await this.loginSuccessHandlerService.run(authResult.userId, null);
 
       // Save off the OrgSsoIdentifier for use in the TDE flows (or elsewhere)
       // - TDE login decryption options component
diff --git a/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.spec.ts b/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.spec.ts
index 8c12060168b..9d7acd7d26e 100644
--- a/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.spec.ts
+++ b/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.spec.ts
@@ -421,6 +421,7 @@ describe("TwoFactorAuthComponent", () => {
             keyConnectorUrl:
               mockUserDecryptionOpts.noMasterPasswordWithKeyConnector.keyConnectorOption!
                 .keyConnectorUrl,
+            organizationSsoIdentifier: "test-sso-id",
           }),
         );
         const authResult = new AuthResult();
diff --git a/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.ts b/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.ts
index ca19d3652bb..4c143cc59f9 100644
--- a/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.ts
+++ b/libs/auth/src/angular/two-factor-auth/two-factor-auth.component.ts
@@ -450,7 +450,7 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
     }
 
     // User is fully logged in so handle any post login logic before executing navigation
-    await this.loginSuccessHandlerService.run(authResult.userId);
+    await this.loginSuccessHandlerService.run(authResult.userId, authResult.masterPassword);
 
     // Save off the OrgSsoIdentifier for use in the TDE flows
     // - TDE login decryption options component
diff --git a/libs/auth/src/common/abstractions/login-success-handler.service.ts b/libs/auth/src/common/abstractions/login-success-handler.service.ts
index 8dee1dd32b9..e6d75d661f5 100644
--- a/libs/auth/src/common/abstractions/login-success-handler.service.ts
+++ b/libs/auth/src/common/abstractions/login-success-handler.service.ts
@@ -5,6 +5,7 @@ export abstract class LoginSuccessHandlerService {
    * Runs any service calls required after a successful login.
    * Service calls that should be included in this method are only those required to be awaited after successful login.
    * @param userId The user id.
+   * @param masterPassword The master password, if available. Null when logging in with SSO or other non-master-password methods.
    */
-  abstract run(userId: UserId): Promise<void>;
+  abstract run(userId: UserId, masterPassword: string | null): Promise<void>;
 }
diff --git a/libs/auth/src/common/login-strategies/login.strategy.spec.ts b/libs/auth/src/common/login-strategies/login.strategy.spec.ts
index 38d62cfdd83..82e1183a1d6 100644
--- a/libs/auth/src/common/login-strategies/login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/login.strategy.spec.ts
@@ -259,7 +259,7 @@ describe("LoginStrategy", () => {
 
       expect(userDecryptionOptionsService.setUserDecryptionOptionsById).toHaveBeenCalledWith(
         userId,
-        UserDecryptionOptions.fromResponse(idTokenResponse),
+        UserDecryptionOptions.fromIdentityTokenResponse(idTokenResponse),
       );
       expect(masterPasswordService.mock.setMasterPasswordUnlockData).toHaveBeenCalledWith(
         new MasterPasswordUnlockData(
@@ -308,6 +308,7 @@ describe("LoginStrategy", () => {
       const result = await passwordLoginStrategy.logIn(credentials);
 
       const expected = new AuthResult();
+      expected.masterPassword = "password";
       expected.userId = userId;
       expected.resetMasterPassword = true;
       expected.twoFactorProviders = null;
@@ -323,6 +324,7 @@ describe("LoginStrategy", () => {
       const result = await passwordLoginStrategy.logIn(credentials);
 
       const expected = new AuthResult();
+      expected.masterPassword = "password";
       expected.userId = userId;
       expected.resetMasterPassword = false;
       expected.twoFactorProviders = null;
diff --git a/libs/auth/src/common/login-strategies/login.strategy.ts b/libs/auth/src/common/login-strategies/login.strategy.ts
index b8e4ee9e822..ae375c8b2f5 100644
--- a/libs/auth/src/common/login-strategies/login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/login.strategy.ts
@@ -13,6 +13,7 @@ import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/ide
 import { UserApiTokenRequest } from "@bitwarden/common/auth/models/request/identity-token/user-api-token.request";
 import { WebAuthnLoginTokenRequest } from "@bitwarden/common/auth/models/request/identity-token/webauthn-login-token.request";
 import { IdentityDeviceVerificationResponse } from "@bitwarden/common/auth/models/response/identity-device-verification.response";
+import { IdentitySsoRequiredResponse } from "@bitwarden/common/auth/models/response/identity-sso-required.response";
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "@bitwarden/common/auth/models/response/identity-two-factor.response";
 import { TwoFactorService } from "@bitwarden/common/auth/two-factor";
@@ -49,7 +50,8 @@ import { CacheData } from "../services/login-strategies/login-strategy.state";
 type IdentityResponse =
   | IdentityTokenResponse
   | IdentityTwoFactorResponse
-  | IdentityDeviceVerificationResponse;
+  | IdentityDeviceVerificationResponse
+  | IdentitySsoRequiredResponse;
 
 export abstract class LoginStrategyData {
   tokenRequest:
@@ -108,6 +110,8 @@ export abstract class LoginStrategy {
     data.tokenRequest.setTwoFactor(twoFactor);
     this.cache.next(data);
     const [authResult] = await this.startLogIn();
+    // There is an import cycle between PasswordLoginStrategyData and LoginStrategy, which means this cast is necessary, which is solved by extracting the data classes.
+    authResult.masterPassword = (this.cache.value as any)["masterPassword"] ?? null;
     return authResult;
   }
 
@@ -126,6 +130,8 @@ export abstract class LoginStrategy {
       return [await this.processTokenResponse(response), response];
     } else if (response instanceof IdentityDeviceVerificationResponse) {
       return [await this.processDeviceVerificationResponse(response), response];
+    } else if (response instanceof IdentitySsoRequiredResponse) {
+      return [await this.processSsoRequiredResponse(response), response];
     }
 
     throw new Error("Invalid response object.");
@@ -197,7 +203,7 @@ export abstract class LoginStrategy {
     // as the user decryption options help determine the available timeout actions.
     await this.userDecryptionOptionsService.setUserDecryptionOptionsById(
       userId,
-      UserDecryptionOptions.fromResponse(tokenResponse),
+      UserDecryptionOptions.fromIdentityTokenResponse(tokenResponse),
     );
 
     if (tokenResponse.userDecryptionOptions?.masterPasswordUnlock != null) {
@@ -264,6 +270,9 @@ export abstract class LoginStrategy {
     await this.processForceSetPasswordReason(response.forcePasswordReset, userId);
 
     this.messagingService.send("loggedIn");
+    // There is an import cycle between PasswordLoginStrategyData and LoginStrategy, which means this cast is necessary, which is solved by extracting the data classes.
+    // TODO: https://bitwarden.atlassian.net/browse/PM-27573
+    result.masterPassword = (this.cache.value as any)["masterPassword"] ?? null;
 
     return result;
   }
@@ -393,4 +402,19 @@ export abstract class LoginStrategy {
     result.requiresDeviceVerification = true;
     return result;
   }
+
+  /**
+   * Handles the response from the server when a SSO Authentication is required.
+   * It hydrates the AuthResult with the SSO organization identifier.
+   *
+   * @param {IdentitySsoRequiredResponse} response - The response from the server indicating that SSO is required.
+   * @returns {Promise<AuthResult>} - A promise that resolves to an AuthResult object
+   */
+  protected async processSsoRequiredResponse(
+    response: IdentitySsoRequiredResponse,
+  ): Promise<AuthResult> {
+    const result = new AuthResult();
+    result.ssoOrganizationIdentifier = response.ssoOrganizationIdentifier;
+    return result;
+  }
 }
diff --git a/libs/auth/src/common/login-strategies/password-login.strategy.ts b/libs/auth/src/common/login-strategies/password-login.strategy.ts
index 829351cc88f..842a48e28cd 100644
--- a/libs/auth/src/common/login-strategies/password-login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/password-login.strategy.ts
@@ -10,6 +10,7 @@ import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/for
 import { PasswordTokenRequest } from "@bitwarden/common/auth/models/request/identity-token/password-token.request";
 import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/identity-token/token-two-factor.request";
 import { IdentityDeviceVerificationResponse } from "@bitwarden/common/auth/models/response/identity-device-verification.response";
+import { IdentitySsoRequiredResponse } from "@bitwarden/common/auth/models/response/identity-sso-required.response";
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "@bitwarden/common/auth/models/response/identity-two-factor.response";
 import { HashPurpose } from "@bitwarden/common/platform/enums";
@@ -33,6 +34,8 @@ export class PasswordLoginStrategyData implements LoginStrategyData {
   localMasterKeyHash: string;
   /** The user's master key */
   masterKey: MasterKey;
+  /** The user's master password */
+  masterPassword: string;
   /**
    * Tracks if the user needs to update their password due to
    * a password that does not meet an organization's master password policy.
@@ -83,6 +86,7 @@ export class PasswordLoginStrategy extends LoginStrategy {
       masterPassword,
       email,
     );
+    data.masterPassword = masterPassword;
     data.userEnteredEmail = email;
 
     // Hash the password early (before authentication) so we don't persist it in memory in plaintext
@@ -162,14 +166,20 @@ export class PasswordLoginStrategy extends LoginStrategy {
     identityResponse:
       | IdentityTokenResponse
       | IdentityTwoFactorResponse
-      | IdentityDeviceVerificationResponse,
+      | IdentityDeviceVerificationResponse
+      | IdentitySsoRequiredResponse,
     credentials: PasswordLoginCredentials,
     authResult: AuthResult,
   ): Promise<void> {
     // TODO: PM-21084 - investigate if we should be sending down masterPasswordPolicy on the
     // IdentityDeviceVerificationResponse like we do for the IdentityTwoFactorResponse
     // If the response is a device verification response, we don't need to evaluate the password
-    if (identityResponse instanceof IdentityDeviceVerificationResponse) {
+    // If SSO is required, we also do not evaluate the password here, since the user needs to first
+    // authenticate with their SSO IdP Provider
+    if (
+      identityResponse instanceof IdentityDeviceVerificationResponse ||
+      identityResponse instanceof IdentitySsoRequiredResponse
+    ) {
       return;
     }
 
@@ -251,6 +261,7 @@ export class PasswordLoginStrategy extends LoginStrategy {
     this.cache.next(data);
 
     const [authResult] = await this.startLogIn();
+    authResult.masterPassword = this.cache.value["masterPassword"] ?? null;
     return authResult;
   }
 
diff --git a/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts b/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts
index acbb680ae6d..3dbce6500a8 100644
--- a/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts
@@ -503,67 +503,6 @@ describe("SsoLoginStrategy", () => {
         HasMasterPassword: false,
         KeyConnectorOption: { KeyConnectorUrl: keyConnectorUrl },
       });
-      tokenResponse.keyConnectorUrl = keyConnectorUrl;
-    });
-
-    it("gets and sets the master key if Key Connector is enabled and the user doesn't have a master password", async () => {
-      const masterKey = new SymmetricCryptoKey(
-        new Uint8Array(64).buffer as CsprngArray,
-      ) as MasterKey;
-
-      apiService.postIdentityToken.mockResolvedValue(tokenResponse);
-      masterPasswordService.masterKeySubject.next(masterKey);
-
-      await ssoLoginStrategy.logIn(credentials);
-
-      expect(keyConnectorService.setMasterKeyFromUrl).toHaveBeenCalledWith(keyConnectorUrl, userId);
-    });
-
-    it("converts new SSO user with no master password to Key Connector on first login", async () => {
-      tokenResponse.key = undefined;
-      tokenResponse.kdfConfig = new Argon2KdfConfig(10, 64, 4);
-
-      apiService.postIdentityToken.mockResolvedValue(tokenResponse);
-
-      await ssoLoginStrategy.logIn(credentials);
-
-      expect(keyConnectorService.setNewSsoUserKeyConnectorConversionData).toHaveBeenCalledWith(
-        {
-          kdfConfig: new Argon2KdfConfig(10, 64, 4),
-          keyConnectorUrl: keyConnectorUrl,
-          organizationId: ssoOrgId,
-        },
-        userId,
-      );
-    });
-
-    it("decrypts and sets the user key if Key Connector is enabled and the user doesn't have a master password", async () => {
-      const userKey = new SymmetricCryptoKey(new Uint8Array(64).buffer as CsprngArray) as UserKey;
-      const masterKey = new SymmetricCryptoKey(
-        new Uint8Array(64).buffer as CsprngArray,
-      ) as MasterKey;
-
-      apiService.postIdentityToken.mockResolvedValue(tokenResponse);
-      masterPasswordService.masterKeySubject.next(masterKey);
-      masterPasswordService.mock.decryptUserKeyWithMasterKey.mockResolvedValue(userKey);
-
-      await ssoLoginStrategy.logIn(credentials);
-
-      expect(masterPasswordService.mock.decryptUserKeyWithMasterKey).toHaveBeenCalledWith(
-        masterKey,
-        userId,
-        undefined,
-      );
-      expect(keyService.setUserKey).toHaveBeenCalledWith(userKey, userId);
-    });
-  });
-
-  describe("Key Connector Pre-TDE", () => {
-    let tokenResponse: IdentityTokenResponse;
-    beforeEach(() => {
-      tokenResponse = identityTokenResponseFactory();
-      tokenResponse.userDecryptionOptions = null;
-      tokenResponse.keyConnectorUrl = keyConnectorUrl;
     });
 
     it("gets and sets the master key if Key Connector is enabled and the user doesn't have a master password", async () => {
diff --git a/libs/auth/src/common/login-strategies/sso-login.strategy.ts b/libs/auth/src/common/login-strategies/sso-login.strategy.ts
index d806f6d733e..33802765aca 100644
--- a/libs/auth/src/common/login-strategies/sso-login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/sso-login.strategy.ts
@@ -157,22 +157,12 @@ export class SsoLoginStrategy extends LoginStrategy {
       // In order for us to set the master key from Key Connector, we need to have a Key Connector URL
       // and the user must not have a master password.
       return userHasKeyConnectorUrl && !userHasMasterPassword;
-    } else {
-      // In pre-TDE versions of the server, the userDecryptionOptions will not be present.
-      // In this case, we can determine if the user has a master password and has a Key Connector URL by
-      // just checking the keyConnectorUrl property. This is because the server short-circuits on the response
-      // and will not pass back the URL in the response if the user has a master password.
-      // TODO: remove compatibility check after 2023.10 release (https://bitwarden.atlassian.net/browse/PM-3537)
-      return tokenResponse.keyConnectorUrl != null;
     }
   }
 
   private getKeyConnectorUrl(tokenResponse: IdentityTokenResponse): string {
-    // TODO: remove tokenResponse.keyConnectorUrl reference after 2023.10 release (https://bitwarden.atlassian.net/browse/PM-3537)
     const userDecryptionOptions = tokenResponse?.userDecryptionOptions;
-    return (
-      tokenResponse.keyConnectorUrl ?? userDecryptionOptions?.keyConnectorOption?.keyConnectorUrl
-    );
+    return userDecryptionOptions?.keyConnectorOption?.keyConnectorUrl;
   }
 
   // TODO: future passkey login strategy will need to support setting user key (decrypting via TDE or admin approval request)
diff --git a/libs/auth/src/common/models/domain/user-decryption-options.ts b/libs/auth/src/common/models/domain/user-decryption-options.ts
index 7653a3b77ff..44d8bff4d2c 100644
--- a/libs/auth/src/common/models/domain/user-decryption-options.ts
+++ b/libs/auth/src/common/models/domain/user-decryption-options.ts
@@ -112,10 +112,11 @@ export class UserDecryptionOptions {
    * @throws If the response is nullish, this method will throw an error. User decryption options
    * are required for client initialization.
    */
-  // TODO: Change response type to `UserDecryptionOptionsResponse` after 2023.10 release (https://bitwarden.atlassian.net/browse/PM-3537)
-  static fromResponse(response: IdentityTokenResponse): UserDecryptionOptions {
+  static fromIdentityTokenResponse(response: IdentityTokenResponse): UserDecryptionOptions {
     if (response == null) {
-      throw new Error("User Decryption Options are required for client initialization.");
+      throw new Error(
+        "User Decryption Options are required for client initialization. Response is nullish.",
+      );
     }
 
     const decryptionOptions = new UserDecryptionOptions();
@@ -134,17 +135,9 @@ export class UserDecryptionOptions {
         responseOptions.keyConnectorOption,
       );
     } else {
-      // If the response does not have userDecryptionOptions, this means it's on a pre-TDE server version and so
-      // we must base our decryption options on the presence of the keyConnectorUrl.
-      // Note that the presence of keyConnectorUrl implies that the user does not have a master password, as in pre-TDE
-      // server versions, a master password short-circuited the addition of the keyConnectorUrl to the response.
-      // TODO: remove this check after 2023.10 release (https://bitwarden.atlassian.net/browse/PM-3537)
-      const usingKeyConnector = response.keyConnectorUrl != null;
-      decryptionOptions.hasMasterPassword = !usingKeyConnector;
-      if (usingKeyConnector) {
-        decryptionOptions.keyConnectorOption = new KeyConnectorUserDecryptionOption();
-        decryptionOptions.keyConnectorOption.keyConnectorUrl = response.keyConnectorUrl;
-      }
+      throw new Error(
+        "User Decryption Options are required for client initialization. userDecryptionOptions is missing in response.",
+      );
     }
     return decryptionOptions;
   }
diff --git a/libs/auth/src/common/services/login-strategies/login-strategy.service.spec.ts b/libs/auth/src/common/services/login-strategies/login-strategy.service.spec.ts
index 831692c160f..20251e339a5 100644
--- a/libs/auth/src/common/services/login-strategies/login-strategy.service.spec.ts
+++ b/libs/auth/src/common/services/login-strategies/login-strategy.service.spec.ts
@@ -10,6 +10,7 @@ import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/ide
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "@bitwarden/common/auth/models/response/identity-two-factor.response";
 import { PreloginResponse } from "@bitwarden/common/auth/models/response/prelogin.response";
+import { UserDecryptionOptionsResponse } from "@bitwarden/common/auth/models/response/user-decryption-options/user-decryption-options.response";
 import { TwoFactorService } from "@bitwarden/common/auth/two-factor";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
@@ -496,6 +497,7 @@ describe("LoginStrategyService", () => {
         refresh_token: "REFRESH_TOKEN",
         scope: "api offline_access",
         token_type: "Bearer",
+        userDecryptionOptions: new UserDecryptionOptionsResponse({ HasMasterPassword: true }),
       }),
     );
     apiService.postPrelogin.mockResolvedValue(
@@ -563,6 +565,7 @@ describe("LoginStrategyService", () => {
         refresh_token: "REFRESH_TOKEN",
         scope: "api offline_access",
         token_type: "Bearer",
+        userDecryptionOptions: new UserDecryptionOptionsResponse({ HasMasterPassword: true }),
       }),
     );
 
@@ -692,6 +695,7 @@ describe("LoginStrategyService", () => {
         refresh_token: "REFRESH_TOKEN",
         scope: "api offline_access",
         token_type: "Bearer",
+        userDecryptionOptions: new UserDecryptionOptionsResponse({ HasMasterPassword: true }),
       }),
     );
 
diff --git a/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.spec.ts b/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.spec.ts
index 975e065e21e..caa5d8b3290 100644
--- a/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.spec.ts
+++ b/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.spec.ts
@@ -1,6 +1,7 @@
 import { MockProxy, mock } from "jest-mock-extended";
 
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { UserId } from "@bitwarden/common/types/guid";
@@ -19,6 +20,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
   let ssoLoginService: MockProxy<SsoLoginServiceAbstraction>;
   let syncService: MockProxy<SyncService>;
   let userAsymmetricKeysRegenerationService: MockProxy<UserAsymmetricKeysRegenerationService>;
+  let encryptedMigrator: MockProxy<EncryptedMigrator>;
   let logService: MockProxy<LogService>;
 
   const userId = "USER_ID" as UserId;
@@ -30,6 +32,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
     ssoLoginService = mock<SsoLoginServiceAbstraction>();
     syncService = mock<SyncService>();
     userAsymmetricKeysRegenerationService = mock<UserAsymmetricKeysRegenerationService>();
+    encryptedMigrator = mock<EncryptedMigrator>();
     logService = mock<LogService>();
 
     service = new DefaultLoginSuccessHandlerService(
@@ -38,6 +41,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
       ssoLoginService,
       syncService,
       userAsymmetricKeysRegenerationService,
+      encryptedMigrator,
       logService,
     );
 
@@ -50,7 +54,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
 
   describe("run", () => {
     it("should call required services on successful login", async () => {
-      await service.run(userId);
+      await service.run(userId, null);
 
       expect(syncService.fullSync).toHaveBeenCalledWith(true, { skipTokenRefresh: true });
       expect(userAsymmetricKeysRegenerationService.regenerateIfNeeded).toHaveBeenCalledWith(userId);
@@ -58,7 +62,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
     });
 
     it("should get SSO email", async () => {
-      await service.run(userId);
+      await service.run(userId, null);
 
       expect(ssoLoginService.getSsoEmail).toHaveBeenCalled();
     });
@@ -68,10 +72,10 @@ describe("DefaultLoginSuccessHandlerService", () => {
         ssoLoginService.getSsoEmail.mockResolvedValue(null);
       });
 
-      it("should log error and return early", async () => {
-        await service.run(userId);
+      it("should not check SSO requirements", async () => {
+        await service.run(userId, null);
 
-        expect(logService.error).toHaveBeenCalledWith("SSO login email not found.");
+        expect(logService.debug).toHaveBeenCalledWith("SSO login email not found.");
         expect(ssoLoginService.updateSsoRequiredCache).not.toHaveBeenCalled();
       });
     });
@@ -82,7 +86,7 @@ describe("DefaultLoginSuccessHandlerService", () => {
       });
 
       it("should call updateSsoRequiredCache() and clearSsoEmail()", async () => {
-        await service.run(userId);
+        await service.run(userId, null);
 
         expect(ssoLoginService.updateSsoRequiredCache).toHaveBeenCalledWith(testEmail, userId);
         expect(ssoLoginService.clearSsoEmail).toHaveBeenCalled();
diff --git a/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.ts b/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.ts
index 27d058c311a..9d4311868d7 100644
--- a/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.ts
+++ b/libs/auth/src/common/services/login-success-handler/default-login-success-handler.service.ts
@@ -1,4 +1,5 @@
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { UserId } from "@bitwarden/common/types/guid";
@@ -15,17 +16,24 @@ export class DefaultLoginSuccessHandlerService implements LoginSuccessHandlerSer
     private ssoLoginService: SsoLoginServiceAbstraction,
     private syncService: SyncService,
     private userAsymmetricKeysRegenerationService: UserAsymmetricKeysRegenerationService,
+    private encryptedMigrator: EncryptedMigrator,
     private logService: LogService,
   ) {}
-  async run(userId: UserId): Promise<void> {
+
+  async run(userId: UserId, masterPassword: string | null): Promise<void> {
     await this.syncService.fullSync(true, { skipTokenRefresh: true });
     await this.userAsymmetricKeysRegenerationService.regenerateIfNeeded(userId);
     await this.loginEmailService.clearLoginEmail();
+    try {
+      await this.encryptedMigrator.runMigrations(userId, masterPassword);
+    } catch {
+      // Don't block login success on migration failure
+    }
 
     const ssoLoginEmail = await this.ssoLoginService.getSsoEmail();
 
     if (!ssoLoginEmail) {
-      this.logService.error("SSO login email not found.");
+      this.logService.debug("SSO login email not found.");
       return;
     }
 
diff --git a/libs/auth/src/common/services/sso-redirect/sso-url.service.ts b/libs/auth/src/common/services/sso-redirect/sso-url.service.ts
index b2d6231db7c..22404c5b1f7 100644
--- a/libs/auth/src/common/services/sso-redirect/sso-url.service.ts
+++ b/libs/auth/src/common/services/sso-redirect/sso-url.service.ts
@@ -8,9 +8,9 @@ export class SsoUrlService {
    * @param webAppUrl The URL of the web app
    * @param clientType The client type that is initiating SSO, which will drive how the response is handled
    * @param redirectUri The redirect URI or callback that will receive the SSO code after authentication
-   * @param state A state value that will be peristed through the SSO flow
+   * @param state A state value that will be persisted through the SSO flow
    * @param codeChallenge A challenge value that will be used to verify the SSO code after authentication
-   * @param email The optional email adddress of the user initiating SSO, which will be used to look up the org SSO identifier
+   * @param email The optional email address of the user initiating SSO, which will be used to look up the org SSO identifier
    * @param orgSsoIdentifier The optional SSO identifier of the org that is initiating SSO
    * @returns The URL for redirecting users to the web app SSO component
    */
diff --git a/libs/common/spec/fake-account-service.ts b/libs/common/spec/fake-account-service.ts
index ba48181faa2..389975dc2e1 100644
--- a/libs/common/spec/fake-account-service.ts
+++ b/libs/common/spec/fake-account-service.ts
@@ -37,6 +37,8 @@ export class FakeAccountService implements AccountService {
   accountActivitySubject = new ReplaySubject<Record<UserId, Date>>(1);
   // eslint-disable-next-line rxjs/no-exposed-subjects -- test class
   accountVerifyDevicesSubject = new ReplaySubject<boolean>(1);
+  // eslint-disable-next-line rxjs/no-exposed-subjects -- test class
+  showHeaderSubject = new ReplaySubject<boolean>(1);
   private _activeUserId: UserId;
   get activeUserId() {
     return this._activeUserId;
@@ -55,6 +57,7 @@ export class FakeAccountService implements AccountService {
       }),
     );
   }
+  showHeader$ = this.showHeaderSubject.asObservable();
   get nextUpAccount$(): Observable<Account> {
     return combineLatest([this.accounts$, this.activeAccount$, this.sortedUserIds$]).pipe(
       map(([accounts, activeAccount, sortedUserIds]) => {
@@ -114,6 +117,10 @@ export class FakeAccountService implements AccountService {
     this.accountsSubject.next(updated);
     await this.mock.clean(userId);
   }
+
+  async setShowHeader(value: boolean): Promise<void> {
+    this.showHeaderSubject.next(value);
+  }
 }
 
 const loggedOutInfo: AccountInfo = {
diff --git a/libs/common/spec/utils.ts b/libs/common/spec/utils.ts
index db9a7e0842c..f3e81d71ce2 100644
--- a/libs/common/spec/utils.ts
+++ b/libs/common/spec/utils.ts
@@ -2,7 +2,10 @@
 // @ts-strict-ignore
 import { mock, MockProxy } from "jest-mock-extended";
 
+import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { ContainerService } from "@bitwarden/common/platform/services/container.service";
+import { KeyService } from "@bitwarden/key-management";
 
 import { EncryptionType } from "../src/platform/enums";
 import { Utils } from "../src/platform/misc/utils";
@@ -29,6 +32,7 @@ export function BuildTestObject<T, K extends keyof T = keyof T>(
 
 export function mockEnc(s: string): MockProxy<EncString> {
   const mocked = mock<EncString>();
+  mocked.decryptedValue = s;
   mocked.decrypt.mockResolvedValue(s);
 
   return mocked;
@@ -77,4 +81,14 @@ export const mockFromSdk = (stub: any) => {
   return `${stub}_fromSdk`;
 };
 
+export const mockContainerService = () => {
+  const keyService = mock<KeyService>();
+  const encryptService = mock<EncryptService>();
+  encryptService.decryptString.mockImplementation(async (encStr, _key) => {
+    return encStr.decryptedValue;
+  });
+  (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
+  return (window as any).bitwardenContainerService;
+};
+
 export { trackEmissions, awaitAsync } from "@bitwarden/core-test-utils";
diff --git a/libs/common/src/abstractions/api.service.ts b/libs/common/src/abstractions/api.service.ts
index f7ca1964b76..72a17f0fa87 100644
--- a/libs/common/src/abstractions/api.service.ts
+++ b/libs/common/src/abstractions/api.service.ts
@@ -50,6 +50,7 @@ import { UpdateProfileRequest } from "../auth/models/request/update-profile.requ
 import { ApiKeyResponse } from "../auth/models/response/api-key.response";
 import { AuthRequestResponse } from "../auth/models/response/auth-request.response";
 import { IdentityDeviceVerificationResponse } from "../auth/models/response/identity-device-verification.response";
+import { IdentitySsoRequiredResponse } from "../auth/models/response/identity-sso-required.response";
 import { IdentityTokenResponse } from "../auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "../auth/models/response/identity-two-factor.response";
 import { KeyConnectorUserKeyResponse } from "../auth/models/response/key-connector-user-key.response";
@@ -140,7 +141,10 @@ export abstract class ApiService {
       | UserApiTokenRequest
       | WebAuthnLoginTokenRequest,
   ): Promise<
-    IdentityTokenResponse | IdentityTwoFactorResponse | IdentityDeviceVerificationResponse
+    | IdentityTokenResponse
+    | IdentityTwoFactorResponse
+    | IdentityDeviceVerificationResponse
+    | IdentitySsoRequiredResponse
   >;
   abstract refreshIdentityToken(userId?: UserId): Promise<any>;
 
diff --git a/libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts b/libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts
index 363b82c507d..54d2f93ac03 100644
--- a/libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts
+++ b/libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts
@@ -41,6 +41,18 @@ export function canAccessBillingTab(org: Organization): boolean {
   return org.isOwner;
 }
 
+/**
+ * Access Intelligence is only available to:
+ * - Enterprise organizations
+ * - Users in those organizations with report access
+ *
+ * @param org The organization to verify access
+ * @returns If true can access the Access Intelligence feature
+ */
+export function canAccessAccessIntelligence(org: Organization): boolean {
+  return org.canUseAccessIntelligence && org.canAccessReports;
+}
+
 export function canAccessOrgAdmin(org: Organization): boolean {
   // Admin console can only be accessed by Owners for disabled organizations
   if (!org.enabled && !org.isOwner) {
diff --git a/libs/common/src/admin-console/models/data/policy.data.ts b/libs/common/src/admin-console/models/data/policy.data.ts
index a8628e2f1ab..639fda1fa92 100644
--- a/libs/common/src/admin-console/models/data/policy.data.ts
+++ b/libs/common/src/admin-console/models/data/policy.data.ts
@@ -11,6 +11,7 @@ export class PolicyData {
   type: PolicyType;
   data: Record<string, string | number | boolean>;
   enabled: boolean;
+  revisionDate: string;
 
   constructor(response?: PolicyResponse) {
     if (response == null) {
@@ -22,6 +23,7 @@ export class PolicyData {
     this.type = response.type;
     this.data = response.data;
     this.enabled = response.enabled;
+    this.revisionDate = response.revisionDate;
   }
 
   static fromPolicy(policy: Policy): PolicyData {
diff --git a/libs/common/src/admin-console/models/domain/organization.ts b/libs/common/src/admin-console/models/domain/organization.ts
index b2153024ef8..dba4a1fedb3 100644
--- a/libs/common/src/admin-console/models/domain/organization.ts
+++ b/libs/common/src/admin-console/models/domain/organization.ts
@@ -402,4 +402,8 @@ export class Organization {
         this.permissions.accessEventLogs)
     );
   }
+
+  get canUseAccessIntelligence() {
+    return this.productTierType === ProductTierType.Enterprise;
+  }
 }
diff --git a/libs/common/src/admin-console/models/domain/policy.ts b/libs/common/src/admin-console/models/domain/policy.ts
index eb67c4412e9..6b2d587a262 100644
--- a/libs/common/src/admin-console/models/domain/policy.ts
+++ b/libs/common/src/admin-console/models/domain/policy.ts
@@ -19,6 +19,8 @@ export class Policy extends Domain {
    */
   enabled: boolean;
 
+  revisionDate: Date;
+
   constructor(obj?: PolicyData) {
     super();
     if (obj == null) {
@@ -30,6 +32,7 @@ export class Policy extends Domain {
     this.type = obj.type;
     this.data = obj.data;
     this.enabled = obj.enabled;
+    this.revisionDate = new Date(obj.revisionDate);
   }
 
   static fromResponse(response: PolicyResponse): Policy {
diff --git a/libs/common/src/admin-console/models/response/policy.response.ts b/libs/common/src/admin-console/models/response/policy.response.ts
index 0544cd996f4..7cca63a19d3 100644
--- a/libs/common/src/admin-console/models/response/policy.response.ts
+++ b/libs/common/src/admin-console/models/response/policy.response.ts
@@ -9,6 +9,7 @@ export class PolicyResponse extends BaseResponse {
   data: any;
   enabled: boolean;
   canToggleState: boolean;
+  revisionDate: string;
 
   constructor(response: any) {
     super(response);
@@ -18,5 +19,6 @@ export class PolicyResponse extends BaseResponse {
     this.data = this.getResponseProperty("Data");
     this.enabled = this.getResponseProperty("Enabled");
     this.canToggleState = this.getResponseProperty("CanToggleState") ?? true;
+    this.revisionDate = this.getResponseProperty("RevisionDate");
   }
 }
diff --git a/libs/common/src/admin-console/services/policy/default-policy.service.spec.ts b/libs/common/src/admin-console/services/policy/default-policy.service.spec.ts
index 4b59683ec0a..2ff649e6533 100644
--- a/libs/common/src/admin-console/services/policy/default-policy.service.spec.ts
+++ b/libs/common/src/admin-console/services/policy/default-policy.service.spec.ts
@@ -83,12 +83,15 @@ describe("PolicyService", () => {
         type: PolicyType.MaximumVaultTimeout,
         enabled: true,
         data: { minutes: 14 },
+        revisionDate: expect.any(Date),
       },
       {
         id: "99",
         organizationId: "test-organization",
         type: PolicyType.DisableSend,
         enabled: true,
+        data: undefined,
+        revisionDate: expect.any(Date),
       },
     ]);
   });
@@ -113,6 +116,8 @@ describe("PolicyService", () => {
         organizationId: "test-organization",
         type: PolicyType.DisableSend,
         enabled: true,
+        data: undefined,
+        revisionDate: expect.any(Date),
       },
     ]);
   });
@@ -242,6 +247,8 @@ describe("PolicyService", () => {
         organizationId: "org1",
         type: PolicyType.DisablePersonalVaultExport,
         enabled: true,
+        data: undefined,
+        revisionDate: expect.any(Date),
       });
     });
 
@@ -331,24 +338,32 @@ describe("PolicyService", () => {
           organizationId: "org4",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy2",
           organizationId: "org1",
           type: PolicyType.ActivateAutofill,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy3",
           organizationId: "org5",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy4",
           organizationId: "org1",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
       ]);
     });
@@ -371,24 +386,32 @@ describe("PolicyService", () => {
           organizationId: "org4",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy2",
           organizationId: "org1",
           type: PolicyType.ActivateAutofill,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy3",
           organizationId: "org5",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: false,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy4",
           organizationId: "org1",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
       ]);
     });
@@ -411,24 +434,32 @@ describe("PolicyService", () => {
           organizationId: "org4",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy2",
           organizationId: "org1",
           type: PolicyType.ActivateAutofill,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy3",
           organizationId: "org5",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy4",
           organizationId: "org2",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
       ]);
     });
@@ -451,24 +482,32 @@ describe("PolicyService", () => {
           organizationId: "org4",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy2",
           organizationId: "org1",
           type: PolicyType.ActivateAutofill,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy3",
           organizationId: "org3",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
         {
           id: "policy4",
           organizationId: "org1",
           type: PolicyType.DisablePersonalVaultExport,
           enabled: true,
+          data: undefined,
+          revisionDate: expect.any(Date),
         },
       ]);
     });
@@ -788,6 +827,7 @@ describe("PolicyService", () => {
     policyData.type = type;
     policyData.enabled = enabled;
     policyData.data = data;
+    policyData.revisionDate = new Date().toISOString();
 
     return policyData;
   }
diff --git a/libs/common/src/auth/abstractions/account.service.ts b/libs/common/src/auth/abstractions/account.service.ts
index a3dabeecf8a..8b0280feb01 100644
--- a/libs/common/src/auth/abstractions/account.service.ts
+++ b/libs/common/src/auth/abstractions/account.service.ts
@@ -47,6 +47,8 @@ export abstract class AccountService {
   abstract sortedUserIds$: Observable<UserId[]>;
   /** Next account that is not the current active account */
   abstract nextUpAccount$: Observable<Account>;
+  /** Observable to display the header */
+  abstract showHeader$: Observable<boolean>;
   /**
    * Updates the `accounts$` observable with the new account data.
    *
@@ -100,6 +102,11 @@ export abstract class AccountService {
    * @param lastActivity
    */
   abstract setAccountActivity(userId: UserId, lastActivity: Date): Promise<void>;
+  /**
+   * Show the account switcher.
+   * @param value
+   */
+  abstract setShowHeader(visible: boolean): Promise<void>;
 }
 
 export abstract class InternalAccountService extends AccountService {
diff --git a/libs/common/src/auth/models/domain/auth-result.ts b/libs/common/src/auth/models/domain/auth-result.ts
index a61a35eeb1d..178866901d3 100644
--- a/libs/common/src/auth/models/domain/auth-result.ts
+++ b/libs/common/src/auth/models/domain/auth-result.ts
@@ -1,5 +1,7 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { Utils } from "@bitwarden/common/platform/misc/utils";
+
 import { UserId } from "../../../types/guid";
 import { TwoFactorProviderType } from "../../enums/two-factor-provider-type";
 
@@ -18,8 +20,16 @@ export class AuthResult {
   email: string;
   requiresEncryptionKeyMigration: boolean;
   requiresDeviceVerification: boolean;
+  ssoOrganizationIdentifier?: string | null;
+  // The master-password used in the authentication process
+  masterPassword: string | null;
 
   get requiresTwoFactor() {
     return this.twoFactorProviders != null;
   }
+
+  // This is not as extensible as an object-based approach. In the future we may need to adjust to an object based approach.
+  get requiresSso() {
+    return !Utils.isNullOrWhitespace(this.ssoOrganizationIdentifier);
+  }
 }
diff --git a/libs/common/src/auth/models/response/identity-sso-required.response.ts b/libs/common/src/auth/models/response/identity-sso-required.response.ts
new file mode 100644
index 00000000000..b1b6df6fd08
--- /dev/null
+++ b/libs/common/src/auth/models/response/identity-sso-required.response.ts
@@ -0,0 +1,10 @@
+import { BaseResponse } from "@bitwarden/common/models/response/base.response";
+
+export class IdentitySsoRequiredResponse extends BaseResponse {
+  ssoOrganizationIdentifier: string | null;
+
+  constructor(response: any) {
+    super(response);
+    this.ssoOrganizationIdentifier = this.getResponseProperty("SsoOrganizationIdentifier");
+  }
+}
diff --git a/libs/common/src/auth/models/response/identity-token.response.ts b/libs/common/src/auth/models/response/identity-token.response.ts
index dab96f6cf8c..59e7eb98ec2 100644
--- a/libs/common/src/auth/models/response/identity-token.response.ts
+++ b/libs/common/src/auth/models/response/identity-token.response.ts
@@ -26,7 +26,6 @@ export class IdentityTokenResponse extends BaseResponse {
   forcePasswordReset: boolean;
   masterPasswordPolicy: MasterPasswordPolicyResponse;
   apiUseKeyConnector: boolean;
-  keyConnectorUrl: string;
 
   userDecryptionOptions?: UserDecryptionOptionsResponse;
 
@@ -70,7 +69,7 @@ export class IdentityTokenResponse extends BaseResponse {
         : new Argon2KdfConfig(kdfIterations, kdfMemory, kdfParallelism);
     this.forcePasswordReset = this.getResponseProperty("ForcePasswordReset");
     this.apiUseKeyConnector = this.getResponseProperty("ApiUseKeyConnector");
-    this.keyConnectorUrl = this.getResponseProperty("KeyConnectorUrl");
+
     this.masterPasswordPolicy = new MasterPasswordPolicyResponse(
       this.getResponseProperty("MasterPasswordPolicy"),
     );
diff --git a/libs/common/src/auth/services/account.service.spec.ts b/libs/common/src/auth/services/account.service.spec.ts
index 3fc47002083..3e3c878eaac 100644
--- a/libs/common/src/auth/services/account.service.spec.ts
+++ b/libs/common/src/auth/services/account.service.spec.ts
@@ -429,6 +429,16 @@ describe("accountService", () => {
         },
       );
     });
+
+    describe("setShowHeader", () => {
+      it("should update _showHeader$ when setShowHeader is called", async () => {
+        expect(sut["_showHeader$"].value).toBe(true);
+
+        await sut.setShowHeader(false);
+
+        expect(sut["_showHeader$"].value).toBe(false);
+      });
+    });
   });
 });
 
diff --git a/libs/common/src/auth/services/account.service.ts b/libs/common/src/auth/services/account.service.ts
index 1be11b03461..fb4b590ce77 100644
--- a/libs/common/src/auth/services/account.service.ts
+++ b/libs/common/src/auth/services/account.service.ts
@@ -6,6 +6,7 @@ import {
   distinctUntilChanged,
   shareReplay,
   combineLatest,
+  BehaviorSubject,
   Observable,
   switchMap,
   filter,
@@ -84,6 +85,7 @@ export const getOptionalUserId = map<Account | null, UserId | null>(
 export class AccountServiceImplementation implements InternalAccountService {
   private accountsState: GlobalState<Record<UserId, AccountInfo>>;
   private activeAccountIdState: GlobalState<UserId | undefined>;
+  private _showHeader$ = new BehaviorSubject<boolean>(true);
 
   accounts$: Observable<Record<UserId, AccountInfo>>;
   activeAccount$: Observable<Account | null>;
@@ -91,6 +93,7 @@ export class AccountServiceImplementation implements InternalAccountService {
   accountVerifyNewDeviceLogin$: Observable<boolean>;
   sortedUserIds$: Observable<UserId[]>;
   nextUpAccount$: Observable<Account>;
+  showHeader$ = this._showHeader$.asObservable();
 
   constructor(
     private messagingService: MessagingService,
@@ -262,6 +265,10 @@ export class AccountServiceImplementation implements InternalAccountService {
     }
   }
 
+  async setShowHeader(visible: boolean): Promise<void> {
+    this._showHeader$.next(visible);
+  }
+
   private async setAccountInfo(userId: UserId, update: Partial<AccountInfo>): Promise<void> {
     function newAccountInfo(oldAccountInfo: AccountInfo): AccountInfo {
       return { ...oldAccountInfo, ...update };
diff --git a/libs/common/src/billing/models/response/premium-plan.response.ts b/libs/common/src/billing/models/response/premium-plan.response.ts
index f5df560a601..73e4f834c6f 100644
--- a/libs/common/src/billing/models/response/premium-plan.response.ts
+++ b/libs/common/src/billing/models/response/premium-plan.response.ts
@@ -4,10 +4,12 @@ export class PremiumPlanResponse extends BaseResponse {
   seat: {
     stripePriceId: string;
     price: number;
+    provided: number;
   };
   storage: {
     stripePriceId: string;
     price: number;
+    provided: number;
   };
 
   constructor(response: any) {
@@ -30,6 +32,7 @@ export class PremiumPlanResponse extends BaseResponse {
 class PurchasableResponse extends BaseResponse {
   stripePriceId: string;
   price: number;
+  provided: number;
 
   constructor(response: any) {
     super(response);
@@ -43,5 +46,9 @@ class PurchasableResponse extends BaseResponse {
     if (typeof this.price !== "number" || isNaN(this.price)) {
       throw new Error("PurchasableResponse: Missing or invalid 'Price' property");
     }
+    this.provided = this.getResponseProperty("Provided");
+    if (typeof this.provided !== "number" || isNaN(this.provided)) {
+      throw new Error("PurchasableResponse: Missing or invalid 'Provided' property");
+    }
   }
 }
diff --git a/libs/common/src/billing/services/subscription-pricing.service.spec.ts b/libs/common/src/billing/services/subscription-pricing.service.spec.ts
index 8f5e9c0a3ab..33bfcebeb58 100644
--- a/libs/common/src/billing/services/subscription-pricing.service.spec.ts
+++ b/libs/common/src/billing/services/subscription-pricing.service.spec.ts
@@ -6,6 +6,10 @@ import { PlanType, ProductTierType } from "@bitwarden/common/billing/enums";
 import { PlanResponse } from "@bitwarden/common/billing/models/response/plan.response";
 import { PremiumPlanResponse } from "@bitwarden/common/billing/models/response/premium-plan.response";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import {
+  EnvironmentService,
+  Region,
+} from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/logging";
 
@@ -23,6 +27,7 @@ describe("DefaultSubscriptionPricingService", () => {
   let configService: MockProxy<ConfigService>;
   let i18nService: MockProxy<I18nService>;
   let logService: MockProxy<LogService>;
+  let environmentService: MockProxy<EnvironmentService>;
 
   const mockFamiliesPlan = {
     type: PlanType.FamiliesAnnually2025,
@@ -55,6 +60,7 @@ describe("DefaultSubscriptionPricingService", () => {
       basePrice: 36,
       seatPrice: 0,
       additionalStoragePricePerGb: 4,
+      providedStorageGB: 1,
       allowSeatAutoscale: false,
       maxSeats: 6,
       maxCollections: null,
@@ -94,6 +100,7 @@ describe("DefaultSubscriptionPricingService", () => {
       basePrice: 0,
       seatPrice: 36,
       additionalStoragePricePerGb: 4,
+      providedStorageGB: 1,
       allowSeatAutoscale: true,
       maxSeats: null,
       maxCollections: null,
@@ -248,7 +255,7 @@ describe("DefaultSubscriptionPricingService", () => {
           return "Custom";
 
         // Plan descriptions
-        case "planDescPremium":
+        case "advancedOnlineSecurity":
           return "Premium plan description";
         case "planDescFamiliesV2":
           return "Families plan description";
@@ -326,19 +333,32 @@ describe("DefaultSubscriptionPricingService", () => {
     });
   });
 
+  const setupEnvironmentService = (
+    envService: MockProxy<EnvironmentService>,
+    region: Region = Region.US,
+  ) => {
+    envService.environment$ = of({
+      getRegion: () => region,
+      isCloud: () => region !== Region.SelfHosted,
+    } as any);
+  };
+
   beforeEach(() => {
     billingApiService = mock<BillingApiServiceAbstraction>();
     configService = mock<ConfigService>();
+    environmentService = mock<EnvironmentService>();
 
     billingApiService.getPlans.mockResolvedValue(mockPlansResponse);
     billingApiService.getPremiumPlan.mockResolvedValue(mockPremiumPlanResponse);
     configService.getFeatureFlag$.mockReturnValue(of(false)); // Default to false (use hardcoded value)
+    setupEnvironmentService(environmentService);
 
     service = new DefaultSubscriptionPricingService(
       billingApiService,
       configService,
       i18nService,
       logService,
+      environmentService,
     );
   });
 
@@ -359,6 +379,7 @@ describe("DefaultSubscriptionPricingService", () => {
             type: "standalone",
             annualPrice: 10,
             annualPricePerAdditionalStorageGB: 4,
+            providedStorageGB: 1,
             features: [
               { key: "builtInAuthenticator", value: "Built-in authenticator" },
               { key: "secureFileStorage", value: "Secure file storage" },
@@ -383,6 +404,7 @@ describe("DefaultSubscriptionPricingService", () => {
             annualPrice: mockFamiliesPlan.PasswordManager.basePrice,
             annualPricePerAdditionalStorageGB:
               mockFamiliesPlan.PasswordManager.additionalStoragePricePerGb,
+            providedStorageGB: mockFamiliesPlan.PasswordManager.baseStorageGb,
             features: [
               { key: "premiumAccounts", value: "6 premium accounts" },
               { key: "familiesUnlimitedSharing", value: "Unlimited sharing for families" },
@@ -393,7 +415,7 @@ describe("DefaultSubscriptionPricingService", () => {
         });
 
         expect(i18nService.t).toHaveBeenCalledWith("premium");
-        expect(i18nService.t).toHaveBeenCalledWith("planDescPremium");
+        expect(i18nService.t).toHaveBeenCalledWith("advancedOnlineSecurity");
         expect(i18nService.t).toHaveBeenCalledWith("planNameFamilies");
         expect(i18nService.t).toHaveBeenCalledWith("planDescFamiliesV2");
         expect(i18nService.t).toHaveBeenCalledWith("builtInAuthenticator");
@@ -415,11 +437,13 @@ describe("DefaultSubscriptionPricingService", () => {
       const errorConfigService = mock<ConfigService>();
       const errorI18nService = mock<I18nService>();
       const errorLogService = mock<LogService>();
+      const errorEnvironmentService = mock<EnvironmentService>();
 
       const testError = new Error("API error");
       errorBillingApiService.getPlans.mockRejectedValue(testError);
       errorBillingApiService.getPremiumPlan.mockResolvedValue(mockPremiumPlanResponse);
       errorConfigService.getFeatureFlag$.mockReturnValue(of(false));
+      setupEnvironmentService(errorEnvironmentService);
 
       errorI18nService.t.mockImplementation((key: string) => key);
 
@@ -428,6 +452,7 @@ describe("DefaultSubscriptionPricingService", () => {
         errorConfigService,
         errorI18nService,
         errorLogService,
+        errorEnvironmentService,
       );
 
       errorService.getPersonalSubscriptionPricingTiers$().subscribe({
@@ -456,6 +481,7 @@ describe("DefaultSubscriptionPricingService", () => {
 
         expect(premiumTier.passwordManager.annualPrice).toEqual(10);
         expect(premiumTier.passwordManager.annualPricePerAdditionalStorageGB).toEqual(4);
+        expect(premiumTier.passwordManager.providedStorageGB).toEqual(1);
 
         expect(familiesTier.passwordManager.annualPrice).toEqual(
           mockFamiliesPlan.PasswordManager.basePrice,
@@ -463,6 +489,9 @@ describe("DefaultSubscriptionPricingService", () => {
         expect(familiesTier.passwordManager.annualPricePerAdditionalStorageGB).toEqual(
           mockFamiliesPlan.PasswordManager.additionalStoragePricePerGb,
         );
+        expect(familiesTier.passwordManager.providedStorageGB).toEqual(
+          mockFamiliesPlan.PasswordManager.baseStorageGb,
+        );
 
         done();
       });
@@ -487,6 +516,7 @@ describe("DefaultSubscriptionPricingService", () => {
             annualPricePerUser: mockTeamsPlan.PasswordManager.seatPrice,
             annualPricePerAdditionalStorageGB:
               mockTeamsPlan.PasswordManager.additionalStoragePricePerGb,
+            providedStorageGB: mockTeamsPlan.PasswordManager.baseStorageGb,
             features: [
               { key: "secureItemSharing", value: "Secure item sharing" },
               { key: "eventLogMonitoring", value: "Event log monitoring" },
@@ -522,6 +552,7 @@ describe("DefaultSubscriptionPricingService", () => {
             annualPricePerUser: mockEnterprisePlan.PasswordManager.seatPrice,
             annualPricePerAdditionalStorageGB:
               mockEnterprisePlan.PasswordManager.additionalStoragePricePerGb,
+            providedStorageGB: mockEnterprisePlan.PasswordManager.baseStorageGb,
             features: [
               { key: "enterpriseSecurityPolicies", value: "Enterprise security policies" },
               { key: "passwordLessSso", value: "Passwordless SSO" },
@@ -595,11 +626,13 @@ describe("DefaultSubscriptionPricingService", () => {
       const errorConfigService = mock<ConfigService>();
       const errorI18nService = mock<I18nService>();
       const errorLogService = mock<LogService>();
+      const errorEnvironmentService = mock<EnvironmentService>();
 
       const testError = new Error("API error");
       errorBillingApiService.getPlans.mockRejectedValue(testError);
       errorBillingApiService.getPremiumPlan.mockResolvedValue(mockPremiumPlanResponse);
       errorConfigService.getFeatureFlag$.mockReturnValue(of(false));
+      setupEnvironmentService(errorEnvironmentService);
 
       errorI18nService.t.mockImplementation((key: string) => key);
 
@@ -608,6 +641,7 @@ describe("DefaultSubscriptionPricingService", () => {
         errorConfigService,
         errorI18nService,
         errorLogService,
+        errorEnvironmentService,
       );
 
       errorService.getBusinessSubscriptionPricingTiers$().subscribe({
@@ -648,6 +682,9 @@ describe("DefaultSubscriptionPricingService", () => {
         expect(teamsSecretsManager.annualPricePerAdditionalServiceAccount).toEqual(
           mockTeamsPlan.SecretsManager.additionalPricePerServiceAccount,
         );
+        expect(teamsPasswordManager.providedStorageGB).toEqual(
+          mockTeamsPlan.PasswordManager.baseStorageGb,
+        );
 
         const enterprisePasswordManager = enterpriseTier.passwordManager as any;
         const enterpriseSecretsManager = enterpriseTier.secretsManager as any;
@@ -657,6 +694,9 @@ describe("DefaultSubscriptionPricingService", () => {
         expect(enterprisePasswordManager.annualPricePerAdditionalStorageGB).toEqual(
           mockEnterprisePlan.PasswordManager.additionalStoragePricePerGb,
         );
+        expect(enterprisePasswordManager.providedStorageGB).toEqual(
+          mockEnterprisePlan.PasswordManager.baseStorageGb,
+        );
         expect(enterpriseSecretsManager.annualPricePerUser).toEqual(
           mockEnterprisePlan.SecretsManager.seatPrice,
         );
@@ -729,6 +769,7 @@ describe("DefaultSubscriptionPricingService", () => {
             annualPricePerUser: mockTeamsPlan.PasswordManager.seatPrice,
             annualPricePerAdditionalStorageGB:
               mockTeamsPlan.PasswordManager.additionalStoragePricePerGb,
+            providedStorageGB: mockTeamsPlan.PasswordManager.baseStorageGb,
             features: [
               { key: "secureItemSharing", value: "Secure item sharing" },
               { key: "eventLogMonitoring", value: "Event log monitoring" },
@@ -764,6 +805,7 @@ describe("DefaultSubscriptionPricingService", () => {
             annualPricePerUser: mockEnterprisePlan.PasswordManager.seatPrice,
             annualPricePerAdditionalStorageGB:
               mockEnterprisePlan.PasswordManager.additionalStoragePricePerGb,
+            providedStorageGB: mockEnterprisePlan.PasswordManager.baseStorageGb,
             features: [
               { key: "enterpriseSecurityPolicies", value: "Enterprise security policies" },
               { key: "passwordLessSso", value: "Passwordless SSO" },
@@ -830,11 +872,13 @@ describe("DefaultSubscriptionPricingService", () => {
       const errorConfigService = mock<ConfigService>();
       const errorI18nService = mock<I18nService>();
       const errorLogService = mock<LogService>();
+      const errorEnvironmentService = mock<EnvironmentService>();
 
       const testError = new Error("API error");
       errorBillingApiService.getPlans.mockRejectedValue(testError);
       errorBillingApiService.getPremiumPlan.mockResolvedValue(mockPremiumPlanResponse);
       errorConfigService.getFeatureFlag$.mockReturnValue(of(false));
+      setupEnvironmentService(errorEnvironmentService);
 
       errorI18nService.t.mockImplementation((key: string) => key);
 
@@ -843,6 +887,7 @@ describe("DefaultSubscriptionPricingService", () => {
         errorConfigService,
         errorI18nService,
         errorLogService,
+        errorEnvironmentService,
       );
 
       errorService.getDeveloperSubscriptionPricingTiers$().subscribe({
@@ -865,17 +910,20 @@ describe("DefaultSubscriptionPricingService", () => {
     it("should handle getPremiumPlan() error when getPlans() succeeds", (done) => {
       const errorBillingApiService = mock<BillingApiServiceAbstraction>();
       const errorConfigService = mock<ConfigService>();
+      const errorEnvironmentService = mock<EnvironmentService>();
 
       const testError = new Error("Premium plan API error");
       errorBillingApiService.getPlans.mockResolvedValue(mockPlansResponse);
       errorBillingApiService.getPremiumPlan.mockRejectedValue(testError);
       errorConfigService.getFeatureFlag$.mockReturnValue(of(true)); // Enable feature flag to use premium plan API
+      setupEnvironmentService(errorEnvironmentService);
 
       const errorService = new DefaultSubscriptionPricingService(
         errorBillingApiService,
         errorConfigService,
         i18nService,
         logService,
+        errorEnvironmentService,
       );
 
       errorService.getPersonalSubscriptionPricingTiers$().subscribe({
@@ -896,88 +944,6 @@ describe("DefaultSubscriptionPricingService", () => {
         },
       });
     });
-
-    it("should handle malformed premium plan API response", (done) => {
-      const errorBillingApiService = mock<BillingApiServiceAbstraction>();
-      const errorConfigService = mock<ConfigService>();
-      const testError = new TypeError("Cannot read properties of undefined (reading 'price')");
-
-      // Malformed response missing the Seat property
-      const malformedResponse = {
-        Storage: {
-          StripePriceId: "price_storage",
-          Price: 4,
-        },
-      };
-
-      errorBillingApiService.getPlans.mockResolvedValue(mockPlansResponse);
-      errorBillingApiService.getPremiumPlan.mockResolvedValue(malformedResponse as any);
-      errorConfigService.getFeatureFlag$.mockReturnValue(of(true)); // Enable feature flag
-
-      const errorService = new DefaultSubscriptionPricingService(
-        errorBillingApiService,
-        errorConfigService,
-        i18nService,
-        logService,
-      );
-
-      errorService.getPersonalSubscriptionPricingTiers$().subscribe({
-        next: () => {
-          fail("Observable should error, not return a value");
-        },
-        error: (error: unknown) => {
-          expect(logService.error).toHaveBeenCalledWith(
-            "Failed to load personal subscription pricing tiers",
-            testError,
-          );
-          expect(error).toEqual(testError);
-          done();
-        },
-      });
-    });
-
-    it("should handle malformed premium plan with invalid price types", (done) => {
-      const errorBillingApiService = mock<BillingApiServiceAbstraction>();
-      const errorConfigService = mock<ConfigService>();
-      const testError = new TypeError("Cannot read properties of undefined (reading 'price')");
-
-      // Malformed response with price as string instead of number
-      const malformedResponse = {
-        Seat: {
-          StripePriceId: "price_seat",
-          Price: "10", // Should be a number
-        },
-        Storage: {
-          StripePriceId: "price_storage",
-          Price: 4,
-        },
-      };
-
-      errorBillingApiService.getPlans.mockResolvedValue(mockPlansResponse);
-      errorBillingApiService.getPremiumPlan.mockResolvedValue(malformedResponse as any);
-      errorConfigService.getFeatureFlag$.mockReturnValue(of(true)); // Enable feature flag
-
-      const errorService = new DefaultSubscriptionPricingService(
-        errorBillingApiService,
-        errorConfigService,
-        i18nService,
-        logService,
-      );
-
-      errorService.getPersonalSubscriptionPricingTiers$().subscribe({
-        next: () => {
-          fail("Observable should error, not return a value");
-        },
-        error: (error: unknown) => {
-          expect(logService.error).toHaveBeenCalledWith(
-            "Failed to load personal subscription pricing tiers",
-            testError,
-          );
-          expect(error).toEqual(testError);
-          done();
-        },
-      });
-    });
   });
 
   describe("Observable behavior and caching", () => {
@@ -997,10 +963,12 @@ describe("DefaultSubscriptionPricingService", () => {
       // Create a new mock to avoid conflicts with beforeEach setup
       const newBillingApiService = mock<BillingApiServiceAbstraction>();
       const newConfigService = mock<ConfigService>();
+      const newEnvironmentService = mock<EnvironmentService>();
 
       newBillingApiService.getPlans.mockResolvedValue(mockPlansResponse);
       newBillingApiService.getPremiumPlan.mockResolvedValue(mockPremiumPlanResponse);
       newConfigService.getFeatureFlag$.mockReturnValue(of(true));
+      setupEnvironmentService(newEnvironmentService);
 
       const getPremiumPlanSpy = jest.spyOn(newBillingApiService, "getPremiumPlan");
 
@@ -1010,6 +978,7 @@ describe("DefaultSubscriptionPricingService", () => {
         newConfigService,
         i18nService,
         logService,
+        newEnvironmentService,
       );
 
       // Subscribe to the premium pricing tier multiple times
@@ -1024,6 +993,7 @@ describe("DefaultSubscriptionPricingService", () => {
       // Create a new mock to test from scratch
       const newBillingApiService = mock<BillingApiServiceAbstraction>();
       const newConfigService = mock<ConfigService>();
+      const newEnvironmentService = mock<EnvironmentService>();
 
       newBillingApiService.getPlans.mockResolvedValue(mockPlansResponse);
       newBillingApiService.getPremiumPlan.mockResolvedValue({
@@ -1031,6 +1001,7 @@ describe("DefaultSubscriptionPricingService", () => {
         storage: { price: 999 },
       } as PremiumPlanResponse);
       newConfigService.getFeatureFlag$.mockReturnValue(of(false));
+      setupEnvironmentService(newEnvironmentService);
 
       // Create a new service instance with the feature flag disabled
       const newService = new DefaultSubscriptionPricingService(
@@ -1038,6 +1009,7 @@ describe("DefaultSubscriptionPricingService", () => {
         newConfigService,
         i18nService,
         logService,
+        newEnvironmentService,
       );
 
       // Subscribe with feature flag disabled
@@ -1053,4 +1025,66 @@ describe("DefaultSubscriptionPricingService", () => {
       });
     });
   });
+
+  describe("Self-hosted environment behavior", () => {
+    it("should not call API for self-hosted environment", () => {
+      const selfHostedBillingApiService = mock<BillingApiServiceAbstraction>();
+      const selfHostedConfigService = mock<ConfigService>();
+      const selfHostedEnvironmentService = mock<EnvironmentService>();
+
+      const getPlansSpy = jest.spyOn(selfHostedBillingApiService, "getPlans");
+      const getPremiumPlanSpy = jest.spyOn(selfHostedBillingApiService, "getPremiumPlan");
+
+      selfHostedConfigService.getFeatureFlag$.mockReturnValue(of(true));
+      setupEnvironmentService(selfHostedEnvironmentService, Region.SelfHosted);
+
+      const selfHostedService = new DefaultSubscriptionPricingService(
+        selfHostedBillingApiService,
+        selfHostedConfigService,
+        i18nService,
+        logService,
+        selfHostedEnvironmentService,
+      );
+
+      // Trigger subscriptions by calling the methods
+      selfHostedService.getPersonalSubscriptionPricingTiers$().subscribe();
+      selfHostedService.getBusinessSubscriptionPricingTiers$().subscribe();
+      selfHostedService.getDeveloperSubscriptionPricingTiers$().subscribe();
+
+      // API should not be called for self-hosted environments
+      expect(getPlansSpy).not.toHaveBeenCalled();
+      expect(getPremiumPlanSpy).not.toHaveBeenCalled();
+    });
+
+    it("should return valid tier structure with undefined prices for self-hosted", (done) => {
+      const selfHostedBillingApiService = mock<BillingApiServiceAbstraction>();
+      const selfHostedConfigService = mock<ConfigService>();
+      const selfHostedEnvironmentService = mock<EnvironmentService>();
+
+      selfHostedConfigService.getFeatureFlag$.mockReturnValue(of(true));
+      setupEnvironmentService(selfHostedEnvironmentService, Region.SelfHosted);
+
+      const selfHostedService = new DefaultSubscriptionPricingService(
+        selfHostedBillingApiService,
+        selfHostedConfigService,
+        i18nService,
+        logService,
+        selfHostedEnvironmentService,
+      );
+
+      selfHostedService.getPersonalSubscriptionPricingTiers$().subscribe((tiers) => {
+        expect(tiers).toHaveLength(2); // Premium and Families
+
+        const premiumTier = tiers.find((t) => t.id === PersonalSubscriptionPricingTierIds.Premium);
+        expect(premiumTier).toBeDefined();
+        expect(premiumTier?.passwordManager.annualPrice).toBeUndefined();
+        expect(premiumTier?.passwordManager.annualPricePerAdditionalStorageGB).toBeUndefined();
+        expect(premiumTier?.passwordManager.providedStorageGB).toBeUndefined();
+        expect(premiumTier?.passwordManager.features).toBeDefined();
+        expect(premiumTier?.passwordManager.features.length).toBeGreaterThan(0);
+
+        done();
+      });
+    });
+  });
 });
diff --git a/libs/common/src/billing/services/subscription-pricing.service.ts b/libs/common/src/billing/services/subscription-pricing.service.ts
index f1502eb26e8..9ba76d348d0 100644
--- a/libs/common/src/billing/services/subscription-pricing.service.ts
+++ b/libs/common/src/billing/services/subscription-pricing.service.ts
@@ -19,6 +19,7 @@ import { PremiumPlanResponse } from "@bitwarden/common/billing/models/response/p
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { ListResponse } from "@bitwarden/common/models/response/list.response";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/logging";
 
@@ -40,17 +41,20 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
    */
   private static readonly FALLBACK_PREMIUM_SEAT_PRICE = 10;
   private static readonly FALLBACK_PREMIUM_STORAGE_PRICE = 4;
+  private static readonly FALLBACK_PREMIUM_PROVIDED_STORAGE_GB = 1;
 
   constructor(
     private billingApiService: BillingApiServiceAbstraction,
     private configService: ConfigService,
     private i18nService: I18nService,
     private logService: LogService,
+    private environmentService: EnvironmentService,
   ) {}
 
   /**
    * Gets personal subscription pricing tiers (Premium and Families).
    * Throws any errors that occur during api request so callers must handle errors.
+   * Pricing information will be undefined if current environment is self-hosted.
    * @returns An observable of an array of personal subscription pricing tiers.
    * @throws Error if any errors occur during api request.
    */
@@ -65,6 +69,7 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
   /**
    * Gets business subscription pricing tiers (Teams, Enterprise, and Custom).
    * Throws any errors that occur during api request so callers must handle errors.
+   * Pricing information will be undefined if current environment is self-hosted.
    * @returns An observable of an array of business subscription pricing tiers.
    * @throws Error if any errors occur during api request.
    */
@@ -79,6 +84,7 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
   /**
    * Gets developer subscription pricing tiers (Free, Teams, and Enterprise).
    * Throws any errors that occur during api request so callers must handle errors.
+   * Pricing information will be undefined if current environment is self-hosted.
    * @returns An observable of an array of business subscription pricing tiers for developers.
    * @throws Error if any errors occur during api request.
    */
@@ -90,19 +96,32 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
       }),
     );
 
-  private plansResponse$: Observable<ListResponse<PlanResponse>> = from(
-    this.billingApiService.getPlans(),
-  ).pipe(shareReplay({ bufferSize: 1, refCount: false }));
+  private organizationPlansResponse$: Observable<ListResponse<PlanResponse>> =
+    this.environmentService.environment$.pipe(
+      take(1),
+      switchMap((environment) =>
+        !environment.isCloud()
+          ? of({ data: [] } as unknown as ListResponse<PlanResponse>)
+          : from(this.billingApiService.getPlans()),
+      ),
+      shareReplay({ bufferSize: 1, refCount: false }),
+    );
 
-  private premiumPlanResponse$: Observable<PremiumPlanResponse> = from(
-    this.billingApiService.getPremiumPlan(),
-  ).pipe(
-    catchError((error: unknown) => {
-      this.logService.error("Failed to fetch premium plan from API", error);
-      return throwError(() => error); // Re-throw to propagate to higher-level error handler
-    }),
-    shareReplay({ bufferSize: 1, refCount: false }),
-  );
+  private premiumPlanResponse$: Observable<PremiumPlanResponse> =
+    this.environmentService.environment$.pipe(
+      take(1),
+      switchMap((environment) =>
+        !environment.isCloud()
+          ? of({ seat: undefined, storage: undefined } as unknown as PremiumPlanResponse)
+          : from(this.billingApiService.getPremiumPlan()).pipe(
+              catchError((error: unknown) => {
+                this.logService.error("Failed to fetch premium plan from API", error);
+                return throwError(() => error); // Re-throw to propagate to higher-level error handler
+              }),
+            ),
+      ),
+      shareReplay({ bufferSize: 1, refCount: false }),
+    );
 
   private premium$: Observable<PersonalSubscriptionPricingTier> = this.configService
     .getFeatureFlag$(FeatureFlag.PM26793_FetchPremiumPriceFromPricingService)
@@ -112,24 +131,27 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
         fetchPremiumFromPricingService
           ? this.premiumPlanResponse$.pipe(
               map((premiumPlan) => ({
-                seat: premiumPlan.seat.price,
-                storage: premiumPlan.storage.price,
+                seat: premiumPlan.seat?.price,
+                storage: premiumPlan.storage?.price,
+                provided: premiumPlan.storage?.provided,
               })),
             )
           : of({
               seat: DefaultSubscriptionPricingService.FALLBACK_PREMIUM_SEAT_PRICE,
               storage: DefaultSubscriptionPricingService.FALLBACK_PREMIUM_STORAGE_PRICE,
+              provided: DefaultSubscriptionPricingService.FALLBACK_PREMIUM_PROVIDED_STORAGE_GB,
             }),
       ),
       map((premiumPrices) => ({
         id: PersonalSubscriptionPricingTierIds.Premium,
         name: this.i18nService.t("premium"),
-        description: this.i18nService.t("planDescPremium"),
+        description: this.i18nService.t("advancedOnlineSecurity"),
         availableCadences: [SubscriptionCadenceIds.Annually],
         passwordManager: {
           type: "standalone",
           annualPrice: premiumPrices.seat,
           annualPricePerAdditionalStorageGB: premiumPrices.storage,
+          providedStorageGB: premiumPrices.provided,
           features: [
             this.featureTranslations.builtInAuthenticator(),
             this.featureTranslations.secureFileStorage(),
@@ -141,40 +163,42 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
       })),
     );
 
-  private families$: Observable<PersonalSubscriptionPricingTier> = this.plansResponse$.pipe(
-    combineLatestWith(this.configService.getFeatureFlag$(FeatureFlag.PM26462_Milestone_3)),
-    map(([plans, milestone3FeatureEnabled]) => {
-      const familiesPlan = plans.data.find(
-        (plan) =>
-          plan.type ===
-          (milestone3FeatureEnabled ? PlanType.FamiliesAnnually : PlanType.FamiliesAnnually2025),
-      )!;
+  private families$: Observable<PersonalSubscriptionPricingTier> =
+    this.organizationPlansResponse$.pipe(
+      combineLatestWith(this.configService.getFeatureFlag$(FeatureFlag.PM26462_Milestone_3)),
+      map(([plans, milestone3FeatureEnabled]) => {
+        const familiesPlan = plans.data.find(
+          (plan) =>
+            plan.type ===
+            (milestone3FeatureEnabled ? PlanType.FamiliesAnnually : PlanType.FamiliesAnnually2025),
+        );
 
-      return {
-        id: PersonalSubscriptionPricingTierIds.Families,
-        name: this.i18nService.t("planNameFamilies"),
-        description: this.i18nService.t("planDescFamiliesV2"),
-        availableCadences: [SubscriptionCadenceIds.Annually],
-        passwordManager: {
-          type: "packaged",
-          users: familiesPlan.PasswordManager.baseSeats,
-          annualPrice: familiesPlan.PasswordManager.basePrice,
-          annualPricePerAdditionalStorageGB:
-            familiesPlan.PasswordManager.additionalStoragePricePerGb,
-          features: [
-            this.featureTranslations.premiumAccounts(),
-            this.featureTranslations.familiesUnlimitedSharing(),
-            this.featureTranslations.familiesUnlimitedCollections(),
-            this.featureTranslations.familiesSharedStorage(),
-          ],
-        },
-      };
-    }),
-  );
+        return {
+          id: PersonalSubscriptionPricingTierIds.Families,
+          name: this.i18nService.t("planNameFamilies"),
+          description: this.i18nService.t("planDescFamiliesV2"),
+          availableCadences: [SubscriptionCadenceIds.Annually],
+          passwordManager: {
+            type: "packaged",
+            users: familiesPlan?.PasswordManager?.baseSeats,
+            annualPrice: familiesPlan?.PasswordManager?.basePrice,
+            annualPricePerAdditionalStorageGB:
+              familiesPlan?.PasswordManager?.additionalStoragePricePerGb,
+            providedStorageGB: familiesPlan?.PasswordManager?.baseStorageGb,
+            features: [
+              this.featureTranslations.premiumAccounts(),
+              this.featureTranslations.familiesUnlimitedSharing(),
+              this.featureTranslations.familiesUnlimitedCollections(),
+              this.featureTranslations.familiesSharedStorage(),
+            ],
+          },
+        };
+      }),
+    );
 
-  private free$: Observable<BusinessSubscriptionPricingTier> = this.plansResponse$.pipe(
+  private free$: Observable<BusinessSubscriptionPricingTier> = this.organizationPlansResponse$.pipe(
     map((plans): BusinessSubscriptionPricingTier => {
-      const freePlan = plans.data.find((plan) => plan.type === PlanType.Free)!;
+      const freePlan = plans.data.find((plan) => plan.type === PlanType.Free);
 
       return {
         id: BusinessSubscriptionPricingTierIds.Free,
@@ -184,8 +208,10 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
         passwordManager: {
           type: "free",
           features: [
-            this.featureTranslations.limitedUsersV2(freePlan.PasswordManager.maxSeats),
-            this.featureTranslations.limitedCollectionsV2(freePlan.PasswordManager.maxCollections),
+            this.featureTranslations.limitedUsersV2(freePlan?.PasswordManager?.maxSeats),
+            this.featureTranslations.limitedCollectionsV2(
+              freePlan?.PasswordManager?.maxCollections,
+            ),
             this.featureTranslations.alwaysFree(),
           ],
         },
@@ -193,108 +219,113 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
           type: "free",
           features: [
             this.featureTranslations.twoSecretsIncluded(),
-            this.featureTranslations.projectsIncludedV2(freePlan.SecretsManager.maxProjects),
+            this.featureTranslations.projectsIncludedV2(freePlan?.SecretsManager?.maxProjects),
           ],
         },
       };
     }),
   );
 
-  private teams$: Observable<BusinessSubscriptionPricingTier> = this.plansResponse$.pipe(
-    map((plans) => {
-      const annualTeamsPlan = plans.data.find((plan) => plan.type === PlanType.TeamsAnnually)!;
+  private teams$: Observable<BusinessSubscriptionPricingTier> =
+    this.organizationPlansResponse$.pipe(
+      map((plans) => {
+        const annualTeamsPlan = plans.data.find((plan) => plan.type === PlanType.TeamsAnnually);
 
-      return {
-        id: BusinessSubscriptionPricingTierIds.Teams,
-        name: this.i18nService.t("planNameTeams"),
-        description: this.i18nService.t("teamsPlanUpgradeMessage"),
-        availableCadences: [SubscriptionCadenceIds.Annually, SubscriptionCadenceIds.Monthly],
-        passwordManager: {
-          type: "scalable",
-          annualPricePerUser: annualTeamsPlan.PasswordManager.seatPrice,
-          annualPricePerAdditionalStorageGB:
-            annualTeamsPlan.PasswordManager.additionalStoragePricePerGb,
-          features: [
-            this.featureTranslations.secureItemSharing(),
-            this.featureTranslations.eventLogMonitoring(),
-            this.featureTranslations.directoryIntegration(),
-            this.featureTranslations.scimSupport(),
-          ],
-        },
-        secretsManager: {
-          type: "scalable",
-          annualPricePerUser: annualTeamsPlan.SecretsManager.seatPrice,
-          annualPricePerAdditionalServiceAccount:
-            annualTeamsPlan.SecretsManager.additionalPricePerServiceAccount,
-          features: [
-            this.featureTranslations.unlimitedSecretsAndProjects(),
-            this.featureTranslations.includedMachineAccountsV2(
-              annualTeamsPlan.SecretsManager.baseServiceAccount,
-            ),
-          ],
-        },
-      };
-    }),
-  );
-
-  private enterprise$: Observable<BusinessSubscriptionPricingTier> = this.plansResponse$.pipe(
-    map((plans) => {
-      const annualEnterprisePlan = plans.data.find(
-        (plan) => plan.type === PlanType.EnterpriseAnnually,
-      )!;
-
-      return {
-        id: BusinessSubscriptionPricingTierIds.Enterprise,
-        name: this.i18nService.t("planNameEnterprise"),
-        description: this.i18nService.t("planDescEnterpriseV2"),
-        availableCadences: [SubscriptionCadenceIds.Annually, SubscriptionCadenceIds.Monthly],
-        passwordManager: {
-          type: "scalable",
-          annualPricePerUser: annualEnterprisePlan.PasswordManager.seatPrice,
-          annualPricePerAdditionalStorageGB:
-            annualEnterprisePlan.PasswordManager.additionalStoragePricePerGb,
-          features: [
-            this.featureTranslations.enterpriseSecurityPolicies(),
-            this.featureTranslations.passwordLessSso(),
-            this.featureTranslations.accountRecovery(),
-            this.featureTranslations.selfHostOption(),
-            this.featureTranslations.complimentaryFamiliesPlan(),
-          ],
-        },
-        secretsManager: {
-          type: "scalable",
-          annualPricePerUser: annualEnterprisePlan.SecretsManager.seatPrice,
-          annualPricePerAdditionalServiceAccount:
-            annualEnterprisePlan.SecretsManager.additionalPricePerServiceAccount,
-          features: [
-            this.featureTranslations.unlimitedUsers(),
-            this.featureTranslations.includedMachineAccountsV2(
-              annualEnterprisePlan.SecretsManager.baseServiceAccount,
-            ),
-          ],
-        },
-      };
-    }),
-  );
-
-  private custom$: Observable<BusinessSubscriptionPricingTier> = this.plansResponse$.pipe(
-    map(
-      (): BusinessSubscriptionPricingTier => ({
-        id: BusinessSubscriptionPricingTierIds.Custom,
-        name: this.i18nService.t("planNameCustom"),
-        description: this.i18nService.t("planDescCustom"),
-        availableCadences: [],
-        passwordManager: {
-          type: "custom",
-          features: [
-            this.featureTranslations.strengthenCybersecurity(),
-            this.featureTranslations.boostProductivity(),
-            this.featureTranslations.seamlessIntegration(),
-          ],
-        },
+        return {
+          id: BusinessSubscriptionPricingTierIds.Teams,
+          name: this.i18nService.t("planNameTeams"),
+          description: this.i18nService.t("teamsPlanUpgradeMessage"),
+          availableCadences: [SubscriptionCadenceIds.Annually, SubscriptionCadenceIds.Monthly],
+          passwordManager: {
+            type: "scalable",
+            annualPricePerUser: annualTeamsPlan?.PasswordManager?.seatPrice,
+            annualPricePerAdditionalStorageGB:
+              annualTeamsPlan?.PasswordManager?.additionalStoragePricePerGb,
+            providedStorageGB: annualTeamsPlan?.PasswordManager?.baseStorageGb,
+            features: [
+              this.featureTranslations.secureItemSharing(),
+              this.featureTranslations.eventLogMonitoring(),
+              this.featureTranslations.directoryIntegration(),
+              this.featureTranslations.scimSupport(),
+            ],
+          },
+          secretsManager: {
+            type: "scalable",
+            annualPricePerUser: annualTeamsPlan?.SecretsManager?.seatPrice,
+            annualPricePerAdditionalServiceAccount:
+              annualTeamsPlan?.SecretsManager?.additionalPricePerServiceAccount,
+            features: [
+              this.featureTranslations.unlimitedSecretsAndProjects(),
+              this.featureTranslations.includedMachineAccountsV2(
+                annualTeamsPlan?.SecretsManager?.baseServiceAccount,
+              ),
+            ],
+          },
+        };
       }),
-    ),
-  );
+    );
+
+  private enterprise$: Observable<BusinessSubscriptionPricingTier> =
+    this.organizationPlansResponse$.pipe(
+      map((plans) => {
+        const annualEnterprisePlan = plans.data.find(
+          (plan) => plan.type === PlanType.EnterpriseAnnually,
+        );
+
+        return {
+          id: BusinessSubscriptionPricingTierIds.Enterprise,
+          name: this.i18nService.t("planNameEnterprise"),
+          description: this.i18nService.t("planDescEnterpriseV2"),
+          availableCadences: [SubscriptionCadenceIds.Annually, SubscriptionCadenceIds.Monthly],
+          passwordManager: {
+            type: "scalable",
+            annualPricePerUser: annualEnterprisePlan?.PasswordManager?.seatPrice,
+            annualPricePerAdditionalStorageGB:
+              annualEnterprisePlan?.PasswordManager?.additionalStoragePricePerGb,
+            providedStorageGB: annualEnterprisePlan?.PasswordManager?.baseStorageGb,
+            features: [
+              this.featureTranslations.enterpriseSecurityPolicies(),
+              this.featureTranslations.passwordLessSso(),
+              this.featureTranslations.accountRecovery(),
+              this.featureTranslations.selfHostOption(),
+              this.featureTranslations.complimentaryFamiliesPlan(),
+            ],
+          },
+          secretsManager: {
+            type: "scalable",
+            annualPricePerUser: annualEnterprisePlan?.SecretsManager?.seatPrice,
+            annualPricePerAdditionalServiceAccount:
+              annualEnterprisePlan?.SecretsManager?.additionalPricePerServiceAccount,
+            features: [
+              this.featureTranslations.unlimitedUsers(),
+              this.featureTranslations.includedMachineAccountsV2(
+                annualEnterprisePlan?.SecretsManager?.baseServiceAccount,
+              ),
+            ],
+          },
+        };
+      }),
+    );
+
+  private custom$: Observable<BusinessSubscriptionPricingTier> =
+    this.organizationPlansResponse$.pipe(
+      map(
+        (): BusinessSubscriptionPricingTier => ({
+          id: BusinessSubscriptionPricingTierIds.Custom,
+          name: this.i18nService.t("planNameCustom"),
+          description: this.i18nService.t("planDescCustom"),
+          availableCadences: [],
+          passwordManager: {
+            type: "custom",
+            features: [
+              this.featureTranslations.strengthenCybersecurity(),
+              this.featureTranslations.boostProductivity(),
+              this.featureTranslations.seamlessIntegration(),
+            ],
+          },
+        }),
+      ),
+    );
 
   private featureTranslations = {
     builtInAuthenticator: () => ({
@@ -333,11 +364,11 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
       key: "familiesSharedStorage",
       value: this.i18nService.t("familiesSharedStorage"),
     }),
-    limitedUsersV2: (users: number) => ({
+    limitedUsersV2: (users?: number) => ({
       key: "limitedUsersV2",
       value: this.i18nService.t("limitedUsersV2", users),
     }),
-    limitedCollectionsV2: (collections: number) => ({
+    limitedCollectionsV2: (collections?: number) => ({
       key: "limitedCollectionsV2",
       value: this.i18nService.t("limitedCollectionsV2", collections),
     }),
@@ -349,7 +380,7 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
       key: "twoSecretsIncluded",
       value: this.i18nService.t("twoSecretsIncluded"),
     }),
-    projectsIncludedV2: (projects: number) => ({
+    projectsIncludedV2: (projects?: number) => ({
       key: "projectsIncludedV2",
       value: this.i18nService.t("projectsIncludedV2", projects),
     }),
@@ -373,7 +404,7 @@ export class DefaultSubscriptionPricingService implements SubscriptionPricingSer
       key: "unlimitedSecretsAndProjects",
       value: this.i18nService.t("unlimitedSecretsAndProjects"),
     }),
-    includedMachineAccountsV2: (included: number) => ({
+    includedMachineAccountsV2: (included?: number) => ({
       key: "includedMachineAccountsV2",
       value: this.i18nService.t("includedMachineAccountsV2", included),
     }),
diff --git a/libs/common/src/billing/types/subscription-pricing-tier.ts b/libs/common/src/billing/types/subscription-pricing-tier.ts
index 8febc4b86db..f14e963b6b0 100644
--- a/libs/common/src/billing/types/subscription-pricing-tier.ts
+++ b/libs/common/src/billing/types/subscription-pricing-tier.ts
@@ -27,20 +27,26 @@ type HasFeatures = {
 };
 
 type HasAdditionalStorage = {
-  annualPricePerAdditionalStorageGB: number;
+  annualPricePerAdditionalStorageGB?: number;
+};
+
+type HasProvidedStorage = {
+  providedStorageGB?: number;
 };
 
 type StandalonePasswordManager = HasFeatures &
-  HasAdditionalStorage & {
+  HasAdditionalStorage &
+  HasProvidedStorage & {
     type: "standalone";
-    annualPrice: number;
+    annualPrice?: number;
   };
 
 type PackagedPasswordManager = HasFeatures &
+  HasProvidedStorage &
   HasAdditionalStorage & {
     type: "packaged";
-    users: number;
-    annualPrice: number;
+    users?: number;
+    annualPrice?: number;
   };
 
 type FreePasswordManager = HasFeatures & {
@@ -52,9 +58,10 @@ type CustomPasswordManager = HasFeatures & {
 };
 
 type ScalablePasswordManager = HasFeatures &
+  HasProvidedStorage &
   HasAdditionalStorage & {
     type: "scalable";
-    annualPricePerUser: number;
+    annualPricePerUser?: number;
   };
 
 type FreeSecretsManager = HasFeatures & {
@@ -63,8 +70,8 @@ type FreeSecretsManager = HasFeatures & {
 
 type ScalableSecretsManager = HasFeatures & {
   type: "scalable";
-  annualPricePerUser: number;
-  annualPricePerAdditionalServiceAccount: number;
+  annualPricePerUser?: number;
+  annualPricePerAdditionalServiceAccount?: number;
 };
 
 export type PersonalSubscriptionPricingTier = {
diff --git a/libs/common/src/dirt/services/hibp-api.service.spec.ts b/libs/common/src/dirt/services/hibp-api.service.spec.ts
index fd2a54bdd10..9e08b4d0623 100644
--- a/libs/common/src/dirt/services/hibp-api.service.spec.ts
+++ b/libs/common/src/dirt/services/hibp-api.service.spec.ts
@@ -35,5 +35,26 @@ describe("HibpApiService", () => {
       expect(result).toHaveLength(1);
       expect(result[0]).toBeInstanceOf(BreachAccountResponse);
     });
+
+    it("should return empty array when no breaches found (REST semantics)", async () => {
+      // Server now returns 200 OK with empty array [] instead of 404
+      const mockResponse: any[] = [];
+      const username = "safe@example.com";
+
+      apiService.send.mockResolvedValue(mockResponse);
+
+      const result = await sut.getHibpBreach(username);
+
+      expect(apiService.send).toHaveBeenCalledWith(
+        "GET",
+        "/hibp/breach?username=" + encodeURIComponent(username),
+        null,
+        true,
+        true,
+      );
+      expect(result).toEqual([]);
+      expect(result).toBeInstanceOf(Array);
+      expect(result).toHaveLength(0);
+    });
   });
 });
diff --git a/libs/common/src/enums/feature-flag.enum.ts b/libs/common/src/enums/feature-flag.enum.ts
index 6010110f069..fb8edd8aa7d 100644
--- a/libs/common/src/enums/feature-flag.enum.ts
+++ b/libs/common/src/enums/feature-flag.enum.ts
@@ -14,6 +14,7 @@ export enum FeatureFlag {
   CreateDefaultLocation = "pm-19467-create-default-location",
   AutoConfirm = "pm-19934-auto-confirm-organization-users",
   BlockClaimedDomainAccountCreation = "pm-28297-block-uninvited-claimed-domain-registration",
+  IncreaseBulkReinviteLimitForCloud = "pm-28251-increase-bulk-reinvite-limit-for-cloud",
 
   /* Auth */
   PM23801_PrefetchPasswordPrelogin = "pm-23801-prefetch-password-prelogin",
@@ -24,7 +25,6 @@ export enum FeatureFlag {
 
   /* Billing */
   TrialPaymentOptional = "PM-8163-trial-payment",
-  PM21821_ProviderPortalTakeover = "pm-21821-provider-portal-takeover",
   PM22415_TaxIDWarnings = "pm-22415-tax-id-warnings",
   PM24032_NewNavigationPremiumUpgradeButton = "pm-24032-new-navigation-premium-upgrade-button",
   PM25379_UseNewOrganizationMetadataStructure = "pm-25379-use-new-organization-metadata-structure",
@@ -43,6 +43,7 @@ export enum FeatureFlag {
   LinuxBiometricsV2 = "pm-26340-linux-biometrics-v2",
   UnlockWithMasterPasswordUnlockData = "pm-23246-unlock-with-master-password-unlock-data",
   NoLogoutOnKdfChange = "pm-23995-no-logout-on-kdf-change",
+  DataRecoveryTool = "pm-28813-data-recovery-tool",
   ConsolidatedSessionTimeoutComponent = "pm-26056-consolidated-session-timeout-component",
 
   /* Tools */
@@ -63,6 +64,8 @@ export enum FeatureFlag {
   AutofillConfirmation = "pm-25083-autofill-confirm-from-search",
   RiskInsightsForPremium = "pm-23904-risk-insights-for-premium",
   VaultLoadingSkeletons = "pm-25081-vault-skeleton-loaders",
+  BrowserPremiumSpotlight = "pm-23384-browser-premium-spotlight",
+  MigrateMyVaultToMyItems = "pm-20558-migrate-myvault-to-myitems",
 
   /* Platform */
   IpcChannelFramework = "ipc-channel-framework",
@@ -97,6 +100,7 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.CreateDefaultLocation]: FALSE,
   [FeatureFlag.AutoConfirm]: FALSE,
   [FeatureFlag.BlockClaimedDomainAccountCreation]: FALSE,
+  [FeatureFlag.IncreaseBulkReinviteLimitForCloud]: FALSE,
 
   /* Autofill */
   [FeatureFlag.MacOsNativeCredentialSync]: FALSE,
@@ -120,13 +124,14 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.AutofillConfirmation]: FALSE,
   [FeatureFlag.RiskInsightsForPremium]: FALSE,
   [FeatureFlag.VaultLoadingSkeletons]: FALSE,
+  [FeatureFlag.BrowserPremiumSpotlight]: FALSE,
+  [FeatureFlag.MigrateMyVaultToMyItems]: FALSE,
 
   /* Auth */
   [FeatureFlag.PM23801_PrefetchPasswordPrelogin]: FALSE,
 
   /* Billing */
   [FeatureFlag.TrialPaymentOptional]: FALSE,
-  [FeatureFlag.PM21821_ProviderPortalTakeover]: FALSE,
   [FeatureFlag.PM22415_TaxIDWarnings]: FALSE,
   [FeatureFlag.PM24032_NewNavigationPremiumUpgradeButton]: FALSE,
   [FeatureFlag.PM25379_UseNewOrganizationMetadataStructure]: FALSE,
@@ -145,6 +150,7 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.LinuxBiometricsV2]: FALSE,
   [FeatureFlag.UnlockWithMasterPasswordUnlockData]: FALSE,
   [FeatureFlag.NoLogoutOnKdfChange]: FALSE,
+  [FeatureFlag.DataRecoveryTool]: FALSE,
   [FeatureFlag.ConsolidatedSessionTimeoutComponent]: FALSE,
 
   /* Platform */
diff --git a/libs/common/src/key-management/crypto/abstractions/crypto-function.service.ts b/libs/common/src/key-management/crypto/abstractions/crypto-function.service.ts
index 705a1c1a24e..b16371198b3 100644
--- a/libs/common/src/key-management/crypto/abstractions/crypto-function.service.ts
+++ b/libs/common/src/key-management/crypto/abstractions/crypto-function.service.ts
@@ -91,7 +91,7 @@ export abstract class CryptoFunctionService {
   abstract rsaEncrypt(
     data: Uint8Array,
     publicKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    algorithm: "sha1",
   ): Promise<Uint8Array>;
   /**
    * @deprecated HAZMAT WARNING: DO NOT USE THIS FOR NEW CODE. Implement low-level crypto operations
@@ -100,10 +100,10 @@ export abstract class CryptoFunctionService {
   abstract rsaDecrypt(
     data: Uint8Array,
     privateKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    algorithm: "sha1",
   ): Promise<Uint8Array>;
   abstract rsaExtractPublicKey(privateKey: Uint8Array): Promise<Uint8Array>;
-  abstract rsaGenerateKeyPair(length: 1024 | 2048 | 4096): Promise<[Uint8Array, Uint8Array]>;
+  abstract rsaGenerateKeyPair(length: 2048): Promise<[Uint8Array, Uint8Array]>;
   /**
    * Generates a key of the given length suitable for use in AES encryption
    */
diff --git a/libs/common/src/key-management/crypto/key-generation/default-key-generation.service.ts b/libs/common/src/key-management/crypto/key-generation/default-key-generation.service.ts
index 8e8d2de1ce4..5f5da741707 100644
--- a/libs/common/src/key-management/crypto/key-generation/default-key-generation.service.ts
+++ b/libs/common/src/key-management/crypto/key-generation/default-key-generation.service.ts
@@ -91,4 +91,12 @@ export class DefaultKeyGenerationService implements KeyGenerationService {
 
     return new SymmetricCryptoKey(newKey);
   }
+
+  async deriveVaultExportKey(
+    password: string,
+    salt: string,
+    kdfConfig: KdfConfig,
+  ): Promise<SymmetricCryptoKey> {
+    return await this.stretchKey(await this.deriveKeyFromPassword(password, salt, kdfConfig));
+  }
 }
diff --git a/libs/common/src/key-management/crypto/key-generation/key-generation.service.ts b/libs/common/src/key-management/crypto/key-generation/key-generation.service.ts
index d6be436384e..ddc3829aa9f 100644
--- a/libs/common/src/key-management/crypto/key-generation/key-generation.service.ts
+++ b/libs/common/src/key-management/crypto/key-generation/key-generation.service.ts
@@ -87,4 +87,19 @@ export abstract class KeyGenerationService {
    * @returns 64 byte derived key.
    */
   abstract stretchKey(key: SymmetricCryptoKey): Promise<SymmetricCryptoKey>;
+
+  /**
+   * Derives a 64 byte key for encrypting and decrypting vault exports.
+   *
+   * @deprecated Do not use this for new use-cases.
+   * @param password Password to derive the key from.
+   * @param salt Salt for the key derivation function.
+   * @param kdfConfig Configuration for the key derivation function.
+   * @returns 64 byte derived key.
+   */
+  abstract deriveVaultExportKey(
+    password: string,
+    salt: string,
+    kdfConfig: KdfConfig,
+  ): Promise<SymmetricCryptoKey>;
 }
diff --git a/libs/common/src/key-management/crypto/services/encrypt.service.implementation.ts b/libs/common/src/key-management/crypto/services/encrypt.service.implementation.ts
index 132bbc306cb..a5da0c82382 100644
--- a/libs/common/src/key-management/crypto/services/encrypt.service.implementation.ts
+++ b/libs/common/src/key-management/crypto/services/encrypt.service.implementation.ts
@@ -252,15 +252,9 @@ export class EncryptServiceImplementation implements EncryptService {
       throw new Error("[Encrypt service] rsaDecrypt: No data provided for decryption.");
     }
 
-    let algorithm: "sha1" | "sha256";
     switch (data.encryptionType) {
       case EncryptionType.Rsa2048_OaepSha1_B64:
       case EncryptionType.Rsa2048_OaepSha1_HmacSha256_B64:
-        algorithm = "sha1";
-        break;
-      case EncryptionType.Rsa2048_OaepSha256_B64:
-      case EncryptionType.Rsa2048_OaepSha256_HmacSha256_B64:
-        algorithm = "sha256";
         break;
       default:
         throw new Error("Invalid encryption type.");
@@ -270,6 +264,6 @@ export class EncryptServiceImplementation implements EncryptService {
       throw new Error("[Encrypt service] rsaDecrypt: No private key provided for decryption.");
     }
 
-    return this.cryptoFunctionService.rsaDecrypt(data.dataBytes, privateKey, algorithm);
+    return this.cryptoFunctionService.rsaDecrypt(data.dataBytes, privateKey, "sha1");
   }
 }
diff --git a/libs/common/src/key-management/crypto/services/web-crypto-function.service.spec.ts b/libs/common/src/key-management/crypto/services/web-crypto-function.service.spec.ts
index c0b5150a720..c64926e0e5b 100644
--- a/libs/common/src/key-management/crypto/services/web-crypto-function.service.spec.ts
+++ b/libs/common/src/key-management/crypto/services/web-crypto-function.service.spec.ts
@@ -1,12 +1,20 @@
 import { mock } from "jest-mock-extended";
 
 import { PlatformUtilsService } from "../../../platform/abstractions/platform-utils.service";
+import { SdkLoadService } from "../../../platform/abstractions/sdk/sdk-load.service";
 import { Utils } from "../../../platform/misc/utils";
 import { EcbDecryptParameters } from "../../../platform/models/domain/decrypt-parameters";
 import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
 
 import { WebCryptoFunctionService } from "./web-crypto-function.service";
 
+class TestSdkLoadService extends SdkLoadService {
+  protected override load(): Promise<void> {
+    // Simulate successful WASM load
+    return Promise.resolve();
+  }
+}
+
 const RsaPublicKey =
   "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl0Vawl/toXzkEvB82FEtqHP" +
   "4xlU2ab/v0crqIfXfIoWF/XXdHGIdrZeilnRXPPJT1B9dTsasttEZNnua/0Rek/cjNDHtzT52irfoZYS7X6HNIfOi54Q+egP" +
@@ -40,6 +48,10 @@ const Sha512Mac =
   "5ea7817a0b7c5d4d9b00364ccd214669131fc17fe4aca";
 
 describe("WebCrypto Function Service", () => {
+  beforeAll(async () => {
+    await new TestSdkLoadService().loadAndInit();
+  });
+
   describe("pbkdf2", () => {
     const regular256Key = "pj9prw/OHPleXI6bRdmlaD+saJS4awrMiQsQiDjeu2I=";
     const utf8256Key = "yqvoFXgMRmHR3QPYr5pyR4uVuoHkltv9aHUP63p8n7I=";
@@ -287,7 +299,6 @@ describe("WebCrypto Function Service", () => {
   });
 
   describe("rsaGenerateKeyPair", () => {
-    testRsaGenerateKeyPair(1024);
     testRsaGenerateKeyPair(2048);
 
     // Generating 4096 bit keys can be slow. Commenting it out to save CI.
@@ -483,7 +494,7 @@ function testHmac(algorithm: "sha1" | "sha256" | "sha512", mac: string) {
   });
 }
 
-function testRsaGenerateKeyPair(length: 1024 | 2048 | 4096) {
+function testRsaGenerateKeyPair(length: 2048) {
   it(
     "should successfully generate a " + length + " bit key pair",
     async () => {
diff --git a/libs/common/src/key-management/crypto/services/web-crypto-function.service.ts b/libs/common/src/key-management/crypto/services/web-crypto-function.service.ts
index 11c186bc393..ee0b5cab902 100644
--- a/libs/common/src/key-management/crypto/services/web-crypto-function.service.ts
+++ b/libs/common/src/key-management/crypto/services/web-crypto-function.service.ts
@@ -1,5 +1,8 @@
 import * as forge from "node-forge";
 
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { PureCrypto } from "@bitwarden/sdk-internal";
+
 import { EncryptionType } from "../../../platform/enums";
 import { Utils } from "../../../platform/misc/utils";
 import {
@@ -260,57 +263,31 @@ export class WebCryptoFunctionService implements CryptoFunctionService {
   async rsaEncrypt(
     data: Uint8Array,
     publicKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    _algorithm: "sha1",
   ): Promise<Uint8Array> {
-    // Note: Edge browser requires that we specify name and hash for both key import and decrypt.
-    // We cannot use the proper types here.
-    const rsaParams = {
-      name: "RSA-OAEP",
-      hash: { name: this.toWebCryptoAlgorithm(algorithm) },
-    };
-    const impKey = await this.subtle.importKey("spki", publicKey, rsaParams, false, ["encrypt"]);
-    const buffer = await this.subtle.encrypt(rsaParams, impKey, data);
-    return new Uint8Array(buffer);
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_encrypt_data(data, publicKey);
   }
 
   async rsaDecrypt(
     data: Uint8Array,
     privateKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    _algorithm: "sha1",
   ): Promise<Uint8Array> {
-    // Note: Edge browser requires that we specify name and hash for both key import and decrypt.
-    // We cannot use the proper types here.
-    const rsaParams = {
-      name: "RSA-OAEP",
-      hash: { name: this.toWebCryptoAlgorithm(algorithm) },
-    };
-    const impKey = await this.subtle.importKey("pkcs8", privateKey, rsaParams, false, ["decrypt"]);
-    const buffer = await this.subtle.decrypt(rsaParams, impKey, data);
-    return new Uint8Array(buffer);
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_decrypt_data(data, privateKey);
   }
 
-  async rsaExtractPublicKey(privateKey: Uint8Array): Promise<Uint8Array> {
-    const rsaParams = {
-      name: "RSA-OAEP",
-      // Have to specify some algorithm
-      hash: { name: this.toWebCryptoAlgorithm("sha1") },
-    };
-    const impPrivateKey = await this.subtle.importKey("pkcs8", privateKey, rsaParams, true, [
-      "decrypt",
-    ]);
-    const jwkPrivateKey = await this.subtle.exportKey("jwk", impPrivateKey);
-    const jwkPublicKeyParams = {
-      kty: "RSA",
-      e: jwkPrivateKey.e,
-      n: jwkPrivateKey.n,
-      alg: "RSA-OAEP",
-      ext: true,
-    };
-    const impPublicKey = await this.subtle.importKey("jwk", jwkPublicKeyParams, rsaParams, true, [
-      "encrypt",
-    ]);
-    const buffer = await this.subtle.exportKey("spki", impPublicKey);
-    return new Uint8Array(buffer) as UnsignedPublicKey;
+  async rsaExtractPublicKey(privateKey: Uint8Array): Promise<UnsignedPublicKey> {
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_extract_public_key(privateKey) as UnsignedPublicKey;
+  }
+
+  async rsaGenerateKeyPair(_length: 2048): Promise<[UnsignedPublicKey, Uint8Array]> {
+    await SdkLoadService.Ready;
+    const privateKey = PureCrypto.rsa_generate_keypair();
+    const publicKey = await this.rsaExtractPublicKey(privateKey);
+    return [publicKey, privateKey];
   }
 
   async aesGenerateKey(bitLength = 128 | 192 | 256 | 512): Promise<CsprngArray> {
@@ -330,20 +307,6 @@ export class WebCryptoFunctionService implements CryptoFunctionService {
     return new Uint8Array(rawKey) as CsprngArray;
   }
 
-  async rsaGenerateKeyPair(length: 1024 | 2048 | 4096): Promise<[Uint8Array, Uint8Array]> {
-    const rsaParams = {
-      name: "RSA-OAEP",
-      modulusLength: length,
-      publicExponent: new Uint8Array([0x01, 0x00, 0x01]), // 65537
-      // Have to specify some algorithm
-      hash: { name: this.toWebCryptoAlgorithm("sha1") },
-    };
-    const keyPair = await this.subtle.generateKey(rsaParams, true, ["encrypt", "decrypt"]);
-    const publicKey = await this.subtle.exportKey("spki", keyPair.publicKey);
-    const privateKey = await this.subtle.exportKey("pkcs8", keyPair.privateKey);
-    return [new Uint8Array(publicKey), new Uint8Array(privateKey)];
-  }
-
   randomBytes(length: number): Promise<CsprngArray> {
     const arr = new Uint8Array(length);
     this.crypto.getRandomValues(arr);
diff --git a/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.spec.ts b/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.spec.ts
new file mode 100644
index 00000000000..5a681ec2913
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.spec.ts
@@ -0,0 +1,194 @@
+import { mock } from "jest-mock-extended";
+
+// eslint-disable-next-line no-restricted-imports
+import { KdfConfigService } from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { ConfigService } from "../../platform/abstractions/config/config.service";
+import { SyncService } from "../../platform/sync";
+import { UserId } from "../../types/guid";
+import { ChangeKdfService } from "../kdf/change-kdf.service.abstraction";
+import { MasterPasswordServiceAbstraction } from "../master-password/abstractions/master-password.service.abstraction";
+
+import { DefaultEncryptedMigrator } from "./default-encrypted-migrator";
+import { EncryptedMigration } from "./migrations/encrypted-migration";
+import { MinimumKdfMigration } from "./migrations/minimum-kdf-migration";
+
+jest.mock("./migrations/minimum-kdf-migration");
+
+describe("EncryptedMigrator", () => {
+  const mockKdfConfigService = mock<KdfConfigService>();
+  const mockChangeKdfService = mock<ChangeKdfService>();
+  const mockLogService = mock<LogService>();
+  const configService = mock<ConfigService>();
+  const masterPasswordService = mock<MasterPasswordServiceAbstraction>();
+  const syncService = mock<SyncService>();
+
+  let sut: DefaultEncryptedMigrator;
+  const mockMigration = mock<MinimumKdfMigration>();
+
+  const mockUserId = "00000000-0000-0000-0000-000000000000" as UserId;
+  const mockMasterPassword = "masterPassword123";
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    // Mock the MinimumKdfMigration constructor to return our mock
+    (MinimumKdfMigration as jest.MockedClass<typeof MinimumKdfMigration>).mockImplementation(
+      () => mockMigration,
+    );
+
+    sut = new DefaultEncryptedMigrator(
+      mockKdfConfigService,
+      mockChangeKdfService,
+      mockLogService,
+      configService,
+      masterPasswordService,
+      syncService,
+    );
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
+  describe("runMigrations", () => {
+    it("should throw error when userId is null", async () => {
+      await expect(sut.runMigrations(null as any, null)).rejects.toThrow("userId");
+    });
+
+    it("should throw error when userId is undefined", async () => {
+      await expect(sut.runMigrations(undefined as any, null)).rejects.toThrow("userId");
+    });
+
+    it("should not run migration when needsMigration returns 'noMigrationNeeded'", async () => {
+      mockMigration.needsMigration.mockResolvedValue("noMigrationNeeded");
+
+      await sut.runMigrations(mockUserId, null);
+
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockMigration.runMigrations).not.toHaveBeenCalled();
+    });
+
+    it("should run migration when needsMigration returns 'needsMigration'", async () => {
+      mockMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      await sut.runMigrations(mockUserId, mockMasterPassword);
+
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockMigration.runMigrations).toHaveBeenCalledWith(mockUserId, mockMasterPassword);
+    });
+
+    it("should run migration when needsMigration returns 'needsMigrationWithMasterPassword'", async () => {
+      mockMigration.needsMigration.mockResolvedValue("needsMigrationWithMasterPassword");
+
+      await sut.runMigrations(mockUserId, mockMasterPassword);
+
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockMigration.runMigrations).toHaveBeenCalledWith(mockUserId, mockMasterPassword);
+    });
+
+    it("should throw error when migration needs master password but null is provided", async () => {
+      mockMigration.needsMigration.mockResolvedValue("needsMigrationWithMasterPassword");
+
+      await sut.runMigrations(mockUserId, null);
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockMigration.runMigrations).not.toHaveBeenCalled();
+    });
+
+    it("should run multiple migrations", async () => {
+      const mockSecondMigration = mock<EncryptedMigration>();
+      mockSecondMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      (sut as any).migrations.push({
+        name: "Test Second Migration",
+        migration: mockSecondMigration,
+      });
+
+      mockMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      await sut.runMigrations(mockUserId, mockMasterPassword);
+
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockSecondMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockMigration.runMigrations).toHaveBeenCalledWith(mockUserId, mockMasterPassword);
+      expect(mockSecondMigration.runMigrations).toHaveBeenCalledWith(
+        mockUserId,
+        mockMasterPassword,
+      );
+    });
+  });
+
+  describe("needsMigrations", () => {
+    it("should return 'noMigrationNeeded' when no migrations are needed", async () => {
+      mockMigration.needsMigration.mockResolvedValue("noMigrationNeeded");
+
+      const result = await sut.needsMigrations(mockUserId);
+
+      expect(result).toBe("noMigrationNeeded");
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should return 'needsMigration' when at least one migration needs to run", async () => {
+      mockMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      const result = await sut.needsMigrations(mockUserId);
+
+      expect(result).toBe("needsMigration");
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should return 'needsMigrationWithMasterPassword' when at least one migration needs master password", async () => {
+      mockMigration.needsMigration.mockResolvedValue("needsMigrationWithMasterPassword");
+
+      const result = await sut.needsMigrations(mockUserId);
+
+      expect(result).toBe("needsMigrationWithMasterPassword");
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should prioritize 'needsMigrationWithMasterPassword' over 'needsMigration'", async () => {
+      const mockSecondMigration = mock<EncryptedMigration>();
+      mockSecondMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      (sut as any).migrations.push({
+        name: "Test Second Migration",
+        migration: mockSecondMigration,
+      });
+
+      mockMigration.needsMigration.mockResolvedValue("needsMigrationWithMasterPassword");
+
+      const result = await sut.needsMigrations(mockUserId);
+
+      expect(result).toBe("needsMigrationWithMasterPassword");
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockSecondMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should return 'needsMigration' when some migrations need running but none need master password", async () => {
+      const mockSecondMigration = mock<EncryptedMigration>();
+      mockSecondMigration.needsMigration.mockResolvedValue("noMigrationNeeded");
+
+      (sut as any).migrations.push({
+        name: "Test Second Migration",
+        migration: mockSecondMigration,
+      });
+
+      mockMigration.needsMigration.mockResolvedValue("needsMigration");
+
+      const result = await sut.needsMigrations(mockUserId);
+
+      expect(result).toBe("needsMigration");
+      expect(mockMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+      expect(mockSecondMigration.needsMigration).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should throw error when userId is null", async () => {
+      await expect(sut.needsMigrations(null as any)).rejects.toThrow("userId");
+    });
+
+    it("should throw error when userId is undefined", async () => {
+      await expect(sut.needsMigrations(undefined as any)).rejects.toThrow("userId");
+    });
+  });
+});
diff --git a/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.ts b/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.ts
new file mode 100644
index 00000000000..bc91e24070a
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/default-encrypted-migrator.ts
@@ -0,0 +1,113 @@
+// eslint-disable-next-line no-restricted-imports
+import { KdfConfigService } from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { assertNonNullish } from "../../auth/utils";
+import { ConfigService } from "../../platform/abstractions/config/config.service";
+import { SyncService } from "../../platform/sync";
+import { UserId } from "../../types/guid";
+import { ChangeKdfService } from "../kdf/change-kdf.service.abstraction";
+import { MasterPasswordServiceAbstraction } from "../master-password/abstractions/master-password.service.abstraction";
+
+import { EncryptedMigrator } from "./encrypted-migrator.abstraction";
+import { EncryptedMigration, MigrationRequirement } from "./migrations/encrypted-migration";
+import { MinimumKdfMigration } from "./migrations/minimum-kdf-migration";
+
+export class DefaultEncryptedMigrator implements EncryptedMigrator {
+  private migrations: { name: string; migration: EncryptedMigration }[] = [];
+  private isRunningMigration = false;
+
+  constructor(
+    readonly kdfConfigService: KdfConfigService,
+    readonly changeKdfService: ChangeKdfService,
+    private readonly logService: LogService,
+    readonly configService: ConfigService,
+    readonly masterPasswordService: MasterPasswordServiceAbstraction,
+    readonly syncService: SyncService,
+  ) {
+    // Register migrations here
+    this.migrations.push({
+      name: "Minimum PBKDF2 Iteration Count Migration",
+      migration: new MinimumKdfMigration(
+        kdfConfigService,
+        changeKdfService,
+        logService,
+        configService,
+        masterPasswordService,
+      ),
+    });
+  }
+
+  async runMigrations(userId: UserId, masterPassword: string | null): Promise<void> {
+    assertNonNullish(userId, "userId");
+
+    // Ensure that the requirements for running all migrations are met
+    const needsMigration = await this.needsMigrations(userId);
+    if (needsMigration === "noMigrationNeeded") {
+      return;
+    } else if (needsMigration === "needsMigrationWithMasterPassword" && masterPassword == null) {
+      // If a migration needs a password, but none is provided, the migrations are skipped. If a manual caller
+      // during a login / unlock flow calls without a master password in a login / unlock strategy that has no
+      // password, such as biometric unlock, the migrations are skipped.
+      //
+      // The fallback to this, the encrypted migrations scheduler, will first check if a migration needs a password
+      // and then prompt the user. If the user enters their password, runMigrations is called again with the password.
+      return;
+    }
+
+    try {
+      // No concurrent migrations allowed, so acquire a service-wide lock
+      if (this.isRunningMigration) {
+        return;
+      }
+      this.isRunningMigration = true;
+
+      // Run all migrations sequentially in the order they were registered
+      this.logService.mark("[Encrypted Migrator] Start");
+      this.logService.info(`[Encrypted Migrator] Starting migrations for user: ${userId}`);
+      let ranMigration = false;
+      for (const { name, migration } of this.migrations) {
+        if ((await migration.needsMigration(userId)) !== "noMigrationNeeded") {
+          this.logService.info(`[Encrypted Migrator] Running migration: ${name}`);
+          const start = performance.now();
+          await migration.runMigrations(userId, masterPassword);
+          this.logService.measure(start, "[Encrypted Migrator]", name, "ExecutionTime");
+          ranMigration = true;
+        }
+      }
+      this.logService.mark("[Encrypted Migrator] Finish");
+      this.logService.info(`[Encrypted Migrator] Completed migrations for user: ${userId}`);
+      if (ranMigration) {
+        await this.syncService.fullSync(true);
+      }
+    } catch (error) {
+      this.logService.error(
+        `[Encrypted Migrator] Error running migrations for user: ${userId}`,
+        error,
+      );
+      throw error; // Re-throw the error to be handled by the caller
+    } finally {
+      this.isRunningMigration = false;
+    }
+  }
+
+  async needsMigrations(userId: UserId): Promise<MigrationRequirement> {
+    assertNonNullish(userId, "userId");
+
+    const migrationRequirements = await Promise.all(
+      this.migrations.map(async ({ migration }) => migration.needsMigration(userId)),
+    );
+
+    if (migrationRequirements.includes("needsMigrationWithMasterPassword")) {
+      return "needsMigrationWithMasterPassword";
+    } else if (migrationRequirements.includes("needsMigration")) {
+      return "needsMigration";
+    } else {
+      return "noMigrationNeeded";
+    }
+  }
+
+  isRunningMigrations(): boolean {
+    return this.isRunningMigration;
+  }
+}
diff --git a/libs/common/src/key-management/encrypted-migrator/encrypted-migrator.abstraction.ts b/libs/common/src/key-management/encrypted-migrator/encrypted-migrator.abstraction.ts
new file mode 100644
index 00000000000..7e408374f7e
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/encrypted-migrator.abstraction.ts
@@ -0,0 +1,32 @@
+import { UserId } from "../../types/guid";
+
+import { MigrationRequirement } from "./migrations/encrypted-migration";
+
+export abstract class EncryptedMigrator {
+  /**
+   * Runs migrations on a decrypted user, with the cryptographic state initialized.
+   * This only runs the migrations that are needed for the user.
+   * This needs to be run after the decrypted user key has been set to state.
+   *
+   * If the master password is required but not provided, the migrations will not run, and the function will return early.
+   * If migrations are already running, the migrations will not run again, and the function will return early.
+   *
+   * @param userId The ID of the user to run migrations for.
+   * @param masterPassword The user's current master password.
+   * @throws If the user does not exist
+   * @throws If the user is locked or logged out
+   * @throws If a migration fails
+   */
+  abstract runMigrations(userId: UserId, masterPassword: string | null): Promise<void>;
+  /**
+   * Checks if the user needs to run any migrations.
+   * This is used to determine if the user should be prompted to run migrations.
+   * @param userId The ID of the user to check migrations for.
+   */
+  abstract needsMigrations(userId: UserId): Promise<MigrationRequirement>;
+
+  /**
+   * Indicates whether migrations are currently running.
+   */
+  abstract isRunningMigrations(): boolean;
+}
diff --git a/libs/common/src/key-management/encrypted-migrator/migrations/encrypted-migration.ts b/libs/common/src/key-management/encrypted-migrator/migrations/encrypted-migration.ts
new file mode 100644
index 00000000000..e6b1dcc45f6
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/migrations/encrypted-migration.ts
@@ -0,0 +1,36 @@
+import { UserId } from "../../../types/guid";
+
+/**
+ * @internal
+ * IMPORTANT: Please read this when implementing new migrations.
+ *
+ * An encrypted migration defines an online migration that mutates the persistent state of the user on the server, or locally.
+ * It should only be run once per user (or for local migrations, once per device). Migrations get scheduled automatically,
+ * during actions such as login and unlock, or during sync.
+ *
+ * Migrations can require the master-password, which is provided by the user if required.
+ * Migrations are run as soon as possible non-lazily, and MAY block unlock / login, if they have to run.
+ *
+ * Most importantly, implementing a migration should be done such that concurrent migrations may fail, but must never
+ * leave the user in a broken state. Locally, these are scheduled with an application-global lock. However, no such guarantees
+ * are made for the server, and other devices may run the migration concurrently.
+ *
+ * When adding a migration, it *MUST* be feature-flagged for the initial roll-out.
+ */
+export interface EncryptedMigration {
+  /**
+   * Runs the migration.
+   * @throws If the migration fails, such as when no network is available.
+   * @throws If the requirements for migration are not met (e.g. the user is locked)
+   */
+  runMigrations(userId: UserId, masterPassword: string | null): Promise<void>;
+  /**
+   * Returns whether the migration needs to be run for the user, and if it does, whether the master password is required.
+   */
+  needsMigration(userId: UserId): Promise<MigrationRequirement>;
+}
+
+export type MigrationRequirement =
+  | "needsMigration"
+  | "needsMigrationWithMasterPassword"
+  | "noMigrationNeeded";
diff --git a/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.spec.ts b/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.spec.ts
new file mode 100644
index 00000000000..cf2bd307b6c
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.spec.ts
@@ -0,0 +1,184 @@
+import { mock } from "jest-mock-extended";
+
+// eslint-disable-next-line no-restricted-imports
+import {
+  Argon2KdfConfig,
+  KdfConfigService,
+  KdfType,
+  PBKDF2KdfConfig,
+} from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { FeatureFlag } from "../../../enums/feature-flag.enum";
+import { ConfigService } from "../../../platform/abstractions/config/config.service";
+import { UserId } from "../../../types/guid";
+import { ChangeKdfService } from "../../kdf/change-kdf.service.abstraction";
+import { MasterPasswordServiceAbstraction } from "../../master-password/abstractions/master-password.service.abstraction";
+
+import { MinimumKdfMigration } from "./minimum-kdf-migration";
+
+describe("MinimumKdfMigration", () => {
+  const mockKdfConfigService = mock<KdfConfigService>();
+  const mockChangeKdfService = mock<ChangeKdfService>();
+  const mockLogService = mock<LogService>();
+  const mockConfigService = mock<ConfigService>();
+  const mockMasterPasswordService = mock<MasterPasswordServiceAbstraction>();
+
+  let sut: MinimumKdfMigration;
+
+  const mockUserId = "00000000-0000-0000-0000-000000000000" as UserId;
+  const mockMasterPassword = "masterPassword";
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    sut = new MinimumKdfMigration(
+      mockKdfConfigService,
+      mockChangeKdfService,
+      mockLogService,
+      mockConfigService,
+      mockMasterPasswordService,
+    );
+  });
+
+  describe("needsMigration", () => {
+    it("should return 'noMigrationNeeded' when user does not have a master password`", async () => {
+      mockMasterPasswordService.userHasMasterPassword.mockResolvedValue(false);
+      const result = await sut.needsMigration(mockUserId);
+      expect(result).toBe("noMigrationNeeded");
+    });
+
+    it("should return 'noMigrationNeeded' when user uses argon2id`", async () => {
+      mockMasterPasswordService.userHasMasterPassword.mockResolvedValue(true);
+      mockKdfConfigService.getKdfConfig.mockResolvedValue(new Argon2KdfConfig(3, 64, 4));
+      const result = await sut.needsMigration(mockUserId);
+      expect(result).toBe("noMigrationNeeded");
+    });
+
+    it("should return 'noMigrationNeeded' when PBKDF2 iterations are already above minimum", async () => {
+      const mockKdfConfig = {
+        kdfType: KdfType.PBKDF2_SHA256,
+        iterations: PBKDF2KdfConfig.ITERATIONS.min + 1000,
+      };
+      mockKdfConfigService.getKdfConfig.mockResolvedValue(mockKdfConfig as any);
+
+      const result = await sut.needsMigration(mockUserId);
+
+      expect(result).toBe("noMigrationNeeded");
+      expect(mockKdfConfigService.getKdfConfig).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should return 'noMigrationNeeded' when PBKDF2 iterations equal minimum", async () => {
+      const mockKdfConfig = {
+        kdfType: KdfType.PBKDF2_SHA256,
+        iterations: PBKDF2KdfConfig.ITERATIONS.min,
+      };
+      mockKdfConfigService.getKdfConfig.mockResolvedValue(mockKdfConfig as any);
+      mockConfigService.getFeatureFlag.mockResolvedValue(true);
+
+      const result = await sut.needsMigration(mockUserId);
+
+      expect(result).toBe("noMigrationNeeded");
+      expect(mockKdfConfigService.getKdfConfig).toHaveBeenCalledWith(mockUserId);
+    });
+
+    it("should return 'noMigrationNeeded' when feature flag is disabled", async () => {
+      const mockKdfConfig = {
+        kdfType: KdfType.PBKDF2_SHA256,
+        iterations: PBKDF2KdfConfig.ITERATIONS.min - 1000,
+      };
+      mockKdfConfigService.getKdfConfig.mockResolvedValue(mockKdfConfig as any);
+      mockConfigService.getFeatureFlag.mockResolvedValue(false);
+
+      const result = await sut.needsMigration(mockUserId);
+
+      expect(result).toBe("noMigrationNeeded");
+      expect(mockKdfConfigService.getKdfConfig).toHaveBeenCalledWith(mockUserId);
+      expect(mockConfigService.getFeatureFlag).toHaveBeenCalledWith(
+        FeatureFlag.ForceUpdateKDFSettings,
+      );
+    });
+
+    it("should return 'needsMigrationWithMasterPassword' when PBKDF2 iterations are below minimum and feature flag is enabled", async () => {
+      const mockKdfConfig = {
+        kdfType: KdfType.PBKDF2_SHA256,
+        iterations: PBKDF2KdfConfig.ITERATIONS.min - 1000,
+      };
+      mockKdfConfigService.getKdfConfig.mockResolvedValue(mockKdfConfig as any);
+      mockConfigService.getFeatureFlag.mockResolvedValue(true);
+
+      const result = await sut.needsMigration(mockUserId);
+
+      expect(result).toBe("needsMigrationWithMasterPassword");
+      expect(mockKdfConfigService.getKdfConfig).toHaveBeenCalledWith(mockUserId);
+      expect(mockConfigService.getFeatureFlag).toHaveBeenCalledWith(
+        FeatureFlag.ForceUpdateKDFSettings,
+      );
+    });
+
+    it("should throw error when userId is null", async () => {
+      await expect(sut.needsMigration(null as any)).rejects.toThrow("userId");
+    });
+
+    it("should throw error when userId is undefined", async () => {
+      await expect(sut.needsMigration(undefined as any)).rejects.toThrow("userId");
+    });
+  });
+
+  describe("runMigrations", () => {
+    it("should update KDF parameters with minimum PBKDF2 iterations", async () => {
+      await sut.runMigrations(mockUserId, mockMasterPassword);
+
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        `[MinimumKdfMigration] Updating user ${mockUserId} to minimum PBKDF2 iteration count ${PBKDF2KdfConfig.ITERATIONS.min}`,
+      );
+      expect(mockChangeKdfService.updateUserKdfParams).toHaveBeenCalledWith(
+        mockMasterPassword,
+        expect.any(PBKDF2KdfConfig),
+        mockUserId,
+      );
+
+      // Verify the PBKDF2KdfConfig has the correct iteration count
+      const kdfConfigArg = (mockChangeKdfService.updateUserKdfParams as jest.Mock).mock.calls[0][1];
+      expect(kdfConfigArg.iterations).toBe(PBKDF2KdfConfig.ITERATIONS.defaultValue);
+    });
+
+    it("should throw error when userId is null", async () => {
+      await expect(sut.runMigrations(null as any, mockMasterPassword)).rejects.toThrow("userId");
+    });
+
+    it("should throw error when userId is undefined", async () => {
+      await expect(sut.runMigrations(undefined as any, mockMasterPassword)).rejects.toThrow(
+        "userId",
+      );
+    });
+
+    it("should throw error when masterPassword is null", async () => {
+      await expect(sut.runMigrations(mockUserId, null as any)).rejects.toThrow("masterPassword");
+    });
+
+    it("should throw error when masterPassword is undefined", async () => {
+      await expect(sut.runMigrations(mockUserId, undefined as any)).rejects.toThrow(
+        "masterPassword",
+      );
+    });
+
+    it("should handle errors from changeKdfService", async () => {
+      const mockError = new Error("KDF update failed");
+      mockChangeKdfService.updateUserKdfParams.mockRejectedValue(mockError);
+
+      await expect(sut.runMigrations(mockUserId, mockMasterPassword)).rejects.toThrow(
+        "KDF update failed",
+      );
+
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        `[MinimumKdfMigration] Updating user ${mockUserId} to minimum PBKDF2 iteration count ${PBKDF2KdfConfig.ITERATIONS.min}`,
+      );
+      expect(mockChangeKdfService.updateUserKdfParams).toHaveBeenCalledWith(
+        mockMasterPassword,
+        expect.any(PBKDF2KdfConfig),
+        mockUserId,
+      );
+    });
+  });
+});
diff --git a/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.ts b/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.ts
new file mode 100644
index 00000000000..0666064b36e
--- /dev/null
+++ b/libs/common/src/key-management/encrypted-migrator/migrations/minimum-kdf-migration.ts
@@ -0,0 +1,68 @@
+import { UserId } from "@bitwarden/common/types/guid";
+// eslint-disable-next-line no-restricted-imports
+import { KdfConfigService, KdfType, PBKDF2KdfConfig } from "@bitwarden/key-management";
+import { LogService } from "@bitwarden/logging";
+
+import { assertNonNullish } from "../../../auth/utils";
+import { FeatureFlag } from "../../../enums/feature-flag.enum";
+import { ConfigService } from "../../../platform/abstractions/config/config.service";
+import { ChangeKdfService } from "../../kdf/change-kdf.service.abstraction";
+import { MasterPasswordServiceAbstraction } from "../../master-password/abstractions/master-password.service.abstraction";
+
+import { EncryptedMigration, MigrationRequirement } from "./encrypted-migration";
+
+/**
+ * @internal
+ * This migrator ensures the user's account has a minimum PBKDF2 iteration count.
+ * It will update the entire account, logging out old clients if necessary.
+ */
+export class MinimumKdfMigration implements EncryptedMigration {
+  constructor(
+    private readonly kdfConfigService: KdfConfigService,
+    private readonly changeKdfService: ChangeKdfService,
+    private readonly logService: LogService,
+    private readonly configService: ConfigService,
+    private readonly masterPasswordService: MasterPasswordServiceAbstraction,
+  ) {}
+
+  async runMigrations(userId: UserId, masterPassword: string | null): Promise<void> {
+    assertNonNullish(userId, "userId");
+    assertNonNullish(masterPassword, "masterPassword");
+
+    this.logService.info(
+      `[MinimumKdfMigration] Updating user ${userId} to minimum PBKDF2 iteration count ${PBKDF2KdfConfig.ITERATIONS.defaultValue}`,
+    );
+    await this.changeKdfService.updateUserKdfParams(
+      masterPassword!,
+      new PBKDF2KdfConfig(PBKDF2KdfConfig.ITERATIONS.defaultValue),
+      userId,
+    );
+    await this.kdfConfigService.setKdfConfig(
+      userId,
+      new PBKDF2KdfConfig(PBKDF2KdfConfig.ITERATIONS.defaultValue),
+    );
+  }
+
+  async needsMigration(userId: UserId): Promise<MigrationRequirement> {
+    assertNonNullish(userId, "userId");
+
+    if (!(await this.masterPasswordService.userHasMasterPassword(userId))) {
+      return "noMigrationNeeded";
+    }
+
+    // Only PBKDF2 users below the minimum iteration count need migration
+    const kdfConfig = await this.kdfConfigService.getKdfConfig(userId);
+    if (
+      kdfConfig.kdfType !== KdfType.PBKDF2_SHA256 ||
+      kdfConfig.iterations >= PBKDF2KdfConfig.ITERATIONS.min
+    ) {
+      return "noMigrationNeeded";
+    }
+
+    if (!(await this.configService.getFeatureFlag(FeatureFlag.ForceUpdateKDFSettings))) {
+      return "noMigrationNeeded";
+    }
+
+    return "needsMigrationWithMasterPassword";
+  }
+}
diff --git a/libs/common/src/key-management/kdf/change-kdf-service.abstraction.ts b/libs/common/src/key-management/kdf/change-kdf.service.abstraction.ts
similarity index 100%
rename from libs/common/src/key-management/kdf/change-kdf-service.abstraction.ts
rename to libs/common/src/key-management/kdf/change-kdf.service.abstraction.ts
diff --git a/libs/common/src/key-management/kdf/change-kdf-service.spec.ts b/libs/common/src/key-management/kdf/change-kdf.service.spec.ts
similarity index 99%
rename from libs/common/src/key-management/kdf/change-kdf-service.spec.ts
rename to libs/common/src/key-management/kdf/change-kdf.service.spec.ts
index c7df90f4790..12096155641 100644
--- a/libs/common/src/key-management/kdf/change-kdf-service.spec.ts
+++ b/libs/common/src/key-management/kdf/change-kdf.service.spec.ts
@@ -17,7 +17,7 @@ import {
 } from "../master-password/types/master-password.types";
 
 import { ChangeKdfApiService } from "./change-kdf-api.service.abstraction";
-import { DefaultChangeKdfService } from "./change-kdf-service";
+import { DefaultChangeKdfService } from "./change-kdf.service";
 
 describe("ChangeKdfService", () => {
   const changeKdfApiService = mock<ChangeKdfApiService>();
diff --git a/libs/common/src/key-management/kdf/change-kdf-service.ts b/libs/common/src/key-management/kdf/change-kdf.service.ts
similarity index 97%
rename from libs/common/src/key-management/kdf/change-kdf-service.ts
rename to libs/common/src/key-management/kdf/change-kdf.service.ts
index 64fbd1fce05..89d97e6704f 100644
--- a/libs/common/src/key-management/kdf/change-kdf-service.ts
+++ b/libs/common/src/key-management/kdf/change-kdf.service.ts
@@ -14,7 +14,7 @@ import {
 } from "../master-password/types/master-password.types";
 
 import { ChangeKdfApiService } from "./change-kdf-api.service.abstraction";
-import { ChangeKdfService } from "./change-kdf-service.abstraction";
+import { ChangeKdfService } from "./change-kdf.service.abstraction";
 
 export class DefaultChangeKdfService implements ChangeKdfService {
   constructor(
diff --git a/libs/common/src/key-management/key-connector/abstractions/key-connector-api.service.ts b/libs/common/src/key-management/key-connector/abstractions/key-connector-api.service.ts
new file mode 100644
index 00000000000..10d55bfc3fb
--- /dev/null
+++ b/libs/common/src/key-management/key-connector/abstractions/key-connector-api.service.ts
@@ -0,0 +1,7 @@
+import { KeyConnectorConfirmationDetailsResponse } from "../models/response/key-connector-confirmation-details.response";
+
+export abstract class KeyConnectorApiService {
+  abstract getConfirmationDetails(
+    orgSsoIdentifier: string,
+  ): Promise<KeyConnectorConfirmationDetailsResponse>;
+}
diff --git a/libs/common/src/key-management/key-connector/models/key-connector-domain-confirmation.ts b/libs/common/src/key-management/key-connector/models/key-connector-domain-confirmation.ts
index 277057485c1..aa3596c1c99 100644
--- a/libs/common/src/key-management/key-connector/models/key-connector-domain-confirmation.ts
+++ b/libs/common/src/key-management/key-connector/models/key-connector-domain-confirmation.ts
@@ -1,3 +1,4 @@
 export interface KeyConnectorDomainConfirmation {
   keyConnectorUrl: string;
+  organizationSsoIdentifier: string;
 }
diff --git a/libs/common/src/key-management/key-connector/models/response/key-connector-confirmation-details.response.ts b/libs/common/src/key-management/key-connector/models/response/key-connector-confirmation-details.response.ts
new file mode 100644
index 00000000000..bd6ce14194d
--- /dev/null
+++ b/libs/common/src/key-management/key-connector/models/response/key-connector-confirmation-details.response.ts
@@ -0,0 +1,10 @@
+import { BaseResponse } from "../../../../models/response/base.response";
+
+export class KeyConnectorConfirmationDetailsResponse extends BaseResponse {
+  organizationName: string;
+
+  constructor(response: any) {
+    super(response);
+    this.organizationName = this.getResponseProperty("OrganizationName");
+  }
+}
diff --git a/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.spec.ts b/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.spec.ts
new file mode 100644
index 00000000000..553ce7a3ba0
--- /dev/null
+++ b/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.spec.ts
@@ -0,0 +1,54 @@
+import { mock, MockProxy } from "jest-mock-extended";
+
+import { ApiService } from "../../../abstractions/api.service";
+import { KeyConnectorConfirmationDetailsResponse } from "../models/response/key-connector-confirmation-details.response";
+
+import { DefaultKeyConnectorApiService } from "./default-key-connector-api.service";
+
+describe("DefaultKeyConnectorApiService", () => {
+  let apiService: MockProxy<ApiService>;
+  let sut: DefaultKeyConnectorApiService;
+
+  beforeEach(() => {
+    apiService = mock<ApiService>();
+    sut = new DefaultKeyConnectorApiService(apiService);
+  });
+
+  describe("getConfirmationDetails", () => {
+    it("encodes orgSsoIdentifier in URL", async () => {
+      const orgSsoIdentifier = "test org/with special@chars";
+      const expectedEncodedIdentifier = encodeURIComponent(orgSsoIdentifier);
+      const mockResponse = {};
+      apiService.send.mockResolvedValue(mockResponse);
+
+      await sut.getConfirmationDetails(orgSsoIdentifier);
+
+      expect(apiService.send).toHaveBeenCalledWith(
+        "GET",
+        `/accounts/key-connector/confirmation-details/${expectedEncodedIdentifier}`,
+        null,
+        true,
+        true,
+      );
+    });
+
+    it("returns expected response", async () => {
+      const orgSsoIdentifier = "test-org";
+      const expectedOrgName = "example";
+      const mockResponse = { OrganizationName: expectedOrgName };
+      apiService.send.mockResolvedValue(mockResponse);
+
+      const result = await sut.getConfirmationDetails(orgSsoIdentifier);
+
+      expect(result).toBeInstanceOf(KeyConnectorConfirmationDetailsResponse);
+      expect(result.organizationName).toBe(expectedOrgName);
+      expect(apiService.send).toHaveBeenCalledWith(
+        "GET",
+        "/accounts/key-connector/confirmation-details/test-org",
+        null,
+        true,
+        true,
+      );
+    });
+  });
+});
diff --git a/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.ts b/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.ts
new file mode 100644
index 00000000000..8bf0cdfed16
--- /dev/null
+++ b/libs/common/src/key-management/key-connector/services/default-key-connector-api.service.ts
@@ -0,0 +1,20 @@
+import { ApiService } from "../../../abstractions/api.service";
+import { KeyConnectorApiService } from "../abstractions/key-connector-api.service";
+import { KeyConnectorConfirmationDetailsResponse } from "../models/response/key-connector-confirmation-details.response";
+
+export class DefaultKeyConnectorApiService implements KeyConnectorApiService {
+  constructor(private apiService: ApiService) {}
+
+  async getConfirmationDetails(
+    orgSsoIdentifier: string,
+  ): Promise<KeyConnectorConfirmationDetailsResponse> {
+    const r = await this.apiService.send(
+      "GET",
+      "/accounts/key-connector/confirmation-details/" + encodeURIComponent(orgSsoIdentifier),
+      null,
+      true,
+      true,
+    );
+    return new KeyConnectorConfirmationDetailsResponse(r);
+  }
+}
diff --git a/libs/common/src/key-management/key-connector/services/key-connector.service.spec.ts b/libs/common/src/key-management/key-connector/services/key-connector.service.spec.ts
index bb458ff49f4..45b4f5e4ac6 100644
--- a/libs/common/src/key-management/key-connector/services/key-connector.service.spec.ts
+++ b/libs/common/src/key-management/key-connector/services/key-connector.service.spec.ts
@@ -603,7 +603,10 @@ describe("KeyConnectorService", () => {
       const data$ = keyConnectorService.requiresDomainConfirmation$(mockUserId);
       const data = await firstValueFrom(data$);
 
-      expect(data).toEqual({ keyConnectorUrl: conversion.keyConnectorUrl });
+      expect(data).toEqual({
+        keyConnectorUrl: conversion.keyConnectorUrl,
+        organizationSsoIdentifier: conversion.organizationId,
+      });
     });
 
     it("should return observable of null value when no data is set", async () => {
diff --git a/libs/common/src/key-management/key-connector/services/key-connector.service.ts b/libs/common/src/key-management/key-connector/services/key-connector.service.ts
index f6730cf8870..8a75034cae1 100644
--- a/libs/common/src/key-management/key-connector/services/key-connector.service.ts
+++ b/libs/common/src/key-management/key-connector/services/key-connector.service.ts
@@ -202,9 +202,16 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
   }
 
   requiresDomainConfirmation$(userId: UserId): Observable<KeyConnectorDomainConfirmation | null> {
-    return this.stateProvider
-      .getUserState$(NEW_SSO_USER_KEY_CONNECTOR_CONVERSION, userId)
-      .pipe(map((data) => (data != null ? { keyConnectorUrl: data.keyConnectorUrl } : null)));
+    return this.stateProvider.getUserState$(NEW_SSO_USER_KEY_CONNECTOR_CONVERSION, userId).pipe(
+      map((data) =>
+        data != null
+          ? {
+              keyConnectorUrl: data.keyConnectorUrl,
+              organizationSsoIdentifier: data.organizationId,
+            }
+          : null,
+      ),
+    );
   }
 
   private handleKeyConnectorError(e: any) {
diff --git a/libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts b/libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts
index f982c2c5ce8..0e86761685f 100644
--- a/libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts
+++ b/libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts
@@ -106,6 +106,13 @@ export abstract class MasterPasswordServiceAbstraction {
     password: string,
     masterPasswordUnlockData: MasterPasswordUnlockData,
   ) => Promise<UserKey>;
+
+  /**
+   * Returns whether the user has a master password set.
+   * @param userId The user ID.
+   * @throws If the user ID is missing.
+   */
+  abstract userHasMasterPassword(userId: UserId): Promise<boolean>;
 }
 
 export abstract class InternalMasterPasswordServiceAbstraction extends MasterPasswordServiceAbstraction {
diff --git a/libs/common/src/key-management/master-password/services/fake-master-password.service.ts b/libs/common/src/key-management/master-password/services/fake-master-password.service.ts
index 5db7f178b18..90fcaddb1a5 100644
--- a/libs/common/src/key-management/master-password/services/fake-master-password.service.ts
+++ b/libs/common/src/key-management/master-password/services/fake-master-password.service.ts
@@ -33,6 +33,10 @@ export class FakeMasterPasswordService implements InternalMasterPasswordServiceA
     this.masterKeyHashSubject.next(initialMasterKeyHash);
   }
 
+  userHasMasterPassword(userId: UserId): Promise<boolean> {
+    return this.mock.userHasMasterPassword(userId);
+  }
+
   emailToSalt(email: string): MasterPasswordSalt {
     return this.mock.emailToSalt(email);
   }
diff --git a/libs/common/src/key-management/master-password/services/master-password.service.ts b/libs/common/src/key-management/master-password/services/master-password.service.ts
index 8012a9230e7..c2947b2263d 100644
--- a/libs/common/src/key-management/master-password/services/master-password.service.ts
+++ b/libs/common/src/key-management/master-password/services/master-password.service.ts
@@ -25,6 +25,7 @@ import { MasterKey, UserKey } from "../../../types/key";
 import { KeyGenerationService } from "../../crypto";
 import { CryptoFunctionService } from "../../crypto/abstractions/crypto-function.service";
 import { EncryptedString, EncString } from "../../crypto/models/enc-string";
+import { USES_KEY_CONNECTOR } from "../../key-connector/services/key-connector.service";
 import { InternalMasterPasswordServiceAbstraction } from "../abstractions/master-password.service.abstraction";
 import {
   MasterKeyWrappedUserKey,
@@ -85,6 +86,19 @@ export class MasterPasswordService implements InternalMasterPasswordServiceAbstr
     private accountService: AccountService,
   ) {}
 
+  async userHasMasterPassword(userId: UserId): Promise<boolean> {
+    assertNonNullish(userId, "userId");
+    // A user has a master-password if they have a master-key encrypted user key *but* are not a key connector user
+    // Note: We can't use the key connector service as an abstraction here because it causes a run-time dependency injection cycle between KC service and MP service.
+    const usesKeyConnector = await firstValueFrom(
+      this.stateProvider.getUser(userId, USES_KEY_CONNECTOR).state$,
+    );
+    const usesMasterKey = await firstValueFrom(
+      this.stateProvider.getUser(userId, MASTER_KEY_ENCRYPTED_USER_KEY).state$,
+    );
+    return usesMasterKey && !usesKeyConnector;
+  }
+
   saltForUser$(userId: UserId): Observable<MasterPasswordSalt> {
     assertNonNullish(userId, "userId");
     return this.accountService.accounts$.pipe(
@@ -307,6 +321,7 @@ export class MasterPasswordService implements InternalMasterPasswordServiceAbstr
         masterPasswordUnlockData.kdf.toSdkConfig(),
       ),
     );
+
     return userKey as UserKey;
   }
 
diff --git a/libs/common/src/key-management/pin/pin-state.service.abstraction.ts b/libs/common/src/key-management/pin/pin-state.service.abstraction.ts
index cd10b8b7fe2..4aef268c1c4 100644
--- a/libs/common/src/key-management/pin/pin-state.service.abstraction.ts
+++ b/libs/common/src/key-management/pin/pin-state.service.abstraction.ts
@@ -45,14 +45,6 @@ export abstract class PinStateServiceAbstraction {
     pinLockType: PinLockType,
   ): Promise<PasswordProtectedKeyEnvelope | null>;
 
-  /**
-   * Gets the user's legacy PIN-protected UserKey
-   * @deprecated Use {@link getPinProtectedUserKeyEnvelope} instead. Only for migration support.
-   * @param userId The user's id
-   * @throws If the user id is not provided
-   */
-  abstract getLegacyPinKeyEncryptedUserKeyPersistent(userId: UserId): Promise<EncString | null>;
-
   /**
    * Sets the PIN state for the user
    * @deprecated - This is not a public API. DO NOT USE IT
diff --git a/libs/common/src/key-management/pin/pin-state.service.implementation.ts b/libs/common/src/key-management/pin/pin-state.service.implementation.ts
index 0bf6cb60fb0..d5b2608f280 100644
--- a/libs/common/src/key-management/pin/pin-state.service.implementation.ts
+++ b/libs/common/src/key-management/pin/pin-state.service.implementation.ts
@@ -13,7 +13,6 @@ import {
   PIN_PROTECTED_USER_KEY_ENVELOPE_PERSISTENT,
   PIN_PROTECTED_USER_KEY_ENVELOPE_EPHEMERAL,
   USER_KEY_ENCRYPTED_PIN,
-  PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
 } from "./pin.state";
 
 export class PinStateService implements PinStateServiceAbstraction {
@@ -36,9 +35,7 @@ export class PinStateService implements PinStateServiceAbstraction {
     assertNonNullish(userId, "userId");
 
     const isPersistentPinSet =
-      (await this.getPinProtectedUserKeyEnvelope(userId, "PERSISTENT")) != null ||
-      // Deprecated
-      (await this.getLegacyPinKeyEncryptedUserKeyPersistent(userId)) != null;
+      (await this.getPinProtectedUserKeyEnvelope(userId, "PERSISTENT")) != null;
     const isPinSet =
       (await firstValueFrom(this.stateProvider.getUserState$(USER_KEY_ENCRYPTED_PIN, userId))) !=
       null;
@@ -71,16 +68,6 @@ export class PinStateService implements PinStateServiceAbstraction {
     }
   }
 
-  async getLegacyPinKeyEncryptedUserKeyPersistent(userId: UserId): Promise<EncString | null> {
-    assertNonNullish(userId, "userId");
-
-    return await firstValueFrom(
-      this.stateProvider
-        .getUserState$(PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT, userId)
-        .pipe(map((value) => (value ? new EncString(value) : null))),
-    );
-  }
-
   async setPinState(
     userId: UserId,
     pinProtectedUserKeyEnvelope: PasswordProtectedKeyEnvelope,
@@ -116,9 +103,6 @@ export class PinStateService implements PinStateServiceAbstraction {
     await this.stateProvider.setUserState(USER_KEY_ENCRYPTED_PIN, null, userId);
     await this.stateProvider.setUserState(PIN_PROTECTED_USER_KEY_ENVELOPE_EPHEMERAL, null, userId);
     await this.stateProvider.setUserState(PIN_PROTECTED_USER_KEY_ENVELOPE_PERSISTENT, null, userId);
-
-    // Note: This can be deleted after sufficiently many PINs are migrated and the state is removed.
-    await this.stateProvider.setUserState(PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT, null, userId);
   }
 
   async clearEphemeralPinState(userId: UserId): Promise<void> {
diff --git a/libs/common/src/key-management/pin/pin-state.service.spec.ts b/libs/common/src/key-management/pin/pin-state.service.spec.ts
index be85a15e6d3..7406701c28d 100644
--- a/libs/common/src/key-management/pin/pin-state.service.spec.ts
+++ b/libs/common/src/key-management/pin/pin-state.service.spec.ts
@@ -13,7 +13,6 @@ import {
   USER_KEY_ENCRYPTED_PIN,
   PIN_PROTECTED_USER_KEY_ENVELOPE_EPHEMERAL,
   PIN_PROTECTED_USER_KEY_ENVELOPE_PERSISTENT,
-  PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
 } from "./pin.state";
 
 describe("PinStateService", () => {
@@ -121,21 +120,6 @@ describe("PinStateService", () => {
       expect(result).toBe("PERSISTENT");
     });
 
-    it("should return 'PERSISTENT' if a legacy pin key encrypted user key (persistent) is found", async () => {
-      // Arrange
-      await stateProvider.setUserState(
-        PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
-        mockUserKeyEncryptedPin,
-        mockUserId,
-      );
-
-      // Act
-      const result = await sut.getPinLockType(mockUserId);
-
-      // Assert
-      expect(result).toBe("PERSISTENT");
-    });
-
     it("should return 'EPHEMERAL' if only user key encrypted pin is found", async () => {
       // Arrange
       await stateProvider.setUserState(USER_KEY_ENCRYPTED_PIN, mockUserKeyEncryptedPin, mockUserId);
@@ -164,7 +148,6 @@ describe("PinStateService", () => {
         null,
         mockUserId,
       );
-      await stateProvider.setUserState(PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT, null, mockUserId);
       await stateProvider.setUserState(USER_KEY_ENCRYPTED_PIN, null, mockUserId);
 
       // Act
@@ -290,45 +273,6 @@ describe("PinStateService", () => {
     });
   });
 
-  describe("getLegacyPinKeyEncryptedUserKeyPersistent()", () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    test.each([null, undefined])("throws if userId is %p", async (userId) => {
-      // Act & Assert
-      await expect(() =>
-        sut.getLegacyPinKeyEncryptedUserKeyPersistent(userId as any),
-      ).rejects.toThrow("userId is null or undefined.");
-    });
-
-    it("should return EncString when legacy key is set", async () => {
-      // Arrange
-      await stateProvider.setUserState(
-        PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
-        mockUserKeyEncryptedPin,
-        mockUserId,
-      );
-
-      // Act
-      const result = await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId);
-
-      // Assert
-      expect(result?.encryptedString).toEqual(mockUserKeyEncryptedPin);
-    });
-
-    test.each([null, undefined])("should return null when legacy key is %p", async (value) => {
-      // Arrange
-      await stateProvider.setUserState(PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT, value, mockUserId);
-
-      // Act
-      const result = await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId);
-
-      // Assert
-      expect(result).toBeNull();
-    });
-  });
-
   describe("setPinState()", () => {
     beforeEach(() => {
       jest.clearAllMocks();
@@ -464,22 +408,6 @@ describe("PinStateService", () => {
       expect(result).toBeNull();
     });
 
-    it("clears legacy PIN key encrypted user key persistent", async () => {
-      // Arrange
-      await stateProvider.setUserState(
-        PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
-        mockUserKeyEncryptedPin,
-        mockUserId,
-      );
-
-      // Act
-      await sut.clearPinState(mockUserId);
-
-      // Assert
-      const result = await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId);
-      expect(result).toBeNull();
-    });
-
     it("clears all PIN state when all types are set", async () => {
       // Arrange - set up all possible PIN state
       await sut.setPinState(
@@ -494,17 +422,11 @@ describe("PinStateService", () => {
         mockUserKeyEncryptedPin,
         "EPHEMERAL",
       );
-      await stateProvider.setUserState(
-        PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
-        mockUserKeyEncryptedPin,
-        mockUserId,
-      );
 
       // Verify all state is set before clearing
       expect(await firstValueFrom(sut.userKeyEncryptedPin$(mockUserId))).not.toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "EPHEMERAL")).not.toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "PERSISTENT")).not.toBeNull();
-      expect(await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId)).not.toBeNull();
 
       // Act
       await sut.clearPinState(mockUserId);
@@ -513,7 +435,6 @@ describe("PinStateService", () => {
       expect(await firstValueFrom(sut.userKeyEncryptedPin$(mockUserId))).toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "EPHEMERAL")).toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "PERSISTENT")).toBeNull();
-      expect(await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId)).toBeNull();
     });
 
     it("results in PIN lock type DISABLED after clearing", async () => {
@@ -545,7 +466,6 @@ describe("PinStateService", () => {
       expect(await firstValueFrom(sut.userKeyEncryptedPin$(mockUserId))).toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "EPHEMERAL")).toBeNull();
       expect(await sut.getPinProtectedUserKeyEnvelope(mockUserId, "PERSISTENT")).toBeNull();
-      expect(await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId)).toBeNull();
       expect(await sut.getPinLockType(mockUserId)).toBe("DISABLED");
     });
   });
@@ -623,32 +543,6 @@ describe("PinStateService", () => {
       expect(ephemeralResult).toBeNull();
     });
 
-    it("does not clear legacy PIN key encrypted user key persistent", async () => {
-      // Arrange - set up ephemeral state and legacy state
-      await sut.setPinState(
-        mockUserId,
-        mockEphemeralEnvelope,
-        mockUserKeyEncryptedPin,
-        "EPHEMERAL",
-      );
-      await stateProvider.setUserState(
-        PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT,
-        mockUserKeyEncryptedPin,
-        mockUserId,
-      );
-
-      // Act
-      await sut.clearEphemeralPinState(mockUserId);
-
-      // Assert - legacy PIN should still be present
-      const legacyResult = await sut.getLegacyPinKeyEncryptedUserKeyPersistent(mockUserId);
-      expect(legacyResult?.encryptedString).toEqual(mockUserKeyEncryptedPin);
-
-      // Assert - ephemeral envelope should be cleared
-      const ephemeralResult = await sut.getPinProtectedUserKeyEnvelope(mockUserId, "EPHEMERAL");
-      expect(ephemeralResult).toBeNull();
-    });
-
     it("changes PIN lock type from EPHEMERAL to DISABLED when no other PIN state exists", async () => {
       // Arrange - set up only ephemeral PIN state
       await sut.setPinState(
diff --git a/libs/common/src/key-management/pin/pin.service.abstraction.ts b/libs/common/src/key-management/pin/pin.service.abstraction.ts
index b242320c06e..c4551d3522f 100644
--- a/libs/common/src/key-management/pin/pin.service.abstraction.ts
+++ b/libs/common/src/key-management/pin/pin.service.abstraction.ts
@@ -1,8 +1,5 @@
-// eslint-disable-next-line no-restricted-imports
-import { KdfConfig } from "@bitwarden/key-management";
-
 import { UserId } from "../../types/guid";
-import { PinKey, UserKey } from "../../types/key";
+import { UserKey } from "../../types/key";
 
 import { PinLockType } from "./pin-lock-type";
 
@@ -69,10 +66,4 @@ export abstract class PinServiceAbstraction {
    * @deprecated This is not deprecated, but only meant to be called by KeyService. DO NOT USE IT.
    */
   abstract userUnlocked(userId: UserId): Promise<void>;
-
-  /**
-   * Makes a PinKey from the provided PIN.
-   * @deprecated - Note: This is currently re-used by vault exports, which is still permitted but should be refactored out to use a different construct.
-   */
-  abstract makePinKey(pin: string, salt: string, kdfConfig: KdfConfig): Promise<PinKey>;
 }
diff --git a/libs/common/src/key-management/pin/pin.service.implementation.ts b/libs/common/src/key-management/pin/pin.service.implementation.ts
index 29a10d1a0a4..da6d3f20eaf 100644
--- a/libs/common/src/key-management/pin/pin.service.implementation.ts
+++ b/libs/common/src/key-management/pin/pin.service.implementation.ts
@@ -1,18 +1,15 @@
 import { firstValueFrom, map } from "rxjs";
 
 // eslint-disable-next-line no-restricted-imports
-import { KdfConfig, KdfConfigService, KeyService } from "@bitwarden/key-management";
+import { KeyService } from "@bitwarden/key-management";
 
-import { AccountService } from "../../auth/abstractions/account.service";
 import { assertNonNullish } from "../../auth/utils";
 import { EncryptService } from "../../key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "../../key-management/crypto/models/enc-string";
 import { LogService } from "../../platform/abstractions/log.service";
 import { SdkService } from "../../platform/abstractions/sdk/sdk.service";
 import { SymmetricCryptoKey } from "../../platform/models/domain/symmetric-crypto-key";
 import { UserId } from "../../types/guid";
-import { PinKey, UserKey } from "../../types/key";
-import { KeyGenerationService } from "../crypto";
+import { UserKey } from "../../types/key";
 import { firstValueFromOrThrow } from "../utils";
 
 import { PinLockType } from "./pin-lock-type";
@@ -21,10 +18,7 @@ import { PinServiceAbstraction } from "./pin.service.abstraction";
 
 export class PinService implements PinServiceAbstraction {
   constructor(
-    private accountService: AccountService,
     private encryptService: EncryptService,
-    private kdfConfigService: KdfConfigService,
-    private keyGenerationService: KeyGenerationService,
     private logService: LogService,
     private keyService: KeyService,
     private sdkService: SdkService,
@@ -56,19 +50,6 @@ export class PinService implements PinServiceAbstraction {
       // On first unlock, set the ephemeral pin envelope, if it is not set yet
       const pin = await this.getPin(userId);
       await this.setPin(pin, "EPHEMERAL", userId);
-    } else if ((await this.pinStateService.getPinLockType(userId)) === "PERSISTENT") {
-      // Encrypted migration for persistent pin unlock to pin envelopes.
-      // This will be removed at the earliest in 2026.1.0
-      //
-      // ----- ENCRYPTION MIGRATION -----
-      // Pin-key encrypted user-keys are eagerly migrated to the new pin-protected user key envelope format.
-      if ((await this.pinStateService.getLegacyPinKeyEncryptedUserKeyPersistent(userId)) != null) {
-        this.logService.info(
-          "[Pin Service] Migrating legacy PIN key to PinProtectedUserKeyEnvelope",
-        );
-        const pin = await this.getPin(userId);
-        await this.setPin(pin, "PERSISTENT", userId);
-      }
     }
   }
 
@@ -144,86 +125,30 @@ export class PinService implements PinServiceAbstraction {
     assertNonNullish(pin, "pin");
     assertNonNullish(userId, "userId");
 
-    const hasPinProtectedKeyEnvelopeSet =
-      (await this.pinStateService.getPinProtectedUserKeyEnvelope(userId, "EPHEMERAL")) != null ||
-      (await this.pinStateService.getPinProtectedUserKeyEnvelope(userId, "PERSISTENT")) != null;
+    this.logService.info("[Pin Service] Pin-unlock via PinProtectedUserKeyEnvelope");
 
-    if (hasPinProtectedKeyEnvelopeSet) {
-      this.logService.info("[Pin Service] Pin-unlock via PinProtectedUserKeyEnvelope");
+    const pinLockType = await this.pinStateService.getPinLockType(userId);
+    const envelope = await this.pinStateService.getPinProtectedUserKeyEnvelope(userId, pinLockType);
 
-      const pinLockType = await this.pinStateService.getPinLockType(userId);
-      const envelope = await this.pinStateService.getPinProtectedUserKeyEnvelope(
-        userId,
-        pinLockType,
+    try {
+      // Use the sdk to create an enrollment, not yet persisting it to state
+      const startTime = performance.now();
+      const userKeyBytes = await firstValueFrom(
+        this.sdkService.client$.pipe(
+          map((sdk) => {
+            if (!sdk) {
+              throw new Error("SDK not available");
+            }
+            return sdk.crypto().unseal_password_protected_key_envelope(pin, envelope!);
+          }),
+        ),
       );
+      this.logService.measure(startTime, "Crypto", "PinService", "UnsealPinEnvelope");
 
-      try {
-        // Use the sdk to create an enrollment, not yet persisting it to state
-        const startTime = performance.now();
-        const userKeyBytes = await firstValueFrom(
-          this.sdkService.client$.pipe(
-            map((sdk) => {
-              if (!sdk) {
-                throw new Error("SDK not available");
-              }
-              return sdk.crypto().unseal_password_protected_key_envelope(pin, envelope!);
-            }),
-          ),
-        );
-        this.logService.measure(startTime, "Crypto", "PinService", "UnsealPinEnvelope");
-
-        return new SymmetricCryptoKey(userKeyBytes) as UserKey;
-      } catch (error) {
-        this.logService.error(`Failed to unseal pin: ${error}`);
-        return null;
-      }
-    } else {
-      this.logService.info("[Pin Service] Pin-unlock via legacy PinKeyEncryptedUserKey");
-
-      // This branch is deprecated and will be removed in the future, but is kept for migration.
-      try {
-        const pinKeyEncryptedUserKey =
-          await this.pinStateService.getLegacyPinKeyEncryptedUserKeyPersistent(userId);
-        const email = await firstValueFrom(
-          this.accountService.accounts$.pipe(map((accounts) => accounts[userId].email)),
-        );
-        const kdfConfig = await this.kdfConfigService.getKdfConfig(userId);
-        return await this.decryptUserKey(pin, email, kdfConfig, pinKeyEncryptedUserKey!);
-      } catch (error) {
-        this.logService.error(`Error decrypting user key with pin: ${error}`);
-        return null;
-      }
+      return new SymmetricCryptoKey(userKeyBytes) as UserKey;
+    } catch (error) {
+      this.logService.error(`Failed to unseal pin: ${error}`);
+      return null;
     }
   }
-
-  /// Anything below here is deprecated and will be removed subsequently
-
-  async makePinKey(pin: string, salt: string, kdfConfig: KdfConfig): Promise<PinKey> {
-    const startTime = performance.now();
-    const pinKey = await this.keyGenerationService.deriveKeyFromPassword(pin, salt, kdfConfig);
-    this.logService.measure(startTime, "Crypto", "PinService", "makePinKey");
-
-    return (await this.keyGenerationService.stretchKey(pinKey)) as PinKey;
-  }
-
-  /**
-   * Decrypts the UserKey with the provided PIN.
-   * @deprecated
-   * @throws If the PIN does not match the PIN that was used to encrypt the user key
-   * @throws If the salt, or KDF don't match the salt / KDF used to encrypt the user key
-   */
-  private async decryptUserKey(
-    pin: string,
-    salt: string,
-    kdfConfig: KdfConfig,
-    pinKeyEncryptedUserKey: EncString,
-  ): Promise<UserKey> {
-    assertNonNullish(pin, "pin");
-    assertNonNullish(salt, "salt");
-    assertNonNullish(kdfConfig, "kdfConfig");
-    assertNonNullish(pinKeyEncryptedUserKey, "pinKeyEncryptedUserKey");
-    const pinKey = await this.makePinKey(pin, salt, kdfConfig);
-    const userKey = await this.encryptService.unwrapSymmetricKey(pinKeyEncryptedUserKey, pinKey);
-    return userKey as UserKey;
-  }
 }
diff --git a/libs/common/src/key-management/pin/pin.service.spec.ts b/libs/common/src/key-management/pin/pin.service.spec.ts
index 8d78255bb1b..644fd1d8d75 100644
--- a/libs/common/src/key-management/pin/pin.service.spec.ts
+++ b/libs/common/src/key-management/pin/pin.service.spec.ts
@@ -2,17 +2,15 @@ import { mock } from "jest-mock-extended";
 import { BehaviorSubject, filter } from "rxjs";
 
 // eslint-disable-next-line no-restricted-imports
-import { DEFAULT_KDF_CONFIG, KdfConfigService, KeyService } from "@bitwarden/key-management";
+import { KeyService } from "@bitwarden/key-management";
 import { PasswordProtectedKeyEnvelope } from "@bitwarden/sdk-internal";
 
 import { MockSdkService } from "../..//platform/spec/mock-sdk.service";
-import { FakeAccountService, mockAccountServiceWith, mockEnc } from "../../../spec";
 import { LogService } from "../../platform/abstractions/log.service";
 import { Utils } from "../../platform/misc/utils";
 import { SymmetricCryptoKey } from "../../platform/models/domain/symmetric-crypto-key";
 import { UserId } from "../../types/guid";
-import { PinKey, UserKey } from "../../types/key";
-import { KeyGenerationService } from "../crypto";
+import { UserKey } from "../../types/key";
 import { EncryptService } from "../crypto/abstractions/encrypt.service";
 import { EncryptedString, EncString } from "../crypto/models/enc-string";
 
@@ -22,16 +20,10 @@ import { PinService } from "./pin.service.implementation";
 describe("PinService", () => {
   let sut: PinService;
 
-  let accountService: FakeAccountService;
-
   const encryptService = mock<EncryptService>();
-  const kdfConfigService = mock<KdfConfigService>();
-  const keyGenerationService = mock<KeyGenerationService>();
   const logService = mock<LogService>();
   const mockUserId = Utils.newGuid() as UserId;
   const mockUserKey = new SymmetricCryptoKey(new Uint8Array(64)) as UserKey;
-  const mockPinKey = new SymmetricCryptoKey(randomBytes(32)) as PinKey;
-  const mockUserEmail = "user@example.com";
   const mockPin = "1234";
   const mockUserKeyEncryptedPin = new EncString("userKeyEncryptedPin");
   const mockEphemeralEnvelope = "mock-ephemeral-envelope" as PasswordProtectedKeyEnvelope;
@@ -42,7 +34,6 @@ describe("PinService", () => {
   const behaviorSubject = new BehaviorSubject<{ userId: UserId; userKey: UserKey }>(null);
 
   beforeEach(() => {
-    accountService = mockAccountServiceWith(mockUserId, { email: mockUserEmail });
     (keyService as any)["unlockedUserKeys$"] = behaviorSubject
       .asObservable()
       .pipe(filter((x) => x != null));
@@ -50,16 +41,7 @@ describe("PinService", () => {
       .mockDeep()
       .unseal_password_protected_key_envelope.mockReturnValue(new Uint8Array(64));
 
-    sut = new PinService(
-      accountService,
-      encryptService,
-      kdfConfigService,
-      keyGenerationService,
-      logService,
-      keyService,
-      sdkService,
-      pinStateService,
-    );
+    sut = new PinService(encryptService, logService, keyService, sdkService, pinStateService);
   });
 
   it("should instantiate the PinService", () => {
@@ -89,26 +71,6 @@ describe("PinService", () => {
       );
     });
 
-    it("should migrate legacy persistent PIN if needed", async () => {
-      // Arrange
-      pinStateService.getPinLockType.mockResolvedValue("PERSISTENT");
-      pinStateService.getLegacyPinKeyEncryptedUserKeyPersistent.mockResolvedValue(
-        mockEnc("legacy-key"),
-      );
-      const getPinSpy = jest.spyOn(sut, "getPin").mockResolvedValue(mockPin);
-      const setPinSpy = jest.spyOn(sut, "setPin").mockResolvedValue();
-
-      // Act
-      await sut.userUnlocked(mockUserId);
-
-      // Assert
-      expect(getPinSpy).toHaveBeenCalledWith(mockUserId);
-      expect(setPinSpy).toHaveBeenCalledWith(mockPin, "PERSISTENT", mockUserId);
-      expect(logService.info).toHaveBeenCalledWith(
-        "[Pin Service] Migrating legacy PIN key to PinProtectedUserKeyEnvelope",
-      );
-    });
-
     it("should do nothing if no migration or setup is needed", async () => {
       // Arrange
       pinStateService.getPinLockType.mockResolvedValue("DISABLED");
@@ -124,28 +86,6 @@ describe("PinService", () => {
     });
   });
 
-  describe("makePinKey()", () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it("should make a PinKey", async () => {
-      // Arrange
-      keyGenerationService.deriveKeyFromPassword.mockResolvedValue(mockPinKey);
-
-      // Act
-      await sut.makePinKey(mockPin, mockUserEmail, DEFAULT_KDF_CONFIG);
-
-      // Assert
-      expect(keyGenerationService.deriveKeyFromPassword).toHaveBeenCalledWith(
-        mockPin,
-        mockUserEmail,
-        DEFAULT_KDF_CONFIG,
-      );
-      expect(keyGenerationService.stretchKey).toHaveBeenCalledWith(mockPinKey);
-    });
-  });
-
   describe("getPin()", () => {
     beforeEach(() => {
       jest.clearAllMocks();
@@ -383,7 +323,6 @@ describe("PinService", () => {
       jest.clearAllMocks();
       pinStateService.userKeyEncryptedPin$.mockReset();
       pinStateService.getPinProtectedUserKeyEnvelope.mockReset();
-      pinStateService.getLegacyPinKeyEncryptedUserKeyPersistent.mockReset();
     });
 
     it("should throw an error if userId is null", async () => {
@@ -423,32 +362,5 @@ describe("PinService", () => {
       // Assert
       expect(result).toEqual(mockUserKey);
     });
-
-    it("should return userkey with legacy pin PERSISTENT", async () => {
-      keyGenerationService.deriveKeyFromPassword.mockResolvedValue(mockPinKey);
-      keyGenerationService.stretchKey.mockResolvedValue(mockPinKey);
-      kdfConfigService.getKdfConfig.mockResolvedValue(DEFAULT_KDF_CONFIG);
-      encryptService.unwrapSymmetricKey.mockResolvedValue(mockUserKey);
-
-      // Arrange
-      const mockPin = "1234";
-      pinStateService.userKeyEncryptedPin$.mockReturnValueOnce(
-        new BehaviorSubject(mockUserKeyEncryptedPin),
-      );
-      pinStateService.getLegacyPinKeyEncryptedUserKeyPersistent.mockResolvedValueOnce(
-        mockUserKeyEncryptedPin,
-      );
-
-      // Act
-      const result = await sut.decryptUserKeyWithPin(mockPin, mockUserId);
-
-      // Assert
-      expect(result).toEqual(mockUserKey);
-    });
   });
 });
-
-// Test helpers
-function randomBytes(length: number): Uint8Array {
-  return new Uint8Array(Array.from({ length }, (_, k) => k % 255));
-}
diff --git a/libs/common/src/key-management/pin/pin.state.ts b/libs/common/src/key-management/pin/pin.state.ts
index 4ad0524035f..c3bbad7644c 100644
--- a/libs/common/src/key-management/pin/pin.state.ts
+++ b/libs/common/src/key-management/pin/pin.state.ts
@@ -3,22 +3,6 @@ import { PasswordProtectedKeyEnvelope } from "@bitwarden/sdk-internal";
 
 import { EncryptedString } from "../crypto/models/enc-string";
 
-/**
- * The persistent (stored on disk) version of the UserKey, encrypted by the PinKey.
- *
- * @deprecated
- * @remarks Persists through a client reset. Used when `requireMasterPasswordOnClientRestart` is disabled.
- * @see SetPinComponent.setPinForm.requireMasterPasswordOnClientRestart
- */
-export const PIN_KEY_ENCRYPTED_USER_KEY_PERSISTENT = new UserKeyDefinition<EncryptedString>(
-  PIN_DISK,
-  "pinKeyEncryptedUserKeyPersistent",
-  {
-    deserializer: (jsonValue) => jsonValue,
-    clearOn: ["logout"],
-  },
-);
-
 /**
  * The persistent (stored on disk) version of the UserKey, stored in a `PasswordProtectedKeyEnvelope`.
  *
diff --git a/libs/common/src/key-management/services/default-process-reload.service.ts b/libs/common/src/key-management/services/default-process-reload.service.ts
index ddbcf7e5530..ecd9ddafa40 100644
--- a/libs/common/src/key-management/services/default-process-reload.service.ts
+++ b/libs/common/src/key-management/services/default-process-reload.service.ts
@@ -56,7 +56,7 @@ export class DefaultProcessReloadService implements ProcessReloadServiceAbstract
       return;
     }
 
-    // If there is an active user, check if they have a pinKeyEncryptedUserKeyEphemeral. If so, prevent process reload upon lock.
+    // If there is an active user, check if they have an ephemeral PIN. If so, prevent process reload upon lock.
     const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
     if (userId != null) {
       if ((await this.pinService.getPinLockType(userId)) === "EPHEMERAL") {
diff --git a/libs/common/src/key-management/session-timeout/abstractions/session-timeout-type.service.ts b/libs/common/src/key-management/session-timeout/abstractions/session-timeout-type.service.ts
new file mode 100644
index 00000000000..6ed230d9b78
--- /dev/null
+++ b/libs/common/src/key-management/session-timeout/abstractions/session-timeout-type.service.ts
@@ -0,0 +1,15 @@
+import { VaultTimeout } from "../../vault-timeout";
+
+export abstract class SessionTimeoutTypeService {
+  /**
+   * Is provided timeout type available on this client type, OS ?
+   * @param timeout the timeout type
+   */
+  abstract isAvailable(timeout: VaultTimeout): Promise<boolean>;
+
+  /**
+   * Returns the highest available and permissive timeout type, that is higher than or equals the provided timeout type.
+   * @param timeout the provided timeout type
+   */
+  abstract getOrPromoteToAvailable(timeout: VaultTimeout): Promise<VaultTimeout>;
+}
diff --git a/libs/common/src/key-management/session-timeout/index.ts b/libs/common/src/key-management/session-timeout/index.ts
new file mode 100644
index 00000000000..4768534e7cb
--- /dev/null
+++ b/libs/common/src/key-management/session-timeout/index.ts
@@ -0,0 +1,3 @@
+export { SessionTimeoutTypeService } from "./abstractions/session-timeout-type.service";
+export { MaximumSessionTimeoutPolicyData } from "./types/maximum-session-timeout-policy.type";
+export { SessionTimeoutAction, SessionTimeoutType } from "./types/session-timeout.type";
diff --git a/libs/common/src/key-management/session-timeout/types/maximum-session-timeout-policy.type.ts b/libs/common/src/key-management/session-timeout/types/maximum-session-timeout-policy.type.ts
new file mode 100644
index 00000000000..de416be1518
--- /dev/null
+++ b/libs/common/src/key-management/session-timeout/types/maximum-session-timeout-policy.type.ts
@@ -0,0 +1,7 @@
+import { SessionTimeoutAction, SessionTimeoutType } from "./session-timeout.type";
+
+export interface MaximumSessionTimeoutPolicyData {
+  type?: SessionTimeoutType;
+  minutes: number;
+  action?: SessionTimeoutAction;
+}
diff --git a/libs/common/src/key-management/session-timeout/types/session-timeout.type.ts b/libs/common/src/key-management/session-timeout/types/session-timeout.type.ts
new file mode 100644
index 00000000000..3dd1a546aab
--- /dev/null
+++ b/libs/common/src/key-management/session-timeout/types/session-timeout.type.ts
@@ -0,0 +1,8 @@
+export type SessionTimeoutAction = null | "lock" | "logOut";
+export type SessionTimeoutType =
+  | null
+  | "never"
+  | "onAppRestart"
+  | "onSystemLock"
+  | "immediately"
+  | "custom";
diff --git a/libs/common/src/key-management/types.ts b/libs/common/src/key-management/types.ts
index df64a3ed342..1c349e83a03 100644
--- a/libs/common/src/key-management/types.ts
+++ b/libs/common/src/key-management/types.ts
@@ -1,6 +1,10 @@
 import { Opaque } from "type-fest";
 
-import { EncString, SignedSecurityState as SdkSignedSecurityState } from "@bitwarden/sdk-internal";
+import {
+  EncString,
+  SignedSecurityState as SdkSignedSecurityState,
+  SignedPublicKey as SdkSignedPublicKey,
+} from "@bitwarden/sdk-internal";
 
 /**
  * A private key, encrypted with a symmetric key.
@@ -10,7 +14,7 @@ export type WrappedPrivateKey = Opaque<EncString, "WrappedPrivateKey">;
 /**
  * A public key, signed with the accounts signature key.
  */
-export type SignedPublicKey = Opaque<string, "SignedPublicKey">;
+export type SignedPublicKey = Opaque<SdkSignedPublicKey, "SignedPublicKey">;
 /**
  * A public key in base64 encoded SPKI-DER
  */
diff --git a/libs/common/src/key-management/vault-timeout/index.ts b/libs/common/src/key-management/vault-timeout/index.ts
index 02e49dceaab..ba32c12c9fb 100644
--- a/libs/common/src/key-management/vault-timeout/index.ts
+++ b/libs/common/src/key-management/vault-timeout/index.ts
@@ -4,8 +4,9 @@ export { VaultTimeoutService } from "./abstractions/vault-timeout.service";
 export { VaultTimeoutService as DefaultVaultTimeoutService } from "./services/vault-timeout.service";
 export { VaultTimeoutAction } from "./enums/vault-timeout-action.enum";
 export {
+  isVaultTimeoutTypeNumeric,
   VaultTimeout,
   VaultTimeoutOption,
+  VaultTimeoutNumberType,
   VaultTimeoutStringType,
 } from "./types/vault-timeout.type";
-export { MaximumVaultTimeoutPolicyData } from "./types/maximum-vault-timeout-policy.type";
diff --git a/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.spec.ts b/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.spec.ts
index ba58fa80922..ccb66a4dff4 100644
--- a/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.spec.ts
+++ b/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.spec.ts
@@ -21,9 +21,14 @@ import { LogService } from "../../../platform/abstractions/log.service";
 import { Utils } from "../../../platform/misc/utils";
 import { UserId } from "../../../types/guid";
 import { PinStateServiceAbstraction } from "../../pin/pin-state.service.abstraction";
+import { SessionTimeoutTypeService } from "../../session-timeout";
 import { VaultTimeoutSettingsService as VaultTimeoutSettingsServiceAbstraction } from "../abstractions/vault-timeout-settings.service";
 import { VaultTimeoutAction } from "../enums/vault-timeout-action.enum";
-import { VaultTimeout, VaultTimeoutStringType } from "../types/vault-timeout.type";
+import {
+  VaultTimeout,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "../types/vault-timeout.type";
 
 import { VaultTimeoutSettingsService } from "./vault-timeout-settings.service";
 import { VAULT_TIMEOUT, VAULT_TIMEOUT_ACTION } from "./vault-timeout-settings.state";
@@ -40,9 +45,11 @@ describe("VaultTimeoutSettingsService", () => {
 
   let userDecryptionOptionsSubject: BehaviorSubject<UserDecryptionOptions>;
 
+  const defaultVaultTimeout: VaultTimeout = 15; // default web vault timeout
   const mockUserId = Utils.newGuid() as UserId;
   let stateProvider: FakeStateProvider;
   let logService: MockProxy<LogService>;
+  let sessionTimeoutTypeService: MockProxy<SessionTimeoutTypeService>;
 
   beforeEach(() => {
     accountService = mockAccountServiceWith(mockUserId);
@@ -67,8 +74,8 @@ describe("VaultTimeoutSettingsService", () => {
     stateProvider = new FakeStateProvider(accountService);
 
     logService = mock<LogService>();
+    sessionTimeoutTypeService = mock<SessionTimeoutTypeService>();
 
-    const defaultVaultTimeout: VaultTimeout = 15; // default web vault timeout
     vaultTimeoutSettingsService = createVaultTimeoutSettingsService(defaultVaultTimeout);
 
     biometricStateService.biometricUnlockEnabled$ = of(false);
@@ -259,40 +266,276 @@ describe("VaultTimeoutSettingsService", () => {
       );
     });
 
-    it.each([
-      // policy, vaultTimeout, expected
-      [null, null, 15], // no policy, no vault timeout, falls back to default
-      [30, 90, 30], // policy overrides vault timeout
-      [30, 15, 15], // policy doesn't override vault timeout when it's within acceptable range
-      [90, VaultTimeoutStringType.Never, 90], // policy overrides vault timeout when it's "never"
-      [null, VaultTimeoutStringType.Never, VaultTimeoutStringType.Never], // no policy, persist "never" vault timeout
-      [90, 0, 0], // policy doesn't override vault timeout when it's 0 (immediate)
-      [null, 0, 0], // no policy, persist 0 (immediate) vault timeout
-      [90, VaultTimeoutStringType.OnRestart, 90], // policy overrides vault timeout when it's "onRestart"
-      [null, VaultTimeoutStringType.OnRestart, VaultTimeoutStringType.OnRestart], // no policy, persist "onRestart" vault timeout
-      [90, VaultTimeoutStringType.OnLocked, 90], // policy overrides vault timeout when it's "onLocked"
-      [null, VaultTimeoutStringType.OnLocked, VaultTimeoutStringType.OnLocked], // no policy, persist "onLocked" vault timeout
-      [90, VaultTimeoutStringType.OnSleep, 90], // policy overrides vault timeout when it's "onSleep"
-      [null, VaultTimeoutStringType.OnSleep, VaultTimeoutStringType.OnSleep], // no policy, persist "onSleep" vault timeout
-      [90, VaultTimeoutStringType.OnIdle, 90], // policy overrides vault timeout when it's "onIdle"
-      [null, VaultTimeoutStringType.OnIdle, VaultTimeoutStringType.OnIdle], // no policy, persist "onIdle" vault timeout
-    ])(
-      "when policy is %s, and vault timeout is %s, returns %s",
-      async (policy, vaultTimeout, expected) => {
+    describe("no policy", () => {
+      it("when vault timeout is null, returns default", async () => {
         userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
-        policyService.policiesByType$.mockReturnValue(
-          of(policy === null ? [] : ([{ data: { minutes: policy } }] as unknown as Policy[])),
+        policyService.policiesByType$.mockReturnValue(of([]));
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, null, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
         );
 
+        expect(result).toBe(defaultVaultTimeout);
+      });
+
+      it.each([
+        VaultTimeoutNumberType.Immediately,
+        VaultTimeoutNumberType.OnMinute,
+        VaultTimeoutNumberType.EightHours,
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnSleep,
+        VaultTimeoutStringType.OnIdle,
+      ])("when vault timeout is %s, returns unchanged", async (vaultTimeout) => {
+        userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
+        policyService.policiesByType$.mockReturnValue(of([]));
+
         await stateProvider.setUserState(VAULT_TIMEOUT, vaultTimeout, mockUserId);
 
         const result = await firstValueFrom(
           vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
         );
 
-        expect(result).toBe(expected);
-      },
-    );
+        expect(result).toBe(vaultTimeout);
+      });
+    });
+
+    describe("policy type: custom", () => {
+      const policyMinutes = 30;
+
+      it.each([
+        VaultTimeoutNumberType.EightHours,
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnSleep,
+        VaultTimeoutStringType.OnIdle,
+      ])(
+        "when vault timeout is %s and exceeds policy max, returns policy minutes",
+        async (vaultTimeout) => {
+          userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
+          policyService.policiesByType$.mockReturnValue(
+            of([{ data: { type: "custom", minutes: policyMinutes } }] as unknown as Policy[]),
+          );
+
+          await stateProvider.setUserState(VAULT_TIMEOUT, vaultTimeout, mockUserId);
+
+          const result = await firstValueFrom(
+            vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+          );
+
+          expect(result).toBe(policyMinutes);
+        },
+      );
+
+      it.each([VaultTimeoutNumberType.OnMinute, policyMinutes])(
+        "when vault timeout is %s and within policy max, returns unchanged",
+        async (vaultTimeout) => {
+          userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
+          policyService.policiesByType$.mockReturnValue(
+            of([{ data: { type: "custom", minutes: policyMinutes } }] as unknown as Policy[]),
+          );
+
+          await stateProvider.setUserState(VAULT_TIMEOUT, vaultTimeout, mockUserId);
+
+          const result = await firstValueFrom(
+            vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+          );
+
+          expect(result).toBe(vaultTimeout);
+        },
+      );
+
+      it("when vault timeout is Immediately, returns Immediately", async () => {
+        userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "custom", minutes: policyMinutes } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(
+          VAULT_TIMEOUT,
+          VaultTimeoutNumberType.Immediately,
+          mockUserId,
+        );
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(result).toBe(VaultTimeoutNumberType.Immediately);
+      });
+    });
+
+    describe("policy type: immediately", () => {
+      it.each([
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnIdle,
+        VaultTimeoutStringType.OnSleep,
+        VaultTimeoutNumberType.Immediately,
+        VaultTimeoutNumberType.OnMinute,
+        VaultTimeoutNumberType.EightHours,
+      ])(
+        "when current timeout is %s, returns immediately or promoted value",
+        async (currentTimeout) => {
+          const expectedTimeout = VaultTimeoutNumberType.Immediately;
+          sessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(expectedTimeout);
+          policyService.policiesByType$.mockReturnValue(
+            of([{ data: { type: "immediately" } }] as unknown as Policy[]),
+          );
+
+          await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+          const result = await firstValueFrom(
+            vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+          );
+
+          expect(sessionTimeoutTypeService.getOrPromoteToAvailable).toHaveBeenCalledWith(
+            VaultTimeoutNumberType.Immediately,
+          );
+          expect(result).toBe(expectedTimeout);
+        },
+      );
+    });
+
+    describe("policy type: onSystemLock", () => {
+      it.each([
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnIdle,
+        VaultTimeoutStringType.OnSleep,
+      ])(
+        "when current timeout is %s, returns onLocked or promoted value",
+        async (currentTimeout) => {
+          const expectedTimeout = VaultTimeoutStringType.OnLocked;
+          sessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(expectedTimeout);
+          policyService.policiesByType$.mockReturnValue(
+            of([{ data: { type: "onSystemLock" } }] as unknown as Policy[]),
+          );
+
+          await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+          const result = await firstValueFrom(
+            vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+          );
+
+          expect(sessionTimeoutTypeService.getOrPromoteToAvailable).toHaveBeenCalledWith(
+            VaultTimeoutStringType.OnLocked,
+          );
+          expect(result).toBe(expectedTimeout);
+        },
+      );
+
+      it.each([
+        VaultTimeoutNumberType.Immediately,
+        VaultTimeoutNumberType.OnMinute,
+        VaultTimeoutNumberType.EightHours,
+      ])("when current timeout is numeric %s, returns unchanged", async (currentTimeout) => {
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "onSystemLock" } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(sessionTimeoutTypeService.getOrPromoteToAvailable).not.toHaveBeenCalled();
+        expect(result).toBe(currentTimeout);
+      });
+    });
+
+    describe("policy type: onAppRestart", () => {
+      it.each([
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnIdle,
+        VaultTimeoutStringType.OnSleep,
+      ])("when current timeout is %s, returns onRestart", async (currentTimeout) => {
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "onAppRestart" } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(sessionTimeoutTypeService.getOrPromoteToAvailable).not.toHaveBeenCalled();
+        expect(result).toBe(VaultTimeoutStringType.OnRestart);
+      });
+
+      it.each([
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutNumberType.Immediately,
+        VaultTimeoutNumberType.OnMinute,
+        VaultTimeoutNumberType.EightHours,
+      ])("when current timeout is %s, returns unchanged", async (currentTimeout) => {
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "onAppRestart" } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(sessionTimeoutTypeService.getOrPromoteToAvailable).not.toHaveBeenCalled();
+        expect(result).toBe(currentTimeout);
+      });
+    });
+
+    describe("policy type: never", () => {
+      it("when current timeout is never, returns never or promoted value", async () => {
+        const expectedTimeout = VaultTimeoutStringType.Never;
+        sessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(expectedTimeout);
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "never" } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, VaultTimeoutStringType.Never, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(sessionTimeoutTypeService.getOrPromoteToAvailable).toHaveBeenCalledWith(
+          VaultTimeoutStringType.Never,
+        );
+        expect(result).toBe(expectedTimeout);
+      });
+
+      it.each([
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.OnIdle,
+        VaultTimeoutStringType.OnSleep,
+        VaultTimeoutNumberType.Immediately,
+        VaultTimeoutNumberType.OnMinute,
+        VaultTimeoutNumberType.EightHours,
+      ])("when current timeout is %s, returns unchanged", async (currentTimeout) => {
+        policyService.policiesByType$.mockReturnValue(
+          of([{ data: { type: "never" } }] as unknown as Policy[]),
+        );
+
+        await stateProvider.setUserState(VAULT_TIMEOUT, currentTimeout, mockUserId);
+
+        const result = await firstValueFrom(
+          vaultTimeoutSettingsService.getVaultTimeoutByUserId$(mockUserId),
+        );
+
+        expect(sessionTimeoutTypeService.getOrPromoteToAvailable).not.toHaveBeenCalled();
+        expect(result).toBe(currentTimeout);
+      });
+    });
   });
 
   describe("setVaultTimeoutOptions", () => {
@@ -405,6 +648,7 @@ describe("VaultTimeoutSettingsService", () => {
       stateProvider,
       logService,
       defaultVaultTimeout,
+      sessionTimeoutTypeService,
     );
   }
 });
diff --git a/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.ts b/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.ts
index 00e53596de4..dc0c5620518 100644
--- a/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.ts
+++ b/libs/common/src/key-management/vault-timeout/services/vault-timeout-settings.service.ts
@@ -1,14 +1,15 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import {
-  EMPTY,
-  Observable,
   catchError,
   combineLatest,
   defer,
   distinctUntilChanged,
+  EMPTY,
   firstValueFrom,
   from,
+  map,
+  Observable,
   shareReplay,
   switchMap,
   tap,
@@ -23,7 +24,6 @@ import { BiometricStateService, KeyService } from "@bitwarden/key-management";
 
 import { PolicyService } from "../../../admin-console/abstractions/policy/policy.service.abstraction";
 import { PolicyType } from "../../../admin-console/enums";
-import { Policy } from "../../../admin-console/models/domain/policy";
 import { getFirstPolicy } from "../../../admin-console/services/policy/default-policy.service";
 import { AccountService } from "../../../auth/abstractions/account.service";
 import { TokenService } from "../../../auth/abstractions/token.service";
@@ -31,9 +31,15 @@ import { LogService } from "../../../platform/abstractions/log.service";
 import { StateProvider } from "../../../platform/state";
 import { UserId } from "../../../types/guid";
 import { PinStateServiceAbstraction } from "../../pin/pin-state.service.abstraction";
+import { MaximumSessionTimeoutPolicyData, SessionTimeoutTypeService } from "../../session-timeout";
 import { VaultTimeoutSettingsService as VaultTimeoutSettingsServiceAbstraction } from "../abstractions/vault-timeout-settings.service";
 import { VaultTimeoutAction } from "../enums/vault-timeout-action.enum";
-import { VaultTimeout, VaultTimeoutStringType } from "../types/vault-timeout.type";
+import {
+  isVaultTimeoutTypeNumeric,
+  VaultTimeout,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "../types/vault-timeout.type";
 
 import { VAULT_TIMEOUT, VAULT_TIMEOUT_ACTION } from "./vault-timeout-settings.state";
 
@@ -49,6 +55,7 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     private stateProvider: StateProvider,
     private logService: LogService,
     private defaultVaultTimeout: VaultTimeout,
+    private sessionTimeoutTypeService: SessionTimeoutTypeService,
   ) {}
 
   async setVaultTimeoutOptions(
@@ -131,11 +138,25 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
 
     return combineLatest([
       this.stateProvider.getUserState$(VAULT_TIMEOUT, userId),
-      this.getMaxVaultTimeoutPolicyByUserId$(userId),
+      this.getMaxSessionTimeoutPolicyDataByUserId$(userId),
     ]).pipe(
-      switchMap(([currentVaultTimeout, maxVaultTimeoutPolicy]) => {
-        return from(this.determineVaultTimeout(currentVaultTimeout, maxVaultTimeoutPolicy)).pipe(
+      switchMap(([currentVaultTimeout, maxSessionTimeoutPolicyData]) => {
+        this.logService.debug(
+          "[VaultTimeoutSettingsService] Current vault timeout is %o for user id %s, max session policy %o",
+          currentVaultTimeout,
+          userId,
+          maxSessionTimeoutPolicyData,
+        );
+        return from(
+          this.determineVaultTimeout(currentVaultTimeout, maxSessionTimeoutPolicyData),
+        ).pipe(
           tap((vaultTimeout: VaultTimeout) => {
+            this.logService.debug(
+              "[VaultTimeoutSettingsService] Determined vault timeout is %o for user id %s",
+              vaultTimeout,
+              userId,
+            );
+
             // As a side effect, set the new value determined by determineVaultTimeout into state if it's different from the current
             if (vaultTimeout !== currentVaultTimeout) {
               return this.stateProvider.setUserState(VAULT_TIMEOUT, vaultTimeout, userId);
@@ -155,28 +176,63 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
 
   private async determineVaultTimeout(
     currentVaultTimeout: VaultTimeout | null,
-    maxVaultTimeoutPolicy: Policy | null,
+    maxSessionTimeoutPolicyData: MaximumSessionTimeoutPolicyData | null,
   ): Promise<VaultTimeout | null> {
     // if current vault timeout is null, apply the client specific default
     currentVaultTimeout = currentVaultTimeout ?? this.defaultVaultTimeout;
 
     // If no policy applies, return the current vault timeout
-    if (!maxVaultTimeoutPolicy) {
+    if (maxSessionTimeoutPolicyData == null) {
       return currentVaultTimeout;
     }
 
-    // User is subject to a max vault timeout policy
-    const maxVaultTimeoutPolicyData = maxVaultTimeoutPolicy.data;
-
-    // If the current vault timeout is not numeric, change it to the policy compliant value
-    if (typeof currentVaultTimeout === "string") {
-      return maxVaultTimeoutPolicyData.minutes;
+    switch (maxSessionTimeoutPolicyData.type) {
+      case "immediately":
+        return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+          VaultTimeoutNumberType.Immediately,
+        );
+      case "custom":
+      case null:
+      case undefined:
+        if (currentVaultTimeout === VaultTimeoutNumberType.Immediately) {
+          return currentVaultTimeout;
+        }
+        if (isVaultTimeoutTypeNumeric(currentVaultTimeout)) {
+          return Math.min(currentVaultTimeout as number, maxSessionTimeoutPolicyData.minutes);
+        }
+        return maxSessionTimeoutPolicyData.minutes;
+      case "onSystemLock":
+        if (
+          currentVaultTimeout === VaultTimeoutStringType.Never ||
+          currentVaultTimeout === VaultTimeoutStringType.OnRestart ||
+          currentVaultTimeout === VaultTimeoutStringType.OnLocked ||
+          currentVaultTimeout === VaultTimeoutStringType.OnIdle ||
+          currentVaultTimeout === VaultTimeoutStringType.OnSleep
+        ) {
+          return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+            VaultTimeoutStringType.OnLocked,
+          );
+        }
+        break;
+      case "onAppRestart":
+        if (
+          currentVaultTimeout === VaultTimeoutStringType.Never ||
+          currentVaultTimeout === VaultTimeoutStringType.OnLocked ||
+          currentVaultTimeout === VaultTimeoutStringType.OnIdle ||
+          currentVaultTimeout === VaultTimeoutStringType.OnSleep
+        ) {
+          return VaultTimeoutStringType.OnRestart;
+        }
+        break;
+      case "never":
+        if (currentVaultTimeout === VaultTimeoutStringType.Never) {
+          return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+            VaultTimeoutStringType.Never,
+          );
+        }
+        break;
     }
-
-    // For numeric vault timeouts, ensure they are smaller than maximum allowed value according to policy
-    const policyCompliantTimeout = Math.min(currentVaultTimeout, maxVaultTimeoutPolicyData.minutes);
-
-    return policyCompliantTimeout;
+    return currentVaultTimeout;
   }
 
   private async setVaultTimeoutAction(userId: UserId, action: VaultTimeoutAction): Promise<void> {
@@ -198,14 +254,14 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
 
     return combineLatest([
       this.stateProvider.getUserState$(VAULT_TIMEOUT_ACTION, userId),
-      this.getMaxVaultTimeoutPolicyByUserId$(userId),
+      this.getMaxSessionTimeoutPolicyDataByUserId$(userId),
     ]).pipe(
-      switchMap(([currentVaultTimeoutAction, maxVaultTimeoutPolicy]) => {
+      switchMap(([currentVaultTimeoutAction, maxSessionTimeoutPolicyData]) => {
         return from(
           this.determineVaultTimeoutAction(
             userId,
             currentVaultTimeoutAction,
-            maxVaultTimeoutPolicy,
+            maxSessionTimeoutPolicyData,
           ),
         ).pipe(
           tap((vaultTimeoutAction: VaultTimeoutAction) => {
@@ -235,7 +291,7 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
   private async determineVaultTimeoutAction(
     userId: string,
     currentVaultTimeoutAction: VaultTimeoutAction | null,
-    maxVaultTimeoutPolicy: Policy | null,
+    maxSessionTimeoutPolicyData: MaximumSessionTimeoutPolicyData | null,
   ): Promise<VaultTimeoutAction> {
     const availableVaultTimeoutActions = await this.getAvailableVaultTimeoutActions(userId);
     if (availableVaultTimeoutActions.length === 1) {
@@ -243,11 +299,13 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     }
 
     if (
-      maxVaultTimeoutPolicy?.data?.action &&
-      availableVaultTimeoutActions.includes(maxVaultTimeoutPolicy.data.action)
+      maxSessionTimeoutPolicyData?.action &&
+      availableVaultTimeoutActions.includes(
+        maxSessionTimeoutPolicyData.action as VaultTimeoutAction,
+      )
     ) {
-      // return policy defined vault timeout action
-      return maxVaultTimeoutPolicy.data.action;
+      // return policy defined session timeout action
+      return maxSessionTimeoutPolicyData.action as VaultTimeoutAction;
     }
 
     // No policy applies from here on
@@ -262,14 +320,17 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     return currentVaultTimeoutAction;
   }
 
-  private getMaxVaultTimeoutPolicyByUserId$(userId: UserId): Observable<Policy | null> {
+  private getMaxSessionTimeoutPolicyDataByUserId$(
+    userId: UserId,
+  ): Observable<MaximumSessionTimeoutPolicyData | null> {
     if (!userId) {
-      throw new Error("User id required. Cannot get max vault timeout policy.");
+      throw new Error("User id required. Cannot get max session timeout policy.");
     }
 
-    return this.policyService
-      .policiesByType$(PolicyType.MaximumVaultTimeout, userId)
-      .pipe(getFirstPolicy);
+    return this.policyService.policiesByType$(PolicyType.MaximumVaultTimeout, userId).pipe(
+      getFirstPolicy,
+      map((policy) => (policy?.data ?? null) as MaximumSessionTimeoutPolicyData | null),
+    );
   }
 
   private async getAvailableVaultTimeoutActions(userId?: string): Promise<VaultTimeoutAction[]> {
diff --git a/libs/common/src/key-management/vault-timeout/types/maximum-vault-timeout-policy.type.ts b/libs/common/src/key-management/vault-timeout/types/maximum-vault-timeout-policy.type.ts
deleted file mode 100644
index c254e823fee..00000000000
--- a/libs/common/src/key-management/vault-timeout/types/maximum-vault-timeout-policy.type.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { VaultTimeoutAction } from "../enums/vault-timeout-action.enum";
-
-export interface MaximumVaultTimeoutPolicyData {
-  minutes: number;
-  action?: VaultTimeoutAction;
-}
diff --git a/libs/common/src/key-management/vault-timeout/types/vault-timeout.type.ts b/libs/common/src/key-management/vault-timeout/types/vault-timeout.type.ts
index e5a2e7f1820..a8757f6100e 100644
--- a/libs/common/src/key-management/vault-timeout/types/vault-timeout.type.ts
+++ b/libs/common/src/key-management/vault-timeout/types/vault-timeout.type.ts
@@ -5,13 +5,25 @@ export const VaultTimeoutStringType = {
   OnLocked: "onLocked", // -2
   OnSleep: "onSleep", // -3
   OnIdle: "onIdle", // -4
+  Custom: "custom", // -100
+} as const;
+
+export const VaultTimeoutNumberType = {
+  Immediately: 0,
+  OnMinute: 1,
+  EightHours: 480,
 } as const;
 
 export type VaultTimeout =
-  | number // 0 or positive numbers only
+  | (typeof VaultTimeoutNumberType)[keyof typeof VaultTimeoutNumberType]
+  | number // 0 or positive numbers (in minutes). See VaultTimeoutNumberType for common numeric presets
   | (typeof VaultTimeoutStringType)[keyof typeof VaultTimeoutStringType];
 
 export interface VaultTimeoutOption {
   name: string;
   value: VaultTimeout;
 }
+
+export function isVaultTimeoutTypeNumeric(timeout: VaultTimeout): boolean {
+  return typeof timeout === "number";
+}
diff --git a/libs/common/src/platform/abstractions/fido2/fido2-authenticator.service.abstraction.ts b/libs/common/src/platform/abstractions/fido2/fido2-authenticator.service.abstraction.ts
index c34c4b835cf..427266522e9 100644
--- a/libs/common/src/platform/abstractions/fido2/fido2-authenticator.service.abstraction.ts
+++ b/libs/common/src/platform/abstractions/fido2/fido2-authenticator.service.abstraction.ts
@@ -138,7 +138,7 @@ export interface Fido2AuthenticatorGetAssertionParams {
   rpId: string;
   /** The hash of the serialized client data, provided by the client. */
   hash: BufferSource;
-  allowCredentialDescriptorList: PublicKeyCredentialDescriptor[];
+  allowCredentialDescriptorList?: PublicKeyCredentialDescriptor[];
   /** The effective user verification requirement for assertion, a Boolean value provided by the client. */
   requireUserVerification: boolean;
   /** The constant Boolean value true. It is included here as a pseudo-parameter to simplify applying this abstract authenticator model to implementations that may wish to make a test of user presence optional although WebAuthn does not. */
diff --git a/libs/common/src/platform/abstractions/fido2/fido2-user-interface.service.abstraction.ts b/libs/common/src/platform/abstractions/fido2/fido2-user-interface.service.abstraction.ts
index 28b199da78f..b8be164c837 100644
--- a/libs/common/src/platform/abstractions/fido2/fido2-user-interface.service.abstraction.ts
+++ b/libs/common/src/platform/abstractions/fido2/fido2-user-interface.service.abstraction.ts
@@ -95,7 +95,7 @@ export abstract class Fido2UserInterfaceSession {
    */
   abstract confirmNewCredential(
     params: NewCredentialParams,
-  ): Promise<{ cipherId: string; userVerified: boolean }>;
+  ): Promise<{ cipherId?: string; userVerified: boolean }>;
 
   /**
    * Make sure that the vault is unlocked.
diff --git a/libs/common/src/platform/abstractions/sdk/sdk-load.service.ts b/libs/common/src/platform/abstractions/sdk/sdk-load.service.ts
index fb443d61777..946b9894d2b 100644
--- a/libs/common/src/platform/abstractions/sdk/sdk-load.service.ts
+++ b/libs/common/src/platform/abstractions/sdk/sdk-load.service.ts
@@ -1,4 +1,4 @@
-import { init_sdk } from "@bitwarden/sdk-internal";
+import { init_sdk, LogLevel } from "@bitwarden/sdk-internal";
 
 // eslint-disable-next-line @typescript-eslint/no-unused-vars -- used in docs
 import type { SdkService } from "./sdk.service";
@@ -10,6 +10,7 @@ export class SdkLoadFailedError extends Error {
 }
 
 export abstract class SdkLoadService {
+  protected static logLevel: LogLevel = LogLevel.Info;
   private static markAsReady: () => void;
   private static markAsFailed: (error: unknown) => void;
 
@@ -41,7 +42,7 @@ export abstract class SdkLoadService {
   async loadAndInit(): Promise<void> {
     try {
       await this.load();
-      init_sdk();
+      init_sdk(SdkLoadService.logLevel);
       SdkLoadService.markAsReady();
     } catch (error) {
       SdkLoadService.markAsFailed(error);
diff --git a/libs/common/src/platform/models/domain/domain-base.ts b/libs/common/src/platform/models/domain/domain-base.ts
index a144353f5bc..382ed5fea76 100644
--- a/libs/common/src/platform/models/domain/domain-base.ts
+++ b/libs/common/src/platform/models/domain/domain-base.ts
@@ -73,14 +73,13 @@ export default class Domain {
     domain: DomainEncryptableKeys<D>,
     viewModel: ViewEncryptableKeys<V>,
     props: EncryptableKeys<D, V>[],
-    orgId: string | null,
     key: SymmetricCryptoKey | null = null,
     objectContext: string = "No Domain Context",
   ): Promise<V> {
     for (const prop of props) {
       viewModel[prop] =
         (await domain[prop]?.decrypt(
-          orgId,
+          null,
           key,
           `Property: ${prop as string}; ObjectContext: ${objectContext}`,
         )) ?? null;
diff --git a/libs/common/src/platform/services/fido2/fido2-utils.spec.ts b/libs/common/src/platform/services/fido2/fido2-utils.spec.ts
index 9bb4ed0a4c5..6b34f772798 100644
--- a/libs/common/src/platform/services/fido2/fido2-utils.spec.ts
+++ b/libs/common/src/platform/services/fido2/fido2-utils.spec.ts
@@ -1,3 +1,9 @@
+import { mock } from "jest-mock-extended";
+
+import { CipherType } from "@bitwarden/common/vault/enums";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { Fido2CredentialView } from "@bitwarden/common/vault/models/view/fido2-credential.view";
+
 import { Fido2Utils } from "./fido2-utils";
 
 describe("Fido2 Utils", () => {
@@ -67,4 +73,62 @@ describe("Fido2 Utils", () => {
       expect(expectedArray).toBeNull();
     });
   });
+
+  describe("cipherHasNoOtherPasskeys(...)", () => {
+    const emptyPasskeyCipher = mock<CipherView>({
+      id: "id-5",
+      localData: { lastUsedDate: 222 },
+      name: "name-5",
+      type: CipherType.Login,
+      login: {
+        username: "username-5",
+        password: "password",
+        uri: "https://example.com",
+        fido2Credentials: [],
+      },
+    });
+
+    const passkeyCipher = mock<CipherView>({
+      id: "id-5",
+      localData: { lastUsedDate: 222 },
+      name: "name-5",
+      type: CipherType.Login,
+      login: {
+        username: "username-5",
+        password: "password",
+        uri: "https://example.com",
+        fido2Credentials: [
+          mock<Fido2CredentialView>({
+            credentialId: "credential-id",
+            rpName: "credential-name",
+            userHandle: "user-handle-1",
+            userName: "credential-username",
+            rpId: "jest-testing-website.com",
+          }),
+          mock<Fido2CredentialView>({
+            credentialId: "credential-id",
+            rpName: "credential-name",
+            userHandle: "user-handle-2",
+            userName: "credential-username",
+            rpId: "jest-testing-website.com",
+          }),
+        ],
+      },
+    });
+
+    it("should return true when there is no userHandle", () => {
+      const userHandle = "user-handle-1";
+      expect(Fido2Utils.cipherHasNoOtherPasskeys(emptyPasskeyCipher, userHandle)).toBeTruthy();
+    });
+
+    it("should return true when userHandle matches", () => {
+      const userHandle = "user-handle-1";
+      expect(Fido2Utils.cipherHasNoOtherPasskeys(passkeyCipher, userHandle)).toBeTruthy();
+    });
+
+    it("should return false when userHandle doesn't match", () => {
+      const userHandle = "testing";
+      expect(Fido2Utils.cipherHasNoOtherPasskeys(passkeyCipher, userHandle)).toBeFalsy();
+    });
+  });
 });
diff --git a/libs/common/src/platform/services/fido2/fido2-utils.ts b/libs/common/src/platform/services/fido2/fido2-utils.ts
index 99e260f4a53..8efd4734d81 100644
--- a/libs/common/src/platform/services/fido2/fido2-utils.ts
+++ b/libs/common/src/platform/services/fido2/fido2-utils.ts
@@ -1,3 +1,5 @@
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+
 // FIXME: Update this file to be type safe and remove this and next line
 import type {
   AssertCredentialResult,
@@ -111,4 +113,16 @@ export class Fido2Utils {
 
     return output;
   }
+
+  /**
+   * This methods returns true if a cipher either has no passkeys, or has a passkey matching with userHandle
+   * @param userHandle
+   */
+  static cipherHasNoOtherPasskeys(cipher: CipherView, userHandle: string): boolean {
+    if (cipher.login.fido2Credentials == null || cipher.login.fido2Credentials.length === 0) {
+      return true;
+    }
+
+    return cipher.login.fido2Credentials.some((passkey) => passkey.userHandle === userHandle);
+  }
 }
diff --git a/libs/common/src/platform/services/fido2/guid-utils.spec.ts b/libs/common/src/platform/services/fido2/guid-utils.spec.ts
index 098ea4bee75..c58bd2720fa 100644
--- a/libs/common/src/platform/services/fido2/guid-utils.spec.ts
+++ b/libs/common/src/platform/services/fido2/guid-utils.spec.ts
@@ -1,28 +1,63 @@
-import { guidToRawFormat } from "./guid-utils";
+import { guidToRawFormat, guidToStandardFormat } from "./guid-utils";
+
+const workingExamples: [string, Uint8Array][] = [
+  [
+    "00000000-0000-0000-0000-000000000000",
+    new Uint8Array([
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00,
+    ]),
+  ],
+  [
+    "08d70b74-e9f5-4522-a425-e5dcd40107e7",
+    new Uint8Array([
+      0x08, 0xd7, 0x0b, 0x74, 0xe9, 0xf5, 0x45, 0x22, 0xa4, 0x25, 0xe5, 0xdc, 0xd4, 0x01, 0x07,
+      0xe7,
+    ]),
+  ],
+];
 
 describe("guid-utils", () => {
   describe("guidToRawFormat", () => {
+    it.each(workingExamples)(
+      "returns UUID in binary format when given a valid UUID string",
+      (input, expected) => {
+        const result = guidToRawFormat(input);
+
+        expect(result).toEqual(expected);
+      },
+    );
+
     it.each([
-      [
-        "00000000-0000-0000-0000-000000000000",
-        [
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00,
-        ],
-        "08d70b74-e9f5-4522-a425-e5dcd40107e7",
-        [
-          0x08, 0xd7, 0x0b, 0x74, 0xe9, 0xf5, 0x45, 0x22, 0xa4, 0x25, 0xe5, 0xdc, 0xd4, 0x01, 0x07,
-          0xe7,
-        ],
-      ],
-    ])("returns UUID in binary format when given a valid UUID string", (input, expected) => {
-      const result = guidToRawFormat(input);
-
-      expect(result).toEqual(new Uint8Array(expected));
+      "invalid",
+      "",
+      "",
+      "00000000-0000-0000-0000-0000000000000000",
+      "00000000-0000-0000-0000-000000",
+    ])("throws an error when given an invalid UUID string", (input) => {
+      expect(() => guidToRawFormat(input)).toThrow(TypeError);
     });
+  });
 
-    it("throws an error when given an invalid UUID string", () => {
-      expect(() => guidToRawFormat("invalid")).toThrow(TypeError);
+  describe("guidToStandardFormat", () => {
+    it.each(workingExamples)(
+      "returns UUID in standard format when given a valid UUID array buffer",
+      (expected, input) => {
+        const result = guidToStandardFormat(input);
+
+        expect(result).toEqual(expected);
+      },
+    );
+
+    it.each([
+      new Uint8Array(),
+      new Uint8Array([]),
+      new Uint8Array([
+        0x08, 0xd7, 0x0b, 0x74, 0xe9, 0xf5, 0x45, 0x22, 0xa4, 0x25, 0xe5, 0xdc, 0xd4, 0x01, 0x07,
+        0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,
+      ]),
+    ])("throws an error when given an invalid UUID array buffer", (input) => {
+      expect(() => guidToStandardFormat(input)).toThrow(TypeError);
     });
   });
 });
diff --git a/libs/common/src/platform/services/fido2/guid-utils.ts b/libs/common/src/platform/services/fido2/guid-utils.ts
index 66e6cbb1d7c..e72fe84e930 100644
--- a/libs/common/src/platform/services/fido2/guid-utils.ts
+++ b/libs/common/src/platform/services/fido2/guid-utils.ts
@@ -53,6 +53,10 @@ export function guidToRawFormat(guid: string) {
 
 /** Convert raw 16 byte array to standard format (XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX) UUID. */
 export function guidToStandardFormat(bufferSource: BufferSource) {
+  if (bufferSource.byteLength !== 16) {
+    throw TypeError("BufferSource length is invalid");
+  }
+
   const arr =
     bufferSource instanceof ArrayBuffer
       ? new Uint8Array(bufferSource)
diff --git a/libs/common/src/platform/services/key-state/user-key.state.ts b/libs/common/src/platform/services/key-state/user-key.state.ts
index 2416c211d6b..64577768c8d 100644
--- a/libs/common/src/platform/services/key-state/user-key.state.ts
+++ b/libs/common/src/platform/services/key-state/user-key.state.ts
@@ -1,5 +1,5 @@
 import { EncryptedString } from "../../../key-management/crypto/models/enc-string";
-import { WrappedSigningKey } from "../../../key-management/types";
+import { SignedPublicKey, WrappedSigningKey } from "../../../key-management/types";
 import { UserKey } from "../../../types/key";
 import { SymmetricCryptoKey } from "../../models/domain/symmetric-crypto-key";
 import { CRYPTO_DISK, CRYPTO_MEMORY, UserKeyDefinition } from "../../state";
@@ -35,3 +35,12 @@ export const USER_KEY_ENCRYPTED_SIGNING_KEY = new UserKeyDefinition<WrappedSigni
     clearOn: ["logout"],
   },
 );
+
+export const USER_SIGNED_PUBLIC_KEY = new UserKeyDefinition<SignedPublicKey>(
+  CRYPTO_DISK,
+  "userSignedPublicKey",
+  {
+    deserializer: (obj) => obj,
+    clearOn: ["logout"],
+  },
+);
diff --git a/libs/common/src/platform/services/sdk/default-sdk.service.spec.ts b/libs/common/src/platform/services/sdk/default-sdk.service.spec.ts
index dc945594079..1286ea7b7f9 100644
--- a/libs/common/src/platform/services/sdk/default-sdk.service.spec.ts
+++ b/libs/common/src/platform/services/sdk/default-sdk.service.spec.ts
@@ -105,6 +105,7 @@ describe("DefaultSdkService", () => {
           .mockReturnValue(of("private-key" as EncryptedString));
         keyService.encryptedOrgKeys$.calledWith(userId).mockReturnValue(of({}));
         keyService.userSigningKey$.calledWith(userId).mockReturnValue(of(null));
+        keyService.userSignedPublicKey$.calledWith(userId).mockReturnValue(of(null));
         securityStateService.accountSecurityState$.calledWith(userId).mockReturnValue(of(null));
       });
 
diff --git a/libs/common/src/platform/services/sdk/default-sdk.service.ts b/libs/common/src/platform/services/sdk/default-sdk.service.ts
index 6e7bcbb197d..5084f5f5f18 100644
--- a/libs/common/src/platform/services/sdk/default-sdk.service.ts
+++ b/libs/common/src/platform/services/sdk/default-sdk.service.ts
@@ -16,6 +16,7 @@ import {
 } from "rxjs";
 
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { UserKey } from "@bitwarden/common/types/key";
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import { KeyService, KdfConfigService, KdfConfig, KdfType } from "@bitwarden/key-management";
@@ -24,15 +25,14 @@ import {
   ClientSettings,
   TokenProvider,
   UnsignedSharedKey,
+  WrappedAccountCryptographicState,
 } from "@bitwarden/sdk-internal";
 
 import { ApiService } from "../../../abstractions/api.service";
 import { AccountInfo, AccountService } from "../../../auth/abstractions/account.service";
-import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
+import { EncString } from "../../../key-management/crypto/models/enc-string";
 import { SecurityStateService } from "../../../key-management/security-state/abstractions/security-state.service";
-import { SignedSecurityState, WrappedSigningKey } from "../../../key-management/types";
 import { OrganizationId, UserId } from "../../../types/guid";
-import { UserKey } from "../../../types/key";
 import { Environment, EnvironmentService } from "../../abstractions/environment.service";
 import { PlatformUtilsService } from "../../abstractions/platform-utils.service";
 import { SdkClientFactory } from "../../abstractions/sdk/sdk-client-factory";
@@ -174,6 +174,9 @@ export class DefaultSdkService implements SdkService {
     const securityState$ = this.securityStateService
       .accountSecurityState$(userId)
       .pipe(distinctUntilChanged(compareValues));
+    const signedPublicKey$ = this.keyService
+      .userSignedPublicKey$(userId)
+      .pipe(distinctUntilChanged(compareValues));
 
     const client$ = combineLatest([
       this.environmentService.getEnvironment$(userId),
@@ -184,11 +187,22 @@ export class DefaultSdkService implements SdkService {
       signingKey$,
       orgKeys$,
       securityState$,
+      signedPublicKey$,
       SdkLoadService.Ready, // Makes sure we wait (once) for the SDK to be loaded
     ]).pipe(
       // switchMap is required to allow the clean-up logic to be executed when `combineLatest` emits a new value.
       switchMap(
-        ([env, account, kdfParams, privateKey, userKey, signingKey, orgKeys, securityState]) => {
+        ([
+          env,
+          account,
+          kdfParams,
+          privateKey,
+          userKey,
+          signingKey,
+          orgKeys,
+          securityState,
+          signedPublicKey,
+        ]) => {
           // Create our own observable to be able to implement clean-up logic
           return new Observable<Rc<PasswordManagerClient>>((subscriber) => {
             const createAndInitializeClient = async () => {
@@ -202,15 +216,31 @@ export class DefaultSdkService implements SdkService {
                 settings,
               );
 
+              let accountCryptographicState: WrappedAccountCryptographicState;
+              if (signingKey != null && securityState != null && signedPublicKey != null) {
+                accountCryptographicState = {
+                  V2: {
+                    private_key: privateKey,
+                    signing_key: signingKey,
+                    security_state: securityState,
+                    signed_public_key: signedPublicKey,
+                  },
+                };
+              } else {
+                accountCryptographicState = {
+                  V1: {
+                    private_key: privateKey,
+                  },
+                };
+              }
+
               await this.initializeClient(
                 userId,
                 client,
                 account,
                 kdfParams,
-                privateKey,
                 userKey,
-                signingKey,
-                securityState,
+                accountCryptographicState,
                 orgKeys,
               );
 
@@ -245,10 +275,8 @@ export class DefaultSdkService implements SdkService {
     client: PasswordManagerClient,
     account: AccountInfo,
     kdfParams: KdfConfig,
-    privateKey: EncryptedString,
     userKey: UserKey,
-    signingKey: WrappedSigningKey | null,
-    securityState: SignedSecurityState | null,
+    accountCryptographicState: WrappedAccountCryptographicState,
     orgKeys: Record<OrganizationId, EncString>,
   ) {
     await client.crypto().initialize_user_crypto({
@@ -265,9 +293,7 @@ export class DefaultSdkService implements SdkService {
                 parallelism: kdfParams.parallelism,
               },
             },
-      privateKey,
-      signingKey: signingKey || undefined,
-      securityState: securityState || undefined,
+      accountCryptographicState: accountCryptographicState,
     });
 
     // We initialize the org crypto even if the org_keys are
diff --git a/libs/common/src/platform/sync/default-sync.service.ts b/libs/common/src/platform/sync/default-sync.service.ts
index e599fbc1c48..910702bddd0 100644
--- a/libs/common/src/platform/sync/default-sync.service.ts
+++ b/libs/common/src/platform/sync/default-sync.service.ts
@@ -253,6 +253,10 @@ export class DefaultSyncService extends CoreSyncService {
           response.accountKeys.securityState.securityState,
           response.id,
         );
+        await this.keyService.setSignedPublicKey(
+          response.accountKeys.publicKeyEncryptionKeyPair.signedPublicKey,
+          response.id,
+        );
       }
     } else {
       await this.keyService.setPrivateKey(response.privateKey, response.id);
diff --git a/libs/common/src/services/api.service.ts b/libs/common/src/services/api.service.ts
index 5f4d3de11b5..c60f6c5e907 100644
--- a/libs/common/src/services/api.service.ts
+++ b/libs/common/src/services/api.service.ts
@@ -63,6 +63,7 @@ import { UpdateProfileRequest } from "../auth/models/request/update-profile.requ
 import { ApiKeyResponse } from "../auth/models/response/api-key.response";
 import { AuthRequestResponse } from "../auth/models/response/auth-request.response";
 import { IdentityDeviceVerificationResponse } from "../auth/models/response/identity-device-verification.response";
+import { IdentitySsoRequiredResponse } from "../auth/models/response/identity-sso-required.response";
 import { IdentityTokenResponse } from "../auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "../auth/models/response/identity-two-factor.response";
 import { KeyConnectorUserKeyResponse } from "../auth/models/response/key-connector-user-key.response";
@@ -165,7 +166,10 @@ export class ApiService implements ApiServiceAbstraction {
       | SsoTokenRequest
       | WebAuthnLoginTokenRequest,
   ): Promise<
-    IdentityTokenResponse | IdentityTwoFactorResponse | IdentityDeviceVerificationResponse
+    | IdentityTokenResponse
+    | IdentityTwoFactorResponse
+    | IdentityDeviceVerificationResponse
+    | IdentitySsoRequiredResponse
   > {
     const headers = new Headers({
       "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
@@ -212,6 +216,8 @@ export class ApiService implements ApiServiceAbstraction {
         responseJson?.ErrorModel?.Message === ApiService.NEW_DEVICE_VERIFICATION_REQUIRED_MESSAGE
       ) {
         return new IdentityDeviceVerificationResponse(responseJson);
+      } else if (response.status === 400 && responseJson?.SsoOrganizationIdentifier) {
+        return new IdentitySsoRequiredResponse(responseJson);
       }
     }
 
diff --git a/libs/common/src/services/audit.service.spec.ts b/libs/common/src/services/audit.service.spec.ts
index b0e96eb5c5c..e653b026735 100644
--- a/libs/common/src/services/audit.service.spec.ts
+++ b/libs/common/src/services/audit.service.spec.ts
@@ -1,7 +1,6 @@
 import { ApiService } from "../abstractions/api.service";
 import { HibpApiService } from "../dirt/services/hibp-api.service";
 import { CryptoFunctionService } from "../key-management/crypto/abstractions/crypto-function.service";
-import { ErrorResponse } from "../models/response/error.response";
 
 import { AuditService } from "./audit.service";
 
@@ -73,14 +72,16 @@ describe("AuditService", () => {
     expect(mockApi.nativeFetch).toHaveBeenCalledTimes(4);
   });
 
-  it("should return empty array for breachedAccounts on 404", async () => {
-    mockHibpApi.getHibpBreach.mockRejectedValueOnce({ statusCode: 404 } as ErrorResponse);
+  it("should return empty array for breachedAccounts when no breaches found", async () => {
+    // Server returns 200 with empty array (correct REST semantics)
+    mockHibpApi.getHibpBreach.mockResolvedValueOnce([]);
     const result = await auditService.breachedAccounts("user@example.com");
     expect(result).toEqual([]);
   });
 
-  it("should throw error for breachedAccounts on non-404 error", async () => {
-    mockHibpApi.getHibpBreach.mockRejectedValueOnce({ statusCode: 500 } as ErrorResponse);
-    await expect(auditService.breachedAccounts("user@example.com")).rejects.toThrow();
+  it("should propagate errors from breachedAccounts", async () => {
+    const error = new Error("API error");
+    mockHibpApi.getHibpBreach.mockRejectedValueOnce(error);
+    await expect(auditService.breachedAccounts("user@example.com")).rejects.toBe(error);
   });
 });
diff --git a/libs/common/src/services/audit.service.ts b/libs/common/src/services/audit.service.ts
index 0bdf45917de..7762c2cbd93 100644
--- a/libs/common/src/services/audit.service.ts
+++ b/libs/common/src/services/audit.service.ts
@@ -6,7 +6,6 @@ import { AuditService as AuditServiceAbstraction } from "../abstractions/audit.s
 import { BreachAccountResponse } from "../dirt/models/response/breach-account.response";
 import { HibpApiService } from "../dirt/services/hibp-api.service";
 import { CryptoFunctionService } from "../key-management/crypto/abstractions/crypto-function.service";
-import { ErrorResponse } from "../models/response/error.response";
 import { Utils } from "../platform/misc/utils";
 
 const PwnedPasswordsApi = "https://api.pwnedpasswords.com/range/";
@@ -70,14 +69,6 @@ export class AuditService implements AuditServiceAbstraction {
   }
 
   async breachedAccounts(username: string): Promise<BreachAccountResponse[]> {
-    try {
-      return await this.hibpApiService.getHibpBreach(username);
-    } catch (e) {
-      const error = e as ErrorResponse;
-      if (error.statusCode === 404) {
-        return [];
-      }
-      throw new Error();
-    }
+    return this.hibpApiService.getHibpBreach(username);
   }
 }
diff --git a/libs/common/src/tools/send/models/domain/send-access.spec.ts b/libs/common/src/tools/send/models/domain/send-access.spec.ts
index 597208d517c..686236bff8e 100644
--- a/libs/common/src/tools/send/models/domain/send-access.spec.ts
+++ b/libs/common/src/tools/send/models/domain/send-access.spec.ts
@@ -1,6 +1,6 @@
 import { mock } from "jest-mock-extended";
 
-import { mockEnc } from "../../../../../spec";
+import { mockContainerService, mockEnc } from "../../../../../spec";
 import { SendType } from "../../enums/send-type";
 import { SendAccessResponse } from "../response/send-access.response";
 
@@ -23,6 +23,8 @@ describe("SendAccess", () => {
       expirationDate: new Date("2022-01-31T12:00:00.000Z"),
       creatorIdentifier: "creatorIdentifier",
     } as SendAccessResponse;
+
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/tools/send/models/domain/send-access.ts b/libs/common/src/tools/send/models/domain/send-access.ts
index 2251e8e5a5a..68d1af7b57e 100644
--- a/libs/common/src/tools/send/models/domain/send-access.ts
+++ b/libs/common/src/tools/send/models/domain/send-access.ts
@@ -54,7 +54,7 @@ export class SendAccess extends Domain {
   async decrypt(key: SymmetricCryptoKey): Promise<SendAccessView> {
     const model = new SendAccessView(this);
 
-    await this.decryptObj<SendAccess, SendAccessView>(this, model, ["name"], null, key);
+    await this.decryptObj<SendAccess, SendAccessView>(this, model, ["name"], key);
 
     switch (this.type) {
       case SendType.File:
diff --git a/libs/common/src/tools/send/models/domain/send-file.spec.ts b/libs/common/src/tools/send/models/domain/send-file.spec.ts
index 44a84cdc639..f60767e9bdf 100644
--- a/libs/common/src/tools/send/models/domain/send-file.spec.ts
+++ b/libs/common/src/tools/send/models/domain/send-file.spec.ts
@@ -1,4 +1,4 @@
-import { mockEnc } from "../../../../../spec";
+import { mockContainerService, mockEnc } from "../../../../../spec";
 import { SendFileData } from "../data/send-file.data";
 
 import { SendFile } from "./send-file";
@@ -39,6 +39,7 @@ describe("SendFile", () => {
   });
 
   it("Decrypt", async () => {
+    mockContainerService();
     const sendFile = new SendFile();
     sendFile.id = "id";
     sendFile.size = "1100";
diff --git a/libs/common/src/tools/send/models/domain/send-file.ts b/libs/common/src/tools/send/models/domain/send-file.ts
index 228f4ee81ca..d01f30a1905 100644
--- a/libs/common/src/tools/send/models/domain/send-file.ts
+++ b/libs/common/src/tools/send/models/domain/send-file.ts
@@ -38,7 +38,6 @@ export class SendFile extends Domain {
       this,
       new SendFileView(this),
       ["fileName"],
-      null,
       key,
     );
   }
diff --git a/libs/common/src/tools/send/models/domain/send-text.spec.ts b/libs/common/src/tools/send/models/domain/send-text.spec.ts
index 6af143ec594..bac2687c897 100644
--- a/libs/common/src/tools/send/models/domain/send-text.spec.ts
+++ b/libs/common/src/tools/send/models/domain/send-text.spec.ts
@@ -1,4 +1,4 @@
-import { mockEnc } from "../../../../../spec";
+import { mockContainerService, mockEnc } from "../../../../../spec";
 import { SendTextData } from "../data/send-text.data";
 
 import { SendText } from "./send-text";
@@ -11,6 +11,8 @@ describe("SendText", () => {
       text: "encText",
       hidden: false,
     };
+
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/tools/send/models/domain/send-text.ts b/libs/common/src/tools/send/models/domain/send-text.ts
index 321810292ad..34a0be52dcb 100644
--- a/libs/common/src/tools/send/models/domain/send-text.ts
+++ b/libs/common/src/tools/send/models/domain/send-text.ts
@@ -30,13 +30,7 @@ export class SendText extends Domain {
   }
 
   decrypt(key: SymmetricCryptoKey): Promise<SendTextView> {
-    return this.decryptObj<SendText, SendTextView>(
-      this,
-      new SendTextView(this),
-      ["text"],
-      null,
-      key,
-    );
+    return this.decryptObj<SendText, SendTextView>(this, new SendTextView(this), ["text"], key);
   }
 
   static fromJSON(obj: Jsonify<SendText>) {
diff --git a/libs/common/src/tools/send/models/domain/send.spec.ts b/libs/common/src/tools/send/models/domain/send.spec.ts
index d465aa97924..dc9ca7d3444 100644
--- a/libs/common/src/tools/send/models/domain/send.spec.ts
+++ b/libs/common/src/tools/send/models/domain/send.spec.ts
@@ -6,7 +6,7 @@ import { emptyGuid, UserId } from "@bitwarden/common/types/guid";
 // eslint-disable-next-line no-restricted-imports
 import { KeyService } from "@bitwarden/key-management";
 
-import { makeStaticByteArray, mockEnc } from "../../../../../spec";
+import { makeStaticByteArray, mockContainerService, mockEnc } from "../../../../../spec";
 import { EncryptService } from "../../../../key-management/crypto/abstractions/encrypt.service";
 import { SymmetricCryptoKey } from "../../../../platform/models/domain/symmetric-crypto-key";
 import { ContainerService } from "../../../../platform/services/container.service";
@@ -43,6 +43,8 @@ describe("Send", () => {
       disabled: false,
       hideEmail: true,
     };
+
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/tools/send/models/domain/send.ts b/libs/common/src/tools/send/models/domain/send.ts
index 48129d4314a..2bf16de8a44 100644
--- a/libs/common/src/tools/send/models/domain/send.ts
+++ b/libs/common/src/tools/send/models/domain/send.ts
@@ -89,7 +89,7 @@ export class Send extends Domain {
     model.key = await encryptService.decryptBytes(this.key, sendKeyEncryptionKey);
     model.cryptoKey = await keyService.makeSendKey(model.key);
 
-    await this.decryptObj<Send, SendView>(this, model, ["name", "notes"], null, model.cryptoKey);
+    await this.decryptObj<Send, SendView>(this, model, ["name", "notes"], model.cryptoKey);
 
     switch (this.type) {
       case SendType.File:
diff --git a/libs/common/src/types/key.ts b/libs/common/src/types/key.ts
index 46dcc14a8b2..3c5487b30e0 100644
--- a/libs/common/src/types/key.ts
+++ b/libs/common/src/types/key.ts
@@ -9,8 +9,6 @@ export type PrfKey = Opaque<SymmetricCryptoKey, "PrfKey">;
 export type UserKey = Opaque<SymmetricCryptoKey, "UserKey">;
 /** @deprecated Interacting with the master key directly is prohibited. Use a high level function from MasterPasswordService instead. */
 export type MasterKey = Opaque<SymmetricCryptoKey, "MasterKey">;
-/** @deprecated */
-export type PinKey = Opaque<SymmetricCryptoKey, "PinKey">;
 export type OrgKey = Opaque<SymmetricCryptoKey, "OrgKey">;
 export type ProviderKey = Opaque<SymmetricCryptoKey, "ProviderKey">;
 export type CipherKey = Opaque<SymmetricCryptoKey, "CipherKey">;
diff --git a/libs/common/src/vault/abstractions/cipher-archive.service.ts b/libs/common/src/vault/abstractions/cipher-archive.service.ts
index d33fc5e7cc7..0969b7de1ac 100644
--- a/libs/common/src/vault/abstractions/cipher-archive.service.ts
+++ b/libs/common/src/vault/abstractions/cipher-archive.service.ts
@@ -4,10 +4,11 @@ import { CipherId, UserId } from "@bitwarden/common/types/guid";
 import { CipherViewLike } from "@bitwarden/common/vault/utils/cipher-view-like-utils";
 
 export abstract class CipherArchiveService {
-  abstract hasArchiveFlagEnabled$(): Observable<boolean>;
+  abstract hasArchiveFlagEnabled$: Observable<boolean>;
   abstract archivedCiphers$(userId: UserId): Observable<CipherViewLike[]>;
   abstract userCanArchive$(userId: UserId): Observable<boolean>;
-  abstract showArchiveVault$(userId: UserId): Observable<boolean>;
+  abstract userHasPremium$(userId: UserId): Observable<boolean>;
   abstract archiveWithServer(ids: CipherId | CipherId[], userId: UserId): Promise<void>;
   abstract unarchiveWithServer(ids: CipherId | CipherId[], userId: UserId): Promise<void>;
+  abstract showSubscriptionEndedMessaging$(userId: UserId): Observable<boolean>;
 }
diff --git a/libs/common/src/vault/abstractions/cipher-encryption.service.ts b/libs/common/src/vault/abstractions/cipher-encryption.service.ts
index 6057a91bae5..fdd42c0acf2 100644
--- a/libs/common/src/vault/abstractions/cipher-encryption.service.ts
+++ b/libs/common/src/vault/abstractions/cipher-encryption.service.ts
@@ -67,7 +67,10 @@ export abstract class CipherEncryptionService {
    *
    * @returns A promise that resolves to an array of decrypted cipher views
    */
-  abstract decryptManyLegacy(ciphers: Cipher[], userId: UserId): Promise<CipherView[]>;
+  abstract decryptManyLegacy(
+    ciphers: Cipher[],
+    userId: UserId,
+  ): Promise<[CipherView[], CipherView[]]>;
   /**
    * Decrypts many ciphers using the SDK for the given userId, and returns a list of
    * failures.
diff --git a/libs/common/src/vault/abstractions/cipher.service.ts b/libs/common/src/vault/abstractions/cipher.service.ts
index 9aefd960b2f..8472a359c51 100644
--- a/libs/common/src/vault/abstractions/cipher.service.ts
+++ b/libs/common/src/vault/abstractions/cipher.service.ts
@@ -68,6 +68,7 @@ export abstract class CipherService implements UserKeyRotationDataProvider<Ciphe
     /** When true, will override the match strategy for the cipher if it is Never. */
     overrideNeverMatchStrategy?: true,
   ): Promise<CipherView[]>;
+  abstract getAllDecryptedForIds(userId: UserId, ids: string[]): Promise<CipherView[]>;
   abstract filterCiphersForUrl<C extends CipherViewLike = CipherView>(
     ciphers: C[],
     url: string,
@@ -160,6 +161,17 @@ export abstract class CipherService implements UserKeyRotationDataProvider<Ciphe
     userId: UserId,
     admin?: boolean,
   ): Promise<Cipher>;
+  /**
+   * Upgrade all old attachments for a cipher by downloading, decrypting, re-uploading with new key, and deleting old.
+   * @param cipher - The cipher with old attachments to upgrade
+   * @param userId - The user ID
+   * @param attachmentId - If provided, only upgrade the attachment with this ID
+   */
+  abstract upgradeOldCipherAttachments(
+    cipher: CipherView,
+    userId: UserId,
+    attachmentId?: string,
+  ): Promise<CipherView>;
   /**
    * Save the collections for a cipher with the server
    *
@@ -273,7 +285,7 @@ export abstract class CipherService implements UserKeyRotationDataProvider<Ciphe
     response: Response,
     userId: UserId,
     useLegacyDecryption?: boolean,
-  ): Promise<Uint8Array | null>;
+  ): Promise<Uint8Array>;
 
   /**
    * Decrypts the full `CipherView` for a given `CipherViewLike`.
diff --git a/libs/common/src/vault/models/domain/attachment.spec.ts b/libs/common/src/vault/models/domain/attachment.spec.ts
index 77bb3eda38d..3c97e3b4213 100644
--- a/libs/common/src/vault/models/domain/attachment.spec.ts
+++ b/libs/common/src/vault/models/domain/attachment.spec.ts
@@ -4,12 +4,10 @@ import { mock, MockProxy } from "jest-mock-extended";
 // eslint-disable-next-line no-restricted-imports
 import { KeyService } from "@bitwarden/key-management";
 
-import { makeStaticByteArray, mockEnc, mockFromJson } from "../../../../spec";
+import { makeStaticByteArray, mockContainerService, mockEnc, mockFromJson } from "../../../../spec";
 import { EncryptService } from "../../../key-management/crypto/abstractions/encrypt.service";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
-import { ContainerService } from "../../../platform/services/container.service";
-import { OrgKey, UserKey } from "../../../types/key";
 import { AttachmentData } from "../../models/data/attachment.data";
 import { Attachment } from "../../models/domain/attachment";
 
@@ -70,10 +68,9 @@ describe("Attachment", () => {
     let encryptService: MockProxy<EncryptService>;
 
     beforeEach(() => {
-      keyService = mock<KeyService>();
-      encryptService = mock<EncryptService>();
-
-      (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
+      const containerService = mockContainerService();
+      keyService = containerService.keyService as MockProxy<KeyService>;
+      encryptService = containerService.encryptService as MockProxy<EncryptService>;
     });
 
     it("expected output", async () => {
@@ -85,14 +82,13 @@ describe("Attachment", () => {
       attachment.key = mockEnc("key");
       attachment.fileName = mockEnc("fileName");
 
-      const userKey = new SymmetricCryptoKey(makeStaticByteArray(64));
-      keyService.getUserKey.mockResolvedValue(userKey as UserKey);
       encryptService.decryptFileData.mockResolvedValue(makeStaticByteArray(32));
       encryptService.unwrapSymmetricKey.mockResolvedValue(
         new SymmetricCryptoKey(makeStaticByteArray(64)),
       );
 
-      const view = await attachment.decrypt(null);
+      const userKey = new SymmetricCryptoKey(makeStaticByteArray(64));
+      const view = await attachment.decrypt(userKey);
 
       expect(view).toEqual({
         id: "id",
@@ -116,31 +112,11 @@ describe("Attachment", () => {
       it("uses the provided key without depending on KeyService", async () => {
         const providedKey = mock<SymmetricCryptoKey>();
 
-        await attachment.decrypt(null, "", providedKey);
+        await attachment.decrypt(providedKey, "");
 
         expect(keyService.getUserKey).not.toHaveBeenCalled();
         expect(encryptService.unwrapSymmetricKey).toHaveBeenCalledWith(attachment.key, providedKey);
       });
-
-      it("gets an organization key if required", async () => {
-        const orgKey = mock<OrgKey>();
-        keyService.getOrgKey.calledWith("orgId").mockResolvedValue(orgKey);
-
-        await attachment.decrypt("orgId", "", null);
-
-        expect(keyService.getOrgKey).toHaveBeenCalledWith("orgId");
-        expect(encryptService.unwrapSymmetricKey).toHaveBeenCalledWith(attachment.key, orgKey);
-      });
-
-      it("gets the user's decryption key if required", async () => {
-        const userKey = mock<UserKey>();
-        keyService.getUserKey.mockResolvedValue(userKey);
-
-        await attachment.decrypt(null, "", null);
-
-        expect(keyService.getUserKey).toHaveBeenCalled();
-        expect(encryptService.unwrapSymmetricKey).toHaveBeenCalledWith(attachment.key, userKey);
-      });
     });
   });
 
diff --git a/libs/common/src/vault/models/domain/attachment.ts b/libs/common/src/vault/models/domain/attachment.ts
index 7b43af9be55..d9dfa128028 100644
--- a/libs/common/src/vault/models/domain/attachment.ts
+++ b/libs/common/src/vault/models/domain/attachment.ts
@@ -1,6 +1,5 @@
 import { Jsonify } from "type-fest";
 
-import { OrgKey, UserKey } from "@bitwarden/common/types/key";
 import { Attachment as SdkAttachment } from "@bitwarden/sdk-internal";
 
 import { EncString } from "../../../key-management/crypto/models/enc-string";
@@ -34,21 +33,19 @@ export class Attachment extends Domain {
   }
 
   async decrypt(
-    orgId: string | undefined,
+    decryptionKey: SymmetricCryptoKey,
     context = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
   ): Promise<AttachmentView> {
     const view = await this.decryptObj<Attachment, AttachmentView>(
       this,
       new AttachmentView(this),
       ["fileName"],
-      orgId ?? null,
-      encKey,
+      decryptionKey,
       "DomainType: Attachment; " + context,
     );
 
     if (this.key != null) {
-      view.key = await this.decryptAttachmentKey(orgId, encKey);
+      view.key = await this.decryptAttachmentKey(decryptionKey);
       view.encryptedKey = this.key; // Keep the encrypted key for the view
     }
 
@@ -56,27 +53,15 @@ export class Attachment extends Domain {
   }
 
   private async decryptAttachmentKey(
-    orgId: string | undefined,
-    encKey?: SymmetricCryptoKey,
+    decryptionKey: SymmetricCryptoKey,
   ): Promise<SymmetricCryptoKey | undefined> {
     try {
       if (this.key == null) {
         return undefined;
       }
 
-      if (encKey == null) {
-        const key = await this.getKeyForDecryption(orgId);
-
-        // If we don't have a key, we can't decrypt
-        if (key == null) {
-          return undefined;
-        }
-
-        encKey = key;
-      }
-
       const encryptService = Utils.getContainerService().getEncryptService();
-      const decValue = await encryptService.unwrapSymmetricKey(this.key, encKey);
+      const decValue = await encryptService.unwrapSymmetricKey(this.key, decryptionKey);
       return decValue;
     } catch (e) {
       // eslint-disable-next-line no-console
@@ -85,11 +70,6 @@ export class Attachment extends Domain {
     }
   }
 
-  private async getKeyForDecryption(orgId: string | undefined): Promise<OrgKey | UserKey | null> {
-    const keyService = Utils.getContainerService().getKeyService();
-    return orgId != null ? await keyService.getOrgKey(orgId) : await keyService.getUserKey();
-  }
-
   toAttachmentData(): AttachmentData {
     const a = new AttachmentData();
     if (this.size != null) {
diff --git a/libs/common/src/vault/models/domain/card.spec.ts b/libs/common/src/vault/models/domain/card.spec.ts
index 185c2fa4b8f..1dfda7be359 100644
--- a/libs/common/src/vault/models/domain/card.spec.ts
+++ b/libs/common/src/vault/models/domain/card.spec.ts
@@ -1,4 +1,9 @@
-import { mockEnc, mockFromJson } from "../../../../spec";
+import {
+  makeSymmetricCryptoKey,
+  mockContainerService,
+  mockEnc,
+  mockFromJson,
+} from "../../../../spec";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { CardData } from "../../../vault/models/data/card.data";
 import { Card } from "../../models/domain/card";
@@ -65,7 +70,10 @@ describe("Card", () => {
     card.expYear = mockEnc("expYear");
     card.code = mockEnc("code");
 
-    const view = await card.decrypt(null);
+    const userKey = makeSymmetricCryptoKey(64);
+
+    mockContainerService();
+    const view = await card.decrypt(userKey);
 
     expect(view).toEqual({
       _brand: "brand",
diff --git a/libs/common/src/vault/models/domain/card.ts b/libs/common/src/vault/models/domain/card.ts
index b3a087d44fb..2d636e8e265 100644
--- a/libs/common/src/vault/models/domain/card.ts
+++ b/libs/common/src/vault/models/domain/card.ts
@@ -31,16 +31,11 @@ export class Card extends Domain {
     this.code = conditionalEncString(obj.code);
   }
 
-  async decrypt(
-    orgId: string | undefined,
-    context = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
-  ): Promise<CardView> {
+  async decrypt(encKey: SymmetricCryptoKey, context = "No Cipher Context"): Promise<CardView> {
     return this.decryptObj<Card, CardView>(
       this,
       new CardView(),
       ["cardholderName", "brand", "number", "expMonth", "expYear", "code"],
-      orgId ?? null,
       encKey,
       "DomainType: Card; " + context,
     );
diff --git a/libs/common/src/vault/models/domain/cipher.spec.ts b/libs/common/src/vault/models/domain/cipher.spec.ts
index 87301928c57..4fe5e89451c 100644
--- a/libs/common/src/vault/models/domain/cipher.spec.ts
+++ b/libs/common/src/vault/models/domain/cipher.spec.ts
@@ -2,9 +2,7 @@ import { mock } from "jest-mock-extended";
 import { Jsonify } from "type-fest";
 
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { KeyService } from "@bitwarden/key-management";
+import { MockProxy } from "@bitwarden/common/platform/spec/mock-deep";
 import {
   CipherType as SdkCipherType,
   UriMatchType,
@@ -14,11 +12,15 @@ import {
   EncString as SdkEncString,
 } from "@bitwarden/sdk-internal";
 
-import { makeStaticByteArray, mockEnc, mockFromJson } from "../../../../spec/utils";
+import {
+  makeStaticByteArray,
+  mockContainerService,
+  mockEnc,
+  mockFromJson,
+} from "../../../../spec/utils";
 import { EncryptService } from "../../../key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "../../../key-management/crypto/models/enc-string";
 import { UriMatchStrategy } from "../../../models/domain/domain-service";
-import { ContainerService } from "../../../platform/services/container.service";
 import { InitializerKey } from "../../../platform/services/cryptography/initializer-key";
 import { UserId } from "../../../types/guid";
 import { CipherService } from "../../abstractions/cipher.service";
@@ -39,7 +41,16 @@ import { IdentityView } from "../../models/view/identity.view";
 import { LoginView } from "../../models/view/login.view";
 import { CipherPermissionsApi } from "../api/cipher-permissions.api";
 
+const mockSymmetricKey = new SymmetricCryptoKey(makeStaticByteArray(64));
+
 describe("Cipher DTO", () => {
+  let encryptService: MockProxy<EncryptService>;
+
+  beforeEach(() => {
+    const containerService = mockContainerService();
+    encryptService = containerService.encryptService;
+  });
+
   it("Convert from empty CipherData", () => {
     const data = new CipherData();
     const cipher = new Cipher(data);
@@ -95,13 +106,12 @@ describe("Cipher DTO", () => {
     login.decrypt.mockResolvedValue(loginView);
     cipher.login = login;
 
-    const keyService = mock<KeyService>();
-    const encryptService = mock<EncryptService>();
     const cipherService = mock<CipherService>();
 
     encryptService.unwrapSymmetricKey.mockRejectedValue(new Error("Failed to unwrap key"));
-
-    (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
+    cipherService.getKeyForCipherKeyDecryption.mockResolvedValue(
+      new SymmetricCryptoKey(makeStaticByteArray(64)),
+    );
 
     const cipherView = await cipher.decrypt(
       await cipherService.getKeyForCipherKeyDecryption(cipher, mockUserId),
@@ -317,19 +327,11 @@ describe("Cipher DTO", () => {
       login.decrypt.mockResolvedValue(loginView);
       cipher.login = login;
 
-      const keyService = mock<KeyService>();
-      const encryptService = mock<EncryptService>();
-      const cipherService = mock<CipherService>();
-
       encryptService.unwrapSymmetricKey.mockResolvedValue(
         new SymmetricCryptoKey(makeStaticByteArray(64)),
       );
 
-      (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-      const cipherView = await cipher.decrypt(
-        await cipherService.getKeyForCipherKeyDecryption(cipher, mockUserId),
-      );
+      const cipherView = await cipher.decrypt(mockSymmetricKey);
 
       expect(cipherView).toMatchObject({
         id: "id",
@@ -445,19 +447,11 @@ describe("Cipher DTO", () => {
       cipher.permissions = new CipherPermissionsApi();
       cipher.archivedDate = undefined;
 
-      const keyService = mock<KeyService>();
-      const encryptService = mock<EncryptService>();
-      const cipherService = mock<CipherService>();
-
       encryptService.unwrapSymmetricKey.mockResolvedValue(
         new SymmetricCryptoKey(makeStaticByteArray(64)),
       );
 
-      (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-      const cipherView = await cipher.decrypt(
-        await cipherService.getKeyForCipherKeyDecryption(cipher, mockUserId),
-      );
+      const cipherView = await cipher.decrypt(mockSymmetricKey);
 
       expect(cipherView).toMatchObject({
         id: "id",
@@ -591,19 +585,11 @@ describe("Cipher DTO", () => {
       card.decrypt.mockResolvedValue(cardView);
       cipher.card = card;
 
-      const keyService = mock<KeyService>();
-      const encryptService = mock<EncryptService>();
-      const cipherService = mock<CipherService>();
-
       encryptService.unwrapSymmetricKey.mockResolvedValue(
         new SymmetricCryptoKey(makeStaticByteArray(64)),
       );
 
-      (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-      const cipherView = await cipher.decrypt(
-        await cipherService.getKeyForCipherKeyDecryption(cipher, mockUserId),
-      );
+      const cipherView = await cipher.decrypt(mockSymmetricKey);
 
       expect(cipherView).toMatchObject({
         id: "id",
@@ -761,19 +747,11 @@ describe("Cipher DTO", () => {
       identity.decrypt.mockResolvedValue(identityView);
       cipher.identity = identity;
 
-      const keyService = mock<KeyService>();
-      const encryptService = mock<EncryptService>();
-      const cipherService = mock<CipherService>();
-
       encryptService.unwrapSymmetricKey.mockResolvedValue(
         new SymmetricCryptoKey(makeStaticByteArray(64)),
       );
 
-      (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-      const cipherView = await cipher.decrypt(
-        await cipherService.getKeyForCipherKeyDecryption(cipher, mockUserId),
-      );
+      const cipherView = await cipher.decrypt(mockSymmetricKey);
 
       expect(cipherView).toMatchObject({
         id: "id",
diff --git a/libs/common/src/vault/models/domain/cipher.ts b/libs/common/src/vault/models/domain/cipher.ts
index abddb73422b..850952364ca 100644
--- a/libs/common/src/vault/models/domain/cipher.ts
+++ b/libs/common/src/vault/models/domain/cipher.ts
@@ -1,5 +1,6 @@
 import { Jsonify } from "type-fest";
 
+import { assertNonNullish } from "@bitwarden/common/auth/utils";
 import { Cipher as SdkCipher } from "@bitwarden/sdk-internal";
 
 import { EncString } from "../../../key-management/crypto/models/enc-string";
@@ -123,19 +124,22 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
     }
   }
 
-  // We are passing the organizationId into the EncString.decrypt() method here, but because the encKey will always be
-  // present and so the organizationId will not be used.
-  // We will refactor the EncString.decrypt() in https://bitwarden.atlassian.net/browse/PM-3762 to remove the dependency on the organizationId.
-  async decrypt(encKey: SymmetricCryptoKey): Promise<CipherView> {
+  async decrypt(userKeyOrOrgKey: SymmetricCryptoKey): Promise<CipherView> {
+    assertNonNullish(userKeyOrOrgKey, "userKeyOrOrgKey", "Cipher decryption");
+
     const model = new CipherView(this);
     let bypassValidation = true;
 
+    // By default, the user/organization key is used for decryption
+    let cipherDecryptionKey = userKeyOrOrgKey;
+
+    // If there is a cipher key present, unwrap it and use it for decryption
     if (this.key != null) {
       const encryptService = Utils.getContainerService().getEncryptService();
 
       try {
-        const cipherKey = await encryptService.unwrapSymmetricKey(this.key, encKey);
-        encKey = cipherKey;
+        const cipherKey = await encryptService.unwrapSymmetricKey(this.key, userKeyOrOrgKey);
+        cipherDecryptionKey = cipherKey;
         bypassValidation = false;
       } catch {
         model.name = "[error: cannot decrypt]";
@@ -144,22 +148,15 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       }
     }
 
-    await this.decryptObj<Cipher, CipherView>(
-      this,
-      model,
-      ["name", "notes"],
-      this.organizationId ?? null,
-      encKey,
-    );
+    await this.decryptObj<Cipher, CipherView>(this, model, ["name", "notes"], cipherDecryptionKey);
 
     switch (this.type) {
       case CipherType.Login:
         if (this.login != null) {
           model.login = await this.login.decrypt(
-            this.organizationId,
             bypassValidation,
+            cipherDecryptionKey,
             `Cipher Id: ${this.id}`,
-            encKey,
           );
         }
         break;
@@ -170,29 +167,20 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
         break;
       case CipherType.Card:
         if (this.card != null) {
-          model.card = await this.card.decrypt(
-            this.organizationId,
-            `Cipher Id: ${this.id}`,
-            encKey,
-          );
+          model.card = await this.card.decrypt(cipherDecryptionKey, `Cipher Id: ${this.id}`);
         }
         break;
       case CipherType.Identity:
         if (this.identity != null) {
           model.identity = await this.identity.decrypt(
-            this.organizationId,
+            cipherDecryptionKey,
             `Cipher Id: ${this.id}`,
-            encKey,
           );
         }
         break;
       case CipherType.SshKey:
         if (this.sshKey != null) {
-          model.sshKey = await this.sshKey.decrypt(
-            this.organizationId,
-            `Cipher Id: ${this.id}`,
-            encKey,
-          );
+          model.sshKey = await this.sshKey.decrypt(cipherDecryptionKey, `Cipher Id: ${this.id}`);
         }
         break;
       default:
@@ -203,9 +191,8 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       const attachments: AttachmentView[] = [];
       for (const attachment of this.attachments) {
         const decryptedAttachment = await attachment.decrypt(
-          this.organizationId,
+          cipherDecryptionKey,
           `Cipher Id: ${this.id}`,
-          encKey,
         );
         attachments.push(decryptedAttachment);
       }
@@ -215,7 +202,7 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
     if (this.fields != null && this.fields.length > 0) {
       const fields: FieldView[] = [];
       for (const field of this.fields) {
-        const decryptedField = await field.decrypt(this.organizationId, encKey);
+        const decryptedField = await field.decrypt(cipherDecryptionKey);
         fields.push(decryptedField);
       }
       model.fields = fields;
@@ -224,7 +211,7 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
     if (this.passwordHistory != null && this.passwordHistory.length > 0) {
       const passwordHistory: PasswordHistoryView[] = [];
       for (const ph of this.passwordHistory) {
-        const decryptedPh = await ph.decrypt(this.organizationId, encKey);
+        const decryptedPh = await ph.decrypt(cipherDecryptionKey);
         passwordHistory.push(decryptedPh);
       }
       model.passwordHistory = passwordHistory;
diff --git a/libs/common/src/vault/models/domain/fido2-credential.spec.ts b/libs/common/src/vault/models/domain/fido2-credential.spec.ts
index 3f43775433e..05504ea5666 100644
--- a/libs/common/src/vault/models/domain/fido2-credential.spec.ts
+++ b/libs/common/src/vault/models/domain/fido2-credential.spec.ts
@@ -1,4 +1,4 @@
-import { mockEnc } from "../../../../spec";
+import { makeSymmetricCryptoKey, mockContainerService, mockEnc } from "../../../../spec";
 import { EncString } from "../../../key-management/crypto/models/enc-string";
 import { EncryptionType } from "../../../platform/enums";
 import { Fido2CredentialData } from "../data/fido2-credential.data";
@@ -103,7 +103,10 @@ describe("Fido2Credential", () => {
       credential.discoverable = mockEnc("true");
       credential.creationDate = mockDate;
 
-      const credentialView = await credential.decrypt(null);
+      mockContainerService();
+
+      const cipherKey = makeSymmetricCryptoKey(64);
+      const credentialView = await credential.decrypt(cipherKey);
 
       expect(credentialView).toEqual({
         credentialId: "credentialId",
diff --git a/libs/common/src/vault/models/domain/fido2-credential.ts b/libs/common/src/vault/models/domain/fido2-credential.ts
index eff95c4d0bd..5123b965c85 100644
--- a/libs/common/src/vault/models/domain/fido2-credential.ts
+++ b/libs/common/src/vault/models/domain/fido2-credential.ts
@@ -46,10 +46,7 @@ export class Fido2Credential extends Domain {
     this.creationDate = new Date(obj.creationDate);
   }
 
-  async decrypt(
-    orgId: string | undefined,
-    encKey?: SymmetricCryptoKey,
-  ): Promise<Fido2CredentialView> {
+  async decrypt(decryptionKey: SymmetricCryptoKey): Promise<Fido2CredentialView> {
     const view = await this.decryptObj<Fido2Credential, Fido2CredentialView>(
       this,
       new Fido2CredentialView(),
@@ -65,8 +62,7 @@ export class Fido2Credential extends Domain {
         "rpName",
         "userDisplayName",
       ],
-      orgId ?? null,
-      encKey,
+      decryptionKey,
     );
 
     const { counter } = await this.decryptObj<
@@ -74,7 +70,7 @@ export class Fido2Credential extends Domain {
       {
         counter: string;
       }
-    >(this, { counter: "" }, ["counter"], orgId ?? null, encKey);
+    >(this, { counter: "" }, ["counter"], decryptionKey);
     // Counter will end up as NaN if this fails
     view.counter = parseInt(counter);
 
@@ -82,8 +78,7 @@ export class Fido2Credential extends Domain {
       this,
       { discoverable: "" },
       ["discoverable"],
-      orgId ?? null,
-      encKey,
+      decryptionKey,
     );
     view.discoverable = discoverable === "true";
     view.creationDate = this.creationDate;
diff --git a/libs/common/src/vault/models/domain/field.spec.ts b/libs/common/src/vault/models/domain/field.spec.ts
index 0a4bc8e3c29..bcaccbcf369 100644
--- a/libs/common/src/vault/models/domain/field.spec.ts
+++ b/libs/common/src/vault/models/domain/field.spec.ts
@@ -6,7 +6,7 @@ import {
   IdentityLinkedIdType,
 } from "@bitwarden/sdk-internal";
 
-import { mockEnc, mockFromJson } from "../../../../spec";
+import { mockContainerService, mockEnc, mockFromJson } from "../../../../spec";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { CardLinkedId, IdentityLinkedId, LoginLinkedId } from "../../enums";
 import { FieldData } from "../../models/data/field.data";
@@ -22,6 +22,7 @@ describe("Field", () => {
       value: "encValue",
       linkedId: null,
     };
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/vault/models/domain/field.ts b/libs/common/src/vault/models/domain/field.ts
index adec9263515..d61a2dbd82c 100644
--- a/libs/common/src/vault/models/domain/field.ts
+++ b/libs/common/src/vault/models/domain/field.ts
@@ -33,14 +33,8 @@ export class Field extends Domain {
     this.value = conditionalEncString(obj.value);
   }
 
-  decrypt(orgId: string | undefined, encKey?: SymmetricCryptoKey): Promise<FieldView> {
-    return this.decryptObj<Field, FieldView>(
-      this,
-      new FieldView(this),
-      ["name", "value"],
-      orgId ?? null,
-      encKey,
-    );
+  decrypt(encKey: SymmetricCryptoKey): Promise<FieldView> {
+    return this.decryptObj<Field, FieldView>(this, new FieldView(this), ["name", "value"], encKey);
   }
 
   toFieldData(): FieldData {
diff --git a/libs/common/src/vault/models/domain/folder.spec.ts b/libs/common/src/vault/models/domain/folder.spec.ts
index a837fbb2726..d9e9e265d91 100644
--- a/libs/common/src/vault/models/domain/folder.spec.ts
+++ b/libs/common/src/vault/models/domain/folder.spec.ts
@@ -1,6 +1,12 @@
 import { mock, MockProxy } from "jest-mock-extended";
 
-import { makeEncString, makeSymmetricCryptoKey, mockEnc, mockFromJson } from "../../../../spec";
+import {
+  makeEncString,
+  makeSymmetricCryptoKey,
+  mockContainerService,
+  mockEnc,
+  mockFromJson,
+} from "../../../../spec";
 import { EncryptService } from "../../../key-management/crypto/abstractions/encrypt.service";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { FolderData } from "../../models/data/folder.data";
@@ -15,6 +21,7 @@ describe("Folder", () => {
       name: "encName",
       revisionDate: "2022-01-31T12:00:00.000Z",
     };
+    mockContainerService();
   });
 
   it("Convert", () => {
@@ -33,7 +40,7 @@ describe("Folder", () => {
     folder.name = mockEnc("encName");
     folder.revisionDate = new Date("2022-01-31T12:00:00.000Z");
 
-    const view = await folder.decrypt();
+    const view = await folder.decrypt(null);
 
     expect(view).toEqual({
       id: "id",
diff --git a/libs/common/src/vault/models/domain/folder.ts b/libs/common/src/vault/models/domain/folder.ts
index 50c67eee01f..c336095f15d 100644
--- a/libs/common/src/vault/models/domain/folder.ts
+++ b/libs/common/src/vault/models/domain/folder.ts
@@ -39,8 +39,8 @@ export class Folder extends Domain {
     this.revisionDate = obj.revisionDate != null ? new Date(obj.revisionDate) : null;
   }
 
-  decrypt(): Promise<FolderView> {
-    return this.decryptObj<Folder, FolderView>(this, new FolderView(this), ["name"], null);
+  decrypt(key: SymmetricCryptoKey): Promise<FolderView> {
+    return this.decryptObj<Folder, FolderView>(this, new FolderView(this), ["name"], key);
   }
 
   async decryptWithKey(
diff --git a/libs/common/src/vault/models/domain/identity.spec.ts b/libs/common/src/vault/models/domain/identity.spec.ts
index 411f6d1c9ea..1e3bdc15373 100644
--- a/libs/common/src/vault/models/domain/identity.spec.ts
+++ b/libs/common/src/vault/models/domain/identity.spec.ts
@@ -1,4 +1,4 @@
-import { mockEnc, mockFromJson } from "../../../../spec";
+import { mockContainerService, mockEnc, mockFromJson } from "../../../../spec";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { IdentityData } from "../../models/data/identity.data";
 import { Identity } from "../../models/domain/identity";
@@ -27,6 +27,8 @@ describe("Identity", () => {
       passportNumber: "encpassportNumber",
       licenseNumber: "enclicenseNumber",
     };
+
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/vault/models/domain/identity.ts b/libs/common/src/vault/models/domain/identity.ts
index e2def3eb386..5424dda1502 100644
--- a/libs/common/src/vault/models/domain/identity.ts
+++ b/libs/common/src/vault/models/domain/identity.ts
@@ -56,9 +56,8 @@ export class Identity extends Domain {
   }
 
   decrypt(
-    orgId: string | undefined,
+    encKey: SymmetricCryptoKey,
     context: string = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
   ): Promise<IdentityView> {
     return this.decryptObj<Identity, IdentityView>(
       this,
@@ -83,7 +82,6 @@ export class Identity extends Domain {
         "passportNumber",
         "licenseNumber",
       ],
-      orgId ?? null,
       encKey,
       "DomainType: Identity; " + context,
     );
diff --git a/libs/common/src/vault/models/domain/login-uri.spec.ts b/libs/common/src/vault/models/domain/login-uri.spec.ts
index 2effd1bb9fe..ecdb1bbe00b 100644
--- a/libs/common/src/vault/models/domain/login-uri.spec.ts
+++ b/libs/common/src/vault/models/domain/login-uri.spec.ts
@@ -1,9 +1,14 @@
-import { MockProxy, mock } from "jest-mock-extended";
+import { MockProxy } from "jest-mock-extended";
 import { Jsonify } from "type-fest";
 
 import { UriMatchType } from "@bitwarden/sdk-internal";
 
-import { mockEnc, mockFromJson } from "../../../../spec";
+import {
+  makeSymmetricCryptoKey,
+  mockContainerService,
+  mockEnc,
+  mockFromJson,
+} from "../../../../spec";
 import { EncryptService } from "../../../key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "../../../key-management/crypto/models/enc-string";
 import { UriMatchStrategy } from "../../../models/domain/domain-service";
@@ -14,6 +19,7 @@ import { LoginUri } from "./login-uri";
 
 describe("LoginUri", () => {
   let data: LoginUriData;
+  let encryptService: MockProxy<EncryptService>;
 
   beforeEach(() => {
     data = {
@@ -21,6 +27,9 @@ describe("LoginUri", () => {
       uriChecksum: "encUriChecksum",
       match: UriMatchStrategy.Domain,
     };
+
+    const containerService = mockContainerService();
+    encryptService = containerService.getEncryptService();
   });
 
   it("Convert from empty", () => {
@@ -83,22 +92,13 @@ describe("LoginUri", () => {
   });
 
   describe("validateChecksum", () => {
-    let encryptService: MockProxy<EncryptService>;
-
-    beforeEach(() => {
-      encryptService = mock();
-      global.bitwardenContainerService = {
-        getEncryptService: () => encryptService,
-        getKeyService: () => null,
-      };
-    });
-
     it("returns true if checksums match", async () => {
       const loginUri = new LoginUri();
       loginUri.uriChecksum = mockEnc("checksum");
       encryptService.hash.mockResolvedValue("checksum");
 
-      const actual = await loginUri.validateChecksum("uri", undefined, undefined);
+      const key = makeSymmetricCryptoKey(64);
+      const actual = await loginUri.validateChecksum("uri", key);
 
       expect(actual).toBe(true);
       expect(encryptService.hash).toHaveBeenCalledWith("uri", "sha256");
@@ -109,7 +109,7 @@ describe("LoginUri", () => {
       loginUri.uriChecksum = mockEnc("checksum");
       encryptService.hash.mockResolvedValue("incorrect checksum");
 
-      const actual = await loginUri.validateChecksum("uri", undefined, undefined);
+      const actual = await loginUri.validateChecksum("uri", undefined);
 
       expect(actual).toBe(false);
     });
diff --git a/libs/common/src/vault/models/domain/login-uri.ts b/libs/common/src/vault/models/domain/login-uri.ts
index 42acca25d6f..e784d10dbd7 100644
--- a/libs/common/src/vault/models/domain/login-uri.ts
+++ b/libs/common/src/vault/models/domain/login-uri.ts
@@ -31,29 +31,27 @@ export class LoginUri extends Domain {
   }
 
   decrypt(
-    orgId: string | undefined,
+    encKey: SymmetricCryptoKey,
     context: string = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
   ): Promise<LoginUriView> {
     return this.decryptObj<LoginUri, LoginUriView>(
       this,
       new LoginUriView(this),
       ["uri"],
-      orgId ?? null,
       encKey,
       context,
     );
   }
 
-  async validateChecksum(clearTextUri: string, orgId?: string, encKey?: SymmetricCryptoKey) {
+  async validateChecksum(clearTextUri: string, encKey: SymmetricCryptoKey) {
     if (this.uriChecksum == null) {
       return false;
     }
 
-    const keyService = Utils.getContainerService().getEncryptService();
-    const localChecksum = await keyService.hash(clearTextUri, "sha256");
+    const encryptService = Utils.getContainerService().getEncryptService();
+    const localChecksum = await encryptService.hash(clearTextUri, "sha256");
 
-    const remoteChecksum = await this.uriChecksum.decrypt(orgId ?? null, encKey);
+    const remoteChecksum = await encryptService.decryptString(this.uriChecksum, encKey);
     return remoteChecksum === localChecksum;
   }
 
diff --git a/libs/common/src/vault/models/domain/login.spec.ts b/libs/common/src/vault/models/domain/login.spec.ts
index 6ebcfea057a..fbacd912c60 100644
--- a/libs/common/src/vault/models/domain/login.spec.ts
+++ b/libs/common/src/vault/models/domain/login.spec.ts
@@ -1,6 +1,6 @@
 import { MockProxy, mock } from "jest-mock-extended";
 
-import { mockEnc, mockFromJson } from "../../../../spec";
+import { mockContainerService, mockEnc, mockFromJson } from "../../../../spec";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { UriMatchStrategy } from "../../../models/domain/domain-service";
 import { LoginData } from "../../models/data/login.data";
@@ -14,6 +14,10 @@ import { Fido2CredentialView } from "../view/fido2-credential.view";
 import { Fido2Credential } from "./fido2-credential";
 
 describe("Login DTO", () => {
+  beforeEach(() => {
+    mockContainerService();
+  });
+
   it("Convert from empty LoginData", () => {
     const data = new LoginData();
     const login = new Login(data);
@@ -107,7 +111,7 @@ describe("Login DTO", () => {
       loginUri.validateChecksum.mockResolvedValue(true);
       login.uris = [loginUri];
 
-      const loginView = await login.decrypt(null, true);
+      const loginView = await login.decrypt(true, null);
       expect(loginView).toEqual(expectedView);
     });
 
@@ -119,7 +123,7 @@ describe("Login DTO", () => {
         .mockResolvedValueOnce(true);
       login.uris = [loginUri, loginUri, loginUri];
 
-      const loginView = await login.decrypt(null, false);
+      const loginView = await login.decrypt(false, null);
       expect(loginView).toEqual(expectedView);
     });
   });
diff --git a/libs/common/src/vault/models/domain/login.ts b/libs/common/src/vault/models/domain/login.ts
index a9cec13fc7c..830fc48b7d1 100644
--- a/libs/common/src/vault/models/domain/login.ts
+++ b/libs/common/src/vault/models/domain/login.ts
@@ -44,16 +44,14 @@ export class Login extends Domain {
   }
 
   async decrypt(
-    orgId: string | undefined,
     bypassValidation: boolean,
+    encKey: SymmetricCryptoKey,
     context: string = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
   ): Promise<LoginView> {
     const view = await this.decryptObj<Login, LoginView>(
       this,
       new LoginView(this),
       ["username", "password", "totp"],
-      orgId ?? null,
       encKey,
       `DomainType: Login; ${context}`,
     );
@@ -66,7 +64,7 @@ export class Login extends Domain {
           continue;
         }
 
-        const uri = await this.uris[i].decrypt(orgId, context, encKey);
+        const uri = await this.uris[i].decrypt(encKey, context);
         const uriString = uri.uri;
 
         if (uriString == null) {
@@ -79,7 +77,7 @@ export class Login extends Domain {
         // So we bypass the validation if there's no cipher.key or proceed with the validation and
         // Skip the value if it's been tampered with.
         const isValidUri =
-          bypassValidation || (await this.uris[i].validateChecksum(uriString, orgId, encKey));
+          bypassValidation || (await this.uris[i].validateChecksum(uriString, encKey));
 
         if (isValidUri) {
           view.uris.push(uri);
@@ -89,7 +87,7 @@ export class Login extends Domain {
 
     if (this.fido2Credentials != null) {
       view.fido2Credentials = await Promise.all(
-        this.fido2Credentials.map((key) => key.decrypt(orgId, encKey)),
+        this.fido2Credentials.map((key) => key.decrypt(encKey)),
       );
     }
 
diff --git a/libs/common/src/vault/models/domain/password.spec.ts b/libs/common/src/vault/models/domain/password.spec.ts
index 4b2de34beca..fe9918972c4 100644
--- a/libs/common/src/vault/models/domain/password.spec.ts
+++ b/libs/common/src/vault/models/domain/password.spec.ts
@@ -1,4 +1,4 @@
-import { mockEnc, mockFromJson } from "../../../../spec";
+import { mockContainerService, mockEnc, mockFromJson } from "../../../../spec";
 import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { PasswordHistoryData } from "../../models/data/password-history.data";
 import { Password } from "../../models/domain/password";
@@ -11,6 +11,7 @@ describe("Password", () => {
       password: "encPassword",
       lastUsedDate: "2022-01-31T12:00:00.000Z",
     };
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/vault/models/domain/password.ts b/libs/common/src/vault/models/domain/password.ts
index 84e8919b905..960fd3d5e52 100644
--- a/libs/common/src/vault/models/domain/password.ts
+++ b/libs/common/src/vault/models/domain/password.ts
@@ -22,12 +22,11 @@ export class Password extends Domain {
     this.lastUsedDate = new Date(obj.lastUsedDate);
   }
 
-  decrypt(orgId: string | undefined, encKey?: SymmetricCryptoKey): Promise<PasswordHistoryView> {
+  decrypt(encKey: SymmetricCryptoKey): Promise<PasswordHistoryView> {
     return this.decryptObj<Password, PasswordHistoryView>(
       this,
       new PasswordHistoryView(this),
       ["password"],
-      orgId ?? null,
       encKey,
       "DomainType: PasswordHistory",
     );
diff --git a/libs/common/src/vault/models/domain/secure-note.spec.ts b/libs/common/src/vault/models/domain/secure-note.spec.ts
index e445e9ea035..c5746d8f8e7 100644
--- a/libs/common/src/vault/models/domain/secure-note.spec.ts
+++ b/libs/common/src/vault/models/domain/secure-note.spec.ts
@@ -1,3 +1,4 @@
+import { mockContainerService } from "../../../../spec";
 import { SecureNoteType } from "../../enums";
 import { SecureNoteData } from "../data/secure-note.data";
 
@@ -10,6 +11,8 @@ describe("SecureNote", () => {
     data = {
       type: SecureNoteType.Generic,
     };
+
+    mockContainerService();
   });
 
   it("Convert from empty", () => {
diff --git a/libs/common/src/vault/models/domain/ssh-key.spec.ts b/libs/common/src/vault/models/domain/ssh-key.spec.ts
index 10149ebc82d..c4ecc1e54f6 100644
--- a/libs/common/src/vault/models/domain/ssh-key.spec.ts
+++ b/libs/common/src/vault/models/domain/ssh-key.spec.ts
@@ -1,7 +1,7 @@
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { EncString as SdkEncString, SshKey as SdkSshKey } from "@bitwarden/sdk-internal";
 
-import { mockEnc } from "../../../../spec";
+import { mockContainerService, mockEnc } from "../../../../spec";
 import { SshKeyApi } from "../api/ssh-key.api";
 import { SshKeyData } from "../data/ssh-key.data";
 
@@ -18,6 +18,8 @@ describe("Sshkey", () => {
         KeyFingerprint: "keyFingerprint",
       }),
     );
+
+    mockContainerService();
   });
 
   it("Convert", () => {
diff --git a/libs/common/src/vault/models/domain/ssh-key.ts b/libs/common/src/vault/models/domain/ssh-key.ts
index a7028321a44..dc9a23403a8 100644
--- a/libs/common/src/vault/models/domain/ssh-key.ts
+++ b/libs/common/src/vault/models/domain/ssh-key.ts
@@ -24,16 +24,11 @@ export class SshKey extends Domain {
     this.keyFingerprint = new EncString(obj.keyFingerprint);
   }
 
-  decrypt(
-    orgId: string | undefined,
-    context = "No Cipher Context",
-    encKey?: SymmetricCryptoKey,
-  ): Promise<SshKeyView> {
+  decrypt(encKey: SymmetricCryptoKey, context = "No Cipher Context"): Promise<SshKeyView> {
     return this.decryptObj<SshKey, SshKeyView>(
       this,
       new SshKeyView(),
       ["privateKey", "publicKey", "keyFingerprint"],
-      orgId ?? null,
       encKey,
       "DomainType: SshKey; " + context,
     );
diff --git a/libs/common/src/vault/models/view/cipher.view.ts b/libs/common/src/vault/models/view/cipher.view.ts
index 0d4ab8e5207..db360f7f991 100644
--- a/libs/common/src/vault/models/view/cipher.view.ts
+++ b/libs/common/src/vault/models/view/cipher.view.ts
@@ -166,10 +166,6 @@ export class CipherView implements View, InitializerMetadata {
   }
 
   get canAssignToCollections(): boolean {
-    if (this.isArchived) {
-      return false;
-    }
-
     if (this.organizationId == null) {
       return true;
     }
diff --git a/libs/common/src/vault/services/cipher.service.spec.ts b/libs/common/src/vault/services/cipher.service.spec.ts
index 85ce8bd0423..50823807fcf 100644
--- a/libs/common/src/vault/services/cipher.service.spec.ts
+++ b/libs/common/src/vault/services/cipher.service.spec.ts
@@ -55,7 +55,7 @@ const ENCRYPTED_BYTES = mock<EncArrayBuffer>();
 
 const cipherData: CipherData = {
   id: "id",
-  organizationId: "orgId",
+  organizationId: "4ff8c0b2-1d3e-4f8c-9b2d-1d3e4f8c0b2" as OrganizationId,
   folderId: "folderId",
   edit: true,
   viewPassword: true,
@@ -119,6 +119,8 @@ describe("Cipher Service", () => {
   beforeEach(() => {
     encryptService.encryptFileData.mockReturnValue(Promise.resolve(ENCRYPTED_BYTES));
     encryptService.encryptString.mockReturnValue(Promise.resolve(new EncString(ENCRYPTED_TEXT)));
+    keyService.orgKeys$.mockReturnValue(of({ [orgId]: makeSymmetricCryptoKey(32) as OrgKey }));
+    keyService.userKey$.mockReturnValue(of(makeSymmetricCryptoKey(64) as UserKey));
 
     // Mock i18nService collator
     i18nService.collator = {
@@ -181,9 +183,6 @@ describe("Cipher Service", () => {
       const testCipher = new Cipher(cipherData);
       const expectedRevisionDate = "2022-01-31T12:00:00.000Z";
 
-      keyService.getOrgKey.mockReturnValue(
-        Promise.resolve<any>(new SymmetricCryptoKey(new Uint8Array(32)) as OrgKey),
-      );
       keyService.makeDataEncKey.mockReturnValue(
         Promise.resolve([
           new SymmetricCryptoKey(new Uint8Array(32)),
@@ -807,7 +806,7 @@ describe("Cipher Service", () => {
 
       // Set up expected results
       const expectedSuccessCipherViews = [
-        { id: mockCiphers[0].id, name: "Success 1" } as unknown as CipherListView,
+        { id: mockCiphers[0].id, name: "Success 1", decryptionFailure: false } as CipherView,
       ];
 
       const expectedFailedCipher = new CipherView(mockCiphers[1]);
@@ -815,6 +814,11 @@ describe("Cipher Service", () => {
       expectedFailedCipher.decryptionFailure = true;
       const expectedFailedCipherViews = [expectedFailedCipher];
 
+      cipherEncryptionService.decryptManyLegacy.mockResolvedValue([
+        expectedSuccessCipherViews,
+        expectedFailedCipherViews,
+      ]);
+
       // Execute
       const [successes, failures] = await (cipherService as any).decryptCiphers(
         mockCiphers,
@@ -822,10 +826,7 @@ describe("Cipher Service", () => {
       );
 
       // Verify the SDK was used for decryption
-      expect(cipherEncryptionService.decryptManyWithFailures).toHaveBeenCalledWith(
-        mockCiphers,
-        userId,
-      );
+      expect(cipherEncryptionService.decryptManyLegacy).toHaveBeenCalledWith(mockCiphers, userId);
 
       expect(successes).toEqual(expectedSuccessCipherViews);
       expect(failures).toEqual(expectedFailedCipherViews);
diff --git a/libs/common/src/vault/services/cipher.service.ts b/libs/common/src/vault/services/cipher.service.ts
index 72c1ca40913..402b8ed1030 100644
--- a/libs/common/src/vault/services/cipher.service.ts
+++ b/libs/common/src/vault/services/cipher.service.ts
@@ -165,7 +165,9 @@ export class CipherService implements CipherServiceAbstraction {
           }),
           switchMap(async (ciphers) => {
             const [decrypted, failures] = await this.decryptCiphersWithSdk(ciphers, userId, false);
-            await this.setFailedDecryptedCiphers(failures, userId);
+            void this.setFailedDecryptedCiphers(failures, userId);
+            // Trigger full decryption and indexing in background
+            void this.getAllDecrypted(userId);
             return decrypted;
           }),
           tap((decrypted) => {
@@ -634,6 +636,15 @@ export class CipherService implements CipherServiceAbstraction {
     );
   }
 
+  async getAllDecryptedForIds(userId: UserId, ids: string[]): Promise<CipherView[]> {
+    return firstValueFrom(
+      this.cipherViews$(userId).pipe(
+        filter((ciphers) => ciphers != null),
+        map((ciphers) => ciphers.filter((cipher) => ids.includes(cipher.id))),
+      ),
+    );
+  }
+
   async filterCiphersForUrl<C extends CipherViewLike>(
     ciphers: C[],
     url: string,
@@ -1553,10 +1564,15 @@ export class CipherService implements CipherServiceAbstraction {
   }
 
   async getKeyForCipherKeyDecryption(cipher: Cipher, userId: UserId): Promise<UserKey | OrgKey> {
-    return (
-      (await this.keyService.getOrgKey(cipher.organizationId)) ||
-      ((await this.keyService.getUserKey(userId)) as UserKey)
-    );
+    if (cipher.organizationId == null) {
+      return await firstValueFrom(this.keyService.userKey$(userId));
+    } else {
+      return await firstValueFrom(
+        this.keyService
+          .orgKeys$(userId)
+          .pipe(map((orgKeys) => orgKeys[cipher.organizationId as OrganizationId] as OrgKey)),
+      );
+    }
   }
 
   async setAddEditCipherInfo(value: AddEditCipherInfo, userId: UserId) {
@@ -1640,12 +1656,14 @@ export class CipherService implements CipherServiceAbstraction {
     const key =
       attachment.key != null
         ? attachment.key
-        : await firstValueFrom(
-            this.keyService.orgKeys$(userId).pipe(
-              filterOutNullish(),
-              map((orgKeys) => orgKeys[cipherDomain.organizationId as OrganizationId] as OrgKey),
-            ),
-          );
+        : cipherDomain.organizationId
+          ? await firstValueFrom(
+              this.keyService.orgKeys$(userId).pipe(
+                filterOutNullish(),
+                map((orgKeys) => orgKeys[cipherDomain.organizationId as OrganizationId] as OrgKey),
+              ),
+            )
+          : await firstValueFrom(this.keyService.userKey$(userId).pipe(filterOutNullish()));
     return await this.encryptService.decryptFileData(encBuf, key);
   }
 
@@ -1813,6 +1831,95 @@ export class CipherService implements CipherServiceAbstraction {
     }
   }
 
+  /**
+   * Upgrade all old attachments for a cipher by downloading, decrypting, re-uploading with new key, and deleting old.
+   * @param cipher
+   * @param userId
+   * @param attachmentId Optional specific attachment ID to upgrade. If not provided, all old attachments will be upgraded.
+   */
+  async upgradeOldCipherAttachments(
+    cipher: CipherView,
+    userId: UserId,
+    attachmentId?: string,
+  ): Promise<CipherView> {
+    if (!cipher.hasOldAttachments) {
+      return cipher;
+    }
+
+    let cipherDomain = await this.get(cipher.id, userId);
+
+    for (const attachmentView of cipher.attachments) {
+      if (
+        attachmentView.key != null ||
+        (attachmentId != null && attachmentView.id !== attachmentId)
+      ) {
+        continue;
+      }
+
+      try {
+        // 1. Get download URL
+        const downloadUrl = await this.getAttachmentDownloadUrl(cipher.id, attachmentView);
+
+        // 2. Download attachment data
+        const dataResponse = await this.apiService.nativeFetch(
+          new Request(downloadUrl, { cache: "no-store" }),
+        );
+
+        if (dataResponse.status !== 200) {
+          throw new Error(`Failed to download attachment. Status: ${dataResponse.status}`);
+        }
+
+        // 3. Decrypt the attachment
+        const decryptedBuffer = await this.getDecryptedAttachmentBuffer(
+          cipher.id as CipherId,
+          attachmentView,
+          dataResponse,
+          userId,
+        );
+
+        // 4. Re-upload with attachment key
+        cipherDomain = await this.saveAttachmentRawWithServer(
+          cipherDomain,
+          attachmentView.fileName,
+          decryptedBuffer,
+          userId,
+        );
+
+        // 5. Delete the old attachment
+        const cipherData = await this.deleteAttachmentWithServer(
+          cipher.id,
+          attachmentView.id,
+          userId,
+        );
+        cipherDomain = new Cipher(cipherData);
+      } catch (e) {
+        this.logService.error(`Failed to upgrade attachment ${attachmentView.id}`, e);
+        throw e;
+      }
+    }
+
+    return await this.decrypt(cipherDomain, userId);
+  }
+
+  private async getAttachmentDownloadUrl(
+    cipherId: string,
+    attachmentView: AttachmentView,
+  ): Promise<string> {
+    try {
+      const attachmentResponse = await this.apiService.getAttachmentData(
+        cipherId,
+        attachmentView.id,
+      );
+      return attachmentResponse.url;
+    } catch (e) {
+      // Fall back to the attachment's stored URL
+      if (e instanceof ErrorResponse && e.statusCode === 404 && attachmentView.url) {
+        return attachmentView.url;
+      }
+      throw new Error(`Failed to get download URL for attachment ${attachmentView.id}`);
+    }
+  }
+
   private async encryptObjProperty<V extends View, D extends Domain>(
     model: V,
     obj: D,
@@ -2143,15 +2250,19 @@ export class CipherService implements CipherServiceAbstraction {
     userId: UserId,
     fullDecryption: boolean = true,
   ): Promise<[CipherViewLike[], CipherView[]]> {
+    if (fullDecryption) {
+      const [decryptedViews, failedViews] = await this.cipherEncryptionService.decryptManyLegacy(
+        ciphers,
+        userId,
+      );
+      return [decryptedViews.sort(this.getLocaleSortingFunction()), failedViews];
+    }
+
     const [decrypted, failures] = await this.cipherEncryptionService.decryptManyWithFailures(
       ciphers,
       userId,
     );
 
-    const decryptedViews = fullDecryption
-      ? await Promise.all(decrypted.map((c) => this.getFullCipherView(c)))
-      : decrypted;
-
     const failedViews = failures.map((c) => {
       const cipher_view = new CipherView(c);
       cipher_view.name = "[error: cannot decrypt]";
@@ -2159,7 +2270,7 @@ export class CipherService implements CipherServiceAbstraction {
       return cipher_view;
     });
 
-    return [decryptedViews.sort(this.getLocaleSortingFunction()), failedViews];
+    return [decrypted.sort(this.getLocaleSortingFunction()), failedViews];
   }
 
   /** Fetches the full `CipherView` when a `CipherListView` is passed. */
diff --git a/libs/common/src/vault/services/default-cipher-archive.service.spec.ts b/libs/common/src/vault/services/default-cipher-archive.service.spec.ts
index 972b04d2c4e..807311ca851 100644
--- a/libs/common/src/vault/services/default-cipher-archive.service.spec.ts
+++ b/libs/common/src/vault/services/default-cipher-archive.service.spec.ts
@@ -1,5 +1,5 @@
 import { mock } from "jest-mock-extended";
-import { of, firstValueFrom } from "rxjs";
+import { of, firstValueFrom, BehaviorSubject } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions";
@@ -24,12 +24,14 @@ describe("DefaultCipherArchiveService", () => {
 
   const userId = "user-id" as UserId;
   const cipherId = "123" as CipherId;
+  const featureFlag = new BehaviorSubject<boolean>(true);
 
   beforeEach(() => {
     mockCipherService = mock<CipherService>();
     mockApiService = mock<ApiService>();
     mockBillingAccountProfileStateService = mock<BillingAccountProfileStateService>();
     mockConfigService = mock<ConfigService>();
+    mockConfigService.getFeatureFlag$.mockReturnValue(featureFlag.asObservable());
 
     service = new DefaultCipherArchiveService(
       mockCipherService,
@@ -86,7 +88,7 @@ describe("DefaultCipherArchiveService", () => {
   describe("userCanArchive$", () => {
     it("should return true when user has premium and feature flag is enabled", async () => {
       mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(true));
-      mockConfigService.getFeatureFlag$.mockReturnValue(of(true));
+      featureFlag.next(true);
 
       const result = await firstValueFrom(service.userCanArchive$(userId));
 
@@ -101,7 +103,7 @@ describe("DefaultCipherArchiveService", () => {
 
     it("should return false when feature flag is disabled", async () => {
       mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(false));
-      mockConfigService.getFeatureFlag$.mockReturnValue(of(false));
+      featureFlag.next(false);
 
       const result = await firstValueFrom(service.userCanArchive$(userId));
 
@@ -109,6 +111,93 @@ describe("DefaultCipherArchiveService", () => {
     });
   });
 
+  describe("hasArchiveFlagEnabled$", () => {
+    it("returns true when feature flag is enabled", async () => {
+      featureFlag.next(true);
+
+      const result = await firstValueFrom(service.hasArchiveFlagEnabled$);
+
+      expect(result).toBe(true);
+      expect(mockConfigService.getFeatureFlag$).toHaveBeenCalledWith(
+        FeatureFlag.PM19148_InnovationArchive,
+      );
+    });
+
+    it("returns false when feature flag is disabled", async () => {
+      featureFlag.next(false);
+
+      const result = await firstValueFrom(service.hasArchiveFlagEnabled$);
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe("userHasPremium$", () => {
+    it("returns true when user has premium", async () => {
+      mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(true));
+
+      const result = await firstValueFrom(service.userHasPremium$(userId));
+
+      expect(result).toBe(true);
+      expect(mockBillingAccountProfileStateService.hasPremiumFromAnySource$).toHaveBeenCalledWith(
+        userId,
+      );
+    });
+
+    it("returns false when user does not have premium", async () => {
+      mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(false));
+
+      const result = await firstValueFrom(service.userHasPremium$(userId));
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe("showSubscriptionEndedMessaging$", () => {
+    it("returns true when user has archived ciphers but no premium", async () => {
+      const mockCiphers: CipherListView[] = [
+        {
+          id: "1",
+          archivedDate: "2024-01-15T10:30:00.000Z",
+          type: "identity",
+        } as unknown as CipherListView,
+      ];
+
+      mockCipherService.cipherListViews$.mockReturnValue(of(mockCiphers));
+      mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(false));
+
+      const result = await firstValueFrom(service.showSubscriptionEndedMessaging$(userId));
+
+      expect(result).toBe(true);
+    });
+
+    it("returns false when user has archived ciphers and has premium", async () => {
+      const mockCiphers: CipherListView[] = [
+        {
+          id: "1",
+          archivedDate: "2024-01-15T10:30:00.000Z",
+          type: "identity",
+        } as unknown as CipherListView,
+      ];
+
+      mockCipherService.cipherListViews$.mockReturnValue(of(mockCiphers));
+      mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(true));
+
+      const result = await firstValueFrom(service.showSubscriptionEndedMessaging$(userId));
+
+      expect(result).toBe(false);
+    });
+
+    it("returns false when user has no archived ciphers and no premium", async () => {
+      mockCipherService.cipherListViews$.mockReturnValue(of([]));
+      mockBillingAccountProfileStateService.hasPremiumFromAnySource$.mockReturnValue(of(false));
+
+      const result = await firstValueFrom(service.showSubscriptionEndedMessaging$(userId));
+
+      expect(result).toBe(false);
+    });
+  });
+
   describe("archiveWithServer", () => {
     const mockResponse = {
       data: [
diff --git a/libs/common/src/vault/services/default-cipher-archive.service.ts b/libs/common/src/vault/services/default-cipher-archive.service.ts
index a56a22474a3..8076735c9e2 100644
--- a/libs/common/src/vault/services/default-cipher-archive.service.ts
+++ b/libs/common/src/vault/services/default-cipher-archive.service.ts
@@ -27,10 +27,6 @@ export class DefaultCipherArchiveService implements CipherArchiveService {
     private configService: ConfigService,
   ) {}
 
-  hasArchiveFlagEnabled$(): Observable<boolean> {
-    return this.configService.getFeatureFlag$(FeatureFlag.PM19148_InnovationArchive);
-  }
-
   /**
    * Observable that contains the list of ciphers that have been archived.
    */
@@ -61,23 +57,22 @@ export class DefaultCipherArchiveService implements CipherArchiveService {
     );
   }
 
-  /**
-   * User can access the archive vault if:
-   * Feature Flag is enabled
-   * There is at least one archived item
-   * ///////////// NOTE /////////////
-   * This is separated from userCanArchive because a user that loses premium status, but has archived items,
-   * should still be able to access their archive vault. The items will be read-only, and can be restored.
-   */
-  showArchiveVault$(userId: UserId): Observable<boolean> {
-    return combineLatest([
-      this.configService.getFeatureFlag$(FeatureFlag.PM19148_InnovationArchive),
-      this.archivedCiphers$(userId),
-    ]).pipe(
-      map(
-        ([archiveFlagEnabled, hasArchivedItems]) =>
-          archiveFlagEnabled && hasArchivedItems.length > 0,
-      ),
+  /** Returns true when the archive features should be shown. */
+  hasArchiveFlagEnabled$: Observable<boolean> = this.configService
+    .getFeatureFlag$(FeatureFlag.PM19148_InnovationArchive)
+    .pipe(shareReplay({ refCount: true, bufferSize: 1 }));
+
+  /** Returns true when the user has premium from any means. */
+  userHasPremium$(userId: UserId): Observable<boolean> {
+    return this.billingAccountProfileStateService
+      .hasPremiumFromAnySource$(userId)
+      .pipe(shareReplay({ refCount: true, bufferSize: 1 }));
+  }
+
+  /** Returns true when the user has previously archived ciphers but lost their premium membership. */
+  showSubscriptionEndedMessaging$(userId: UserId): Observable<boolean> {
+    return combineLatest([this.archivedCiphers$(userId), this.userHasPremium$(userId)]).pipe(
+      map(([archivedCiphers, hasPremium]) => archivedCiphers.length > 0 && !hasPremium),
       shareReplay({ refCount: true, bufferSize: 1 }),
     );
   }
diff --git a/libs/common/src/vault/services/default-cipher-encryption.service.spec.ts b/libs/common/src/vault/services/default-cipher-encryption.service.spec.ts
index 6d6341bd1fa..f54dfa17a38 100644
--- a/libs/common/src/vault/services/default-cipher-encryption.service.spec.ts
+++ b/libs/common/src/vault/services/default-cipher-encryption.service.spec.ts
@@ -496,9 +496,11 @@ describe("DefaultCipherEncryptionService", () => {
         .mockReturnValueOnce(expectedViews[0])
         .mockReturnValueOnce(expectedViews[1]);
 
-      const result = await cipherEncryptionService.decryptManyLegacy(ciphers, userId);
+      const [successfulDecryptions, failedDecryptions] =
+        await cipherEncryptionService.decryptManyLegacy(ciphers, userId);
 
-      expect(result).toEqual(expectedViews);
+      expect(successfulDecryptions).toEqual(expectedViews);
+      expect(failedDecryptions).toEqual([]);
       expect(mockSdkClient.vault().ciphers().decrypt).toHaveBeenCalledTimes(2);
       expect(CipherView.fromSdkCipherView).toHaveBeenCalledTimes(2);
     });
diff --git a/libs/common/src/vault/services/default-cipher-encryption.service.ts b/libs/common/src/vault/services/default-cipher-encryption.service.ts
index 3f03e0f5e9e..f1b737ed50f 100644
--- a/libs/common/src/vault/services/default-cipher-encryption.service.ts
+++ b/libs/common/src/vault/services/default-cipher-encryption.service.ts
@@ -168,7 +168,7 @@ export class DefaultCipherEncryptionService implements CipherEncryptionService {
     );
   }
 
-  decryptManyLegacy(ciphers: Cipher[], userId: UserId): Promise<CipherView[]> {
+  decryptManyLegacy(ciphers: Cipher[], userId: UserId): Promise<[CipherView[], CipherView[]]> {
     return firstValueFrom(
       this.sdkService.userClient$(userId).pipe(
         map((sdk) => {
@@ -178,38 +178,49 @@ export class DefaultCipherEncryptionService implements CipherEncryptionService {
 
           using ref = sdk.take();
 
-          return ciphers.map((cipher) => {
-            const sdkCipherView = ref.value.vault().ciphers().decrypt(cipher.toSdkCipher());
-            const clientCipherView = CipherView.fromSdkCipherView(sdkCipherView)!;
+          const successful: CipherView[] = [];
+          const failed: CipherView[] = [];
 
-            // Handle FIDO2 credentials if present
-            if (
-              clientCipherView.type === CipherType.Login &&
-              sdkCipherView.login?.fido2Credentials?.length
-            ) {
-              const fido2CredentialViews = ref.value
-                .vault()
-                .ciphers()
-                .decrypt_fido2_credentials(sdkCipherView);
+          ciphers.forEach((cipher) => {
+            try {
+              const sdkCipherView = ref.value.vault().ciphers().decrypt(cipher.toSdkCipher());
+              const clientCipherView = CipherView.fromSdkCipherView(sdkCipherView)!;
 
-              // TODO (PM-21259): Remove manual keyValue decryption for FIDO2 credentials.
-              // This is a temporary workaround until we can use the SDK for FIDO2 authentication.
-              const decryptedKeyValue = ref.value
-                .vault()
-                .ciphers()
-                .decrypt_fido2_private_key(sdkCipherView);
+              // Handle FIDO2 credentials if present
+              if (
+                clientCipherView.type === CipherType.Login &&
+                sdkCipherView.login?.fido2Credentials?.length
+              ) {
+                const fido2CredentialViews = ref.value
+                  .vault()
+                  .ciphers()
+                  .decrypt_fido2_credentials(sdkCipherView);
 
-              clientCipherView.login.fido2Credentials = fido2CredentialViews
-                .map((f) => {
-                  const view = Fido2CredentialView.fromSdkFido2CredentialView(f)!;
-                  view.keyValue = decryptedKeyValue;
-                  return view;
-                })
-                .filter((view): view is Fido2CredentialView => view !== undefined);
+                const decryptedKeyValue = ref.value
+                  .vault()
+                  .ciphers()
+                  .decrypt_fido2_private_key(sdkCipherView);
+
+                clientCipherView.login.fido2Credentials = fido2CredentialViews
+                  .map((f) => {
+                    const view = Fido2CredentialView.fromSdkFido2CredentialView(f)!;
+                    view.keyValue = decryptedKeyValue;
+                    return view;
+                  })
+                  .filter((view): view is Fido2CredentialView => view !== undefined);
+              }
+
+              successful.push(clientCipherView);
+            } catch (error) {
+              this.logService.error(`Failed to decrypt cipher ${cipher.id}: ${error}`);
+              const failedView = new CipherView(cipher);
+              failedView.name = "[error: cannot decrypt]";
+              failedView.decryptionFailure = true;
+              failed.push(failedView);
             }
-
-            return clientCipherView;
           });
+
+          return [successful, failed] as [CipherView[], CipherView[]];
         }),
         catchError((error: unknown) => {
           this.logService.error(`Failed to decrypt ciphers: ${error}`);
diff --git a/libs/common/src/vault/services/search.service.ts b/libs/common/src/vault/services/search.service.ts
index 0b34bd3863f..feb6a7494b5 100644
--- a/libs/common/src/vault/services/search.service.ts
+++ b/libs/common/src/vault/services/search.service.ts
@@ -335,8 +335,10 @@ export class SearchService implements SearchServiceAbstraction {
 
       if (
         login &&
-        login.uris.length &&
-        login.uris.some((loginUri) => loginUri?.uri?.toLowerCase().indexOf(query) > -1)
+        login.uris?.length &&
+        login.uris?.some(
+          (loginUri) => loginUri?.uri && loginUri.uri.toLowerCase().indexOf(query) > -1,
+        )
       ) {
         return true;
       }
diff --git a/libs/common/src/vault/tasks/services/default-task.service.spec.ts b/libs/common/src/vault/tasks/services/default-task.service.spec.ts
index 8fc2f902ca4..b57915aadbc 100644
--- a/libs/common/src/vault/tasks/services/default-task.service.spec.ts
+++ b/libs/common/src/vault/tasks/services/default-task.service.spec.ts
@@ -51,10 +51,10 @@ describe("Default task service", () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: false,
+            canUseAccessIntelligence: false,
           },
           {
-            useAccessIntelligence: true,
+            canUseAccessIntelligence: true,
           },
         ] as Organization[]),
       );
@@ -70,10 +70,10 @@ describe("Default task service", () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: false,
+            canUseAccessIntelligence: false,
           },
           {
-            useAccessIntelligence: false,
+            canUseAccessIntelligence: false,
           },
         ] as Organization[]),
       );
@@ -91,17 +91,17 @@ describe("Default task service", () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: true,
+            canUseAccessIntelligence: true,
           },
         ] as Organization[]),
       );
     });
 
-    it("should return an empty array if tasks are not enabled", async () => {
+    it("should return no tasks if not present and canUserAccessIntelligence is false", async () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: false,
+            canUseAccessIntelligence: false,
           },
         ] as Organization[]),
       );
@@ -111,7 +111,6 @@ describe("Default task service", () => {
       const result = await firstValueFrom(tasks$("user-id" as UserId));
 
       expect(result.length).toBe(0);
-      expect(mockApiSend).not.toHaveBeenCalled();
     });
 
     it("should fetch tasks from the API when the state is null", async () => {
@@ -163,17 +162,17 @@ describe("Default task service", () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: true,
+            canUseAccessIntelligence: true,
           },
         ] as Organization[]),
       );
     });
 
-    it("should return an empty array if tasks are not enabled", async () => {
+    it("should return no tasks if not present and canUserAccessIntelligence is false", async () => {
       mockGetAllOrgs$.mockReturnValue(
         new BehaviorSubject([
           {
-            useAccessIntelligence: false,
+            canUseAccessIntelligence: false,
           },
         ] as Organization[]),
       );
@@ -183,7 +182,6 @@ describe("Default task service", () => {
       const result = await firstValueFrom(pendingTasks$("user-id" as UserId));
 
       expect(result.length).toBe(0);
-      expect(mockApiSend).not.toHaveBeenCalled();
     });
 
     it("should filter tasks to only pending tasks", async () => {
diff --git a/libs/common/src/vault/tasks/services/default-task.service.ts b/libs/common/src/vault/tasks/services/default-task.service.ts
index 5bd23ed8605..60e05e0728f 100644
--- a/libs/common/src/vault/tasks/services/default-task.service.ts
+++ b/libs/common/src/vault/tasks/services/default-task.service.ts
@@ -48,7 +48,7 @@ export class DefaultTaskService implements TaskService {
 
   tasksEnabled$ = perUserCache$((userId) => {
     return this.organizationService.organizations$(userId).pipe(
-      map((orgs) => orgs.some((o) => o.useAccessIntelligence)),
+      map((orgs) => orgs.some((o) => o.canUseAccessIntelligence)),
       distinctUntilChanged(),
     );
   });
diff --git a/libs/components/src/a11y/a11y-title.directive.ts b/libs/components/src/a11y/a11y-title.directive.ts
index fa038172cb6..75c2967805f 100644
--- a/libs/components/src/a11y/a11y-title.directive.ts
+++ b/libs/components/src/a11y/a11y-title.directive.ts
@@ -1,21 +1,23 @@
-import { Directive } from "@angular/core";
+import { Directive, effect, ElementRef, input } from "@angular/core";
 
-import { TooltipDirective } from "../tooltip/tooltip.directive";
+import { setA11yTitleAndAriaLabel } from "./set-a11y-title-and-aria-label";
 
-/**
- * @deprecated This function is deprecated in favor of `bitTooltip`.
- * Please use `bitTooltip` instead.
- *
- * Directive that provides accessible tooltips by internally using TooltipDirective.
- * This maintains the appA11yTitle API while leveraging the enhanced tooltip functionality.
- */
 @Directive({
   selector: "[appA11yTitle]",
-  hostDirectives: [
-    {
-      directive: TooltipDirective,
-      inputs: ["bitTooltip: appA11yTitle", "tooltipPosition"],
-    },
-  ],
 })
-export class A11yTitleDirective {}
+export class A11yTitleDirective {
+  readonly title = input.required<string>({ alias: "appA11yTitle" });
+
+  constructor(private el: ElementRef) {
+    const originalTitle = this.el.nativeElement.getAttribute("title");
+    const originalAriaLabel = this.el.nativeElement.getAttribute("aria-label");
+
+    effect(() => {
+      setA11yTitleAndAriaLabel({
+        element: this.el.nativeElement,
+        title: originalTitle ?? this.title(),
+        label: originalAriaLabel ?? this.title(),
+      });
+    });
+  }
+}
diff --git a/libs/components/src/chip-select/chip-select.component.spec.ts b/libs/components/src/chip-select/chip-select.component.spec.ts
index 3c2f71ef8d7..3a66b799652 100644
--- a/libs/components/src/chip-select/chip-select.component.spec.ts
+++ b/libs/components/src/chip-select/chip-select.component.spec.ts
@@ -451,6 +451,24 @@ describe("ChipSelectComponent", () => {
 
       expect(disabledMenuItem?.disabled).toBe(true);
     });
+
+    it("should handle writeValue called before options are initialized", async () => {
+      const testApp = fixture.componentInstance;
+
+      component["rootTree"] = null;
+
+      component.writeValue("opt1");
+
+      expect(component["pendingValue"]).toBe("opt1");
+      expect(component["selectedOption"]).toBeUndefined();
+
+      testApp.options.set(testOptions);
+      fixture.detectChanges();
+      await fixture.whenStable();
+
+      expect(component["selectedOption"]?.value).toBe("opt1");
+      expect(component["pendingValue"]).toBeUndefined();
+    });
   });
 });
 
diff --git a/libs/components/src/chip-select/chip-select.component.ts b/libs/components/src/chip-select/chip-select.component.ts
index bf6c6fb2aad..50e462dc815 100644
--- a/libs/components/src/chip-select/chip-select.component.ts
+++ b/libs/components/src/chip-select/chip-select.component.ts
@@ -100,10 +100,21 @@ export class ChipSelectComponent<T = unknown> implements ControlValueAccessor {
   /** Tree constructed from `this.options` */
   private rootTree?: ChipSelectOption<T> | null;
 
+  /** Store the pending value when writeValue is called before options are initialized */
+  private pendingValue?: T;
+
   constructor() {
     // Initialize the root tree whenever options change
     effect(() => {
       this.initializeRootTree(this.options());
+
+      // If there's a pending value, apply it now that options are available
+      if (this.pendingValue !== undefined) {
+        this.selectedOption = this.findOption(this.rootTree, this.pendingValue);
+        this.setOrResetRenderedOptions();
+        this.pendingValue = undefined;
+        this.cdr.markForCheck();
+      }
     });
 
     // Focus the first menu item when menuItems change (e.g., navigating submenus)
@@ -255,6 +266,12 @@ export class ChipSelectComponent<T = unknown> implements ControlValueAccessor {
 
   /** Implemented as part of NG_VALUE_ACCESSOR */
   writeValue(obj: T): void {
+    // If rootTree is not yet initialized, store the value to apply it later
+    if (!this.rootTree) {
+      this.pendingValue = obj;
+      return;
+    }
+
     this.selectedOption = this.findOption(this.rootTree, obj);
     this.setOrResetRenderedOptions();
     // OnPush components require manual change detection when writeValue() is called
diff --git a/libs/components/src/color-password/color-password.component.ts b/libs/components/src/color-password/color-password.component.ts
index bd7f3beb403..eaaefd29f1d 100644
--- a/libs/components/src/color-password/color-password.component.ts
+++ b/libs/components/src/color-password/color-password.component.ts
@@ -14,7 +14,7 @@ type CharacterType = "letter" | "emoji" | "special" | "number";
 @Component({
   selector: "bit-color-password",
   template: `@for (character of passwordCharArray(); track $index; let i = $index) {
-    <span [class]="getCharacterClass(character)">
+    <span [class]="getCharacterClass(character)" class="tw-font-mono">
       <span>{{ character }}</span>
       @if (showCount()) {
         <span class="tw-whitespace-nowrap tw-text-xs tw-leading-5 tw-text-main">{{ i + 1 }}</span>
diff --git a/libs/components/src/color-password/color-password.stories.ts b/libs/components/src/color-password/color-password.stories.ts
index 65b6a3c0f18..2ed5cdc4b8d 100644
--- a/libs/components/src/color-password/color-password.stories.ts
+++ b/libs/components/src/color-password/color-password.stories.ts
@@ -4,7 +4,7 @@ import { formatArgsForCodeSnippet } from "../../../../.storybook/format-args-for
 
 import { ColorPasswordComponent } from "./color-password.component";
 
-const examplePassword = "Wq$Jk😀7jlI  DX#rS5Sdi!z ";
+const examplePassword = "Wq$Jk😀7jlI  DX#rS5Sdi!z0O ";
 
 export default {
   title: "Component Library/Color Password",
diff --git a/libs/components/src/dialog/dialog/dialog.component.html b/libs/components/src/dialog/dialog/dialog.component.html
index c077dc2ceb8..be946c76a57 100644
--- a/libs/components/src/dialog/dialog/dialog.component.html
+++ b/libs/components/src/dialog/dialog/dialog.component.html
@@ -3,7 +3,7 @@
   class="tw-flex tw-w-full tw-flex-col tw-self-center tw-overflow-hidden tw-border tw-border-solid tw-border-secondary-100 tw-bg-background tw-text-main"
   [ngClass]="[
     width,
-    isDrawer ? 'tw-h-screen tw-border-t-0' : 'tw-rounded-t-xl md:tw-rounded-xl tw-shadow-lg',
+    isDrawer ? 'tw-h-full tw-border-t-0' : 'tw-rounded-t-xl md:tw-rounded-xl tw-shadow-lg',
   ]"
   cdkTrapFocus
   cdkTrapFocusAutoCapture
diff --git a/libs/components/src/dialog/dialog/dialog.component.ts b/libs/components/src/dialog/dialog/dialog.component.ts
index 954f03aabe2..627a509ee8c 100644
--- a/libs/components/src/dialog/dialog/dialog.component.ts
+++ b/libs/components/src/dialog/dialog/dialog.component.ts
@@ -104,7 +104,7 @@ export class DialogComponent {
     // `tw-max-h-[90vh]` is needed to prevent dialogs from overlapping the desktop header
     const baseClasses = ["tw-flex", "tw-flex-col", "tw-w-screen"];
     const sizeClasses = this.dialogRef?.isDrawer
-      ? ["tw-min-h-screen", "md:tw-w-[23rem]"]
+      ? ["tw-h-full", "md:tw-w-[23rem]"]
       : ["md:tw-p-4", "tw-w-screen", "tw-max-h-[90vh]"];
 
     const animationClasses =
diff --git a/libs/components/src/drawer/drawer-body.component.ts b/libs/components/src/drawer/drawer-body.component.ts
index 9b5d3148d9b..c6499067642 100644
--- a/libs/components/src/drawer/drawer-body.component.ts
+++ b/libs/components/src/drawer/drawer-body.component.ts
@@ -12,7 +12,7 @@ import { hasScrolledFrom } from "../utils/has-scrolled-from";
   imports: [],
   host: {
     class:
-      "tw-p-4 tw-pt-0 tw-block tw-overflow-auto tw-border-solid tw-border tw-border-transparent tw-transition-colors tw-duration-200",
+      "tw-p-4 tw-pt-0 tw-flex-1 tw-overflow-auto tw-border-solid tw-border tw-border-transparent tw-transition-colors tw-duration-200",
     "[class.tw-border-t-secondary-300]": "this.hasScrolledFrom().top",
   },
   hostDirectives: [
diff --git a/libs/components/src/drawer/drawer.component.html b/libs/components/src/drawer/drawer.component.html
index fce6b3c57eb..79cbf319e7d 100644
--- a/libs/components/src/drawer/drawer.component.html
+++ b/libs/components/src/drawer/drawer.component.html
@@ -1,7 +1,7 @@
 <ng-container *cdkPortal>
   <section
     [attr.role]="role()"
-    class="tw-w-[23rem] tw-sticky tw-top-0 tw-h-screen tw-flex tw-flex-col tw-overflow-auto tw-border-0 tw-border-l tw-border-solid tw-border-secondary-300 tw-bg-background"
+    class="tw-w-[23rem] tw-sticky tw-top-0 tw-h-full tw-flex tw-flex-col tw-overflow-auto tw-border-0 tw-border-l tw-border-solid tw-border-secondary-300 tw-bg-background"
   >
     <ng-content></ng-content>
   </section>
diff --git a/libs/components/src/icon-button/icon-button.component.html b/libs/components/src/icon-button/icon-button.component.html
index b5826ce9928..447d04e7d41 100644
--- a/libs/components/src/icon-button/icon-button.component.html
+++ b/libs/components/src/icon-button/icon-button.component.html
@@ -1,6 +1,6 @@
 <span class="tw-relative tw-inline-block tw-leading-[0px]">
   <span class="tw-inline-block tw-leading-[0px]" [ngClass]="{ 'tw-invisible': showLoadingStyle() }">
-    <i class="bwi" [ngClass]="iconClass" aria-hidden="true"></i>
+    <i class="bwi" [ngClass]="iconClass()" aria-hidden="true"></i>
   </span>
   <span
     class="tw-absolute tw-inset-0 tw-flex tw-items-center tw-justify-center"
diff --git a/libs/components/src/icon-button/icon-button.component.ts b/libs/components/src/icon-button/icon-button.component.ts
index d69bae98dff..c7eb28fc086 100644
--- a/libs/components/src/icon-button/icon-button.component.ts
+++ b/libs/components/src/icon-button/icon-button.component.ts
@@ -20,7 +20,16 @@ import { SpinnerComponent } from "../spinner";
 import { TooltipDirective } from "../tooltip";
 import { ariaDisableElement } from "../utils";
 
-export type IconButtonType = "primary" | "danger" | "contrast" | "main" | "muted" | "nav-contrast";
+export const IconButtonTypes = [
+  "primary",
+  "danger",
+  "contrast",
+  "main",
+  "muted",
+  "nav-contrast",
+] as const;
+
+export type IconButtonType = (typeof IconButtonTypes)[number];
 
 const focusRing = [
   // Workaround for box-shadow with transparent offset issue:
@@ -148,9 +157,7 @@ export class BitIconButtonComponent implements ButtonLikeAbstraction, FocusableE
       );
   }
 
-  get iconClass() {
-    return [this.icon(), "!tw-m-0"];
-  }
+  readonly iconClass = computed(() => [this.icon(), "!tw-m-0"]);
 
   protected readonly disabledAttr = computed(() => {
     const disabled = this.disabled() != null && this.disabled() !== false;
diff --git a/libs/components/src/icon-button/icon-button.stories.ts b/libs/components/src/icon-button/icon-button.stories.ts
index c93beb167bd..83e8e051b86 100644
--- a/libs/components/src/icon-button/icon-button.stories.ts
+++ b/libs/components/src/icon-button/icon-button.stories.ts
@@ -5,7 +5,7 @@ import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.servic
 import { formatArgsForCodeSnippet } from "../../../../.storybook/format-args-for-code-snippet";
 import { I18nMockService } from "../utils";
 
-import { BitIconButtonComponent } from "./icon-button.component";
+import { BitIconButtonComponent, IconButtonTypes } from "./icon-button.component";
 
 export default {
   title: "Component Library/Icon Button",
@@ -30,7 +30,7 @@ export default {
   },
   argTypes: {
     buttonType: {
-      options: ["primary", "secondary", "danger", "unstyled", "contrast", "main", "muted", "light"],
+      options: IconButtonTypes,
     },
   },
   parameters: {
diff --git a/libs/components/src/icon-button/index.ts b/libs/components/src/icon-button/index.ts
index cc52f263252..b753e53c96a 100644
--- a/libs/components/src/icon-button/index.ts
+++ b/libs/components/src/icon-button/index.ts
@@ -1,2 +1,2 @@
 export * from "./icon-button.module";
-export { BitIconButtonComponent } from "./icon-button.component";
+export * from "./icon-button.component";
diff --git a/libs/components/src/index.ts b/libs/components/src/index.ts
index 410a96f1cb3..23fb5beb456 100644
--- a/libs/components/src/index.ts
+++ b/libs/components/src/index.ts
@@ -39,6 +39,9 @@ export * from "./section";
 export * from "./select";
 export * from "./shared/compact-mode.service";
 export * from "./skeleton";
+export * from "./spinner";
+export * from "./stepper";
+export * from "./switch";
 export * from "./table";
 export * from "./tabs";
 export * from "./toast";
@@ -46,5 +49,3 @@ export * from "./toggle-group";
 export * from "./tooltip";
 export * from "./typography";
 export * from "./utils";
-export * from "./stepper";
-export * from "./switch";
diff --git a/libs/components/src/layout/layout.component.html b/libs/components/src/layout/layout.component.html
index 8ae26e7771b..255799b6690 100644
--- a/libs/components/src/layout/layout.component.html
+++ b/libs/components/src/layout/layout.component.html
@@ -1,6 +1,6 @@
 @let mainContentId = "main-content";
-<div class="tw-flex tw-w-full">
-  <div class="tw-flex tw-w-full" cdkTrapFocus>
+<div class="tw-flex tw-size-full">
+  <div class="tw-flex tw-size-full" cdkTrapFocus>
     <div
       class="tw-fixed tw-z-50 tw-w-full tw-flex tw-justify-center tw-opacity-0 focus-within:tw-opacity-100 tw-pointer-events-none focus-within:tw-pointer-events-auto"
     >
@@ -23,7 +23,7 @@
       [id]="mainContentId"
       tabindex="-1"
       bitScrollLayoutHost
-      class="tw-overflow-auto tw-max-h-screen tw-min-w-0 tw-flex-1 tw-bg-background tw-p-8 tw-pt-6 tw-@container"
+      class="tw-overflow-auto tw-max-h-full tw-min-w-0 tw-flex-1 tw-bg-background tw-p-8 tw-pt-6 tw-@container"
     >
       <!-- ^ If updating this padding, also update the padding correction in bit-banner! ^ -->
       <ng-content></ng-content>
@@ -45,7 +45,7 @@
       </div>
     }
   </div>
-  <div class="tw-absolute tw-z-50 tw-left-0 md:tw-sticky tw-top-0 tw-h-screen md:tw-w-auto">
+  <div class="tw-absolute tw-z-50 tw-left-0 md:tw-sticky tw-top-0 tw-h-full md:tw-w-auto">
     <ng-template [cdkPortalOutlet]="drawerPortal()"></ng-template>
   </div>
 </div>
diff --git a/libs/components/src/layout/layout.component.ts b/libs/components/src/layout/layout.component.ts
index 1b357424205..7460099cf92 100644
--- a/libs/components/src/layout/layout.component.ts
+++ b/libs/components/src/layout/layout.component.ts
@@ -29,6 +29,7 @@ import { ScrollLayoutHostDirective } from "./scroll-layout.directive";
   ],
   host: {
     "(document:keydown.tab)": "handleKeydown($event)",
+    class: "tw-block tw-h-screen",
   },
   hostDirectives: [DrawerHostDirective],
 })
diff --git a/libs/components/src/navigation/nav-group.stories.ts b/libs/components/src/navigation/nav-group.stories.ts
index d5c381ac3e3..e3033e4b40a 100644
--- a/libs/components/src/navigation/nav-group.stories.ts
+++ b/libs/components/src/navigation/nav-group.stories.ts
@@ -84,6 +84,11 @@ export const Default: StoryObj<NavGroupComponent> = {
           <bit-nav-item text="Child B"></bit-nav-item>
           <bit-nav-item text="Child C" icon="bwi-filter"></bit-nav-item>
         </bit-nav-group>
+        <bit-nav-group open="true" text="Lorem Ipsum (Button)" icon="bwi-filter">
+          <bit-nav-item text="Child A" icon="bwi-filter"></bit-nav-item>
+          <bit-nav-item text="Child B"></bit-nav-item>
+          <bit-nav-item text="Child C" icon="bwi-filter"></bit-nav-item>
+        </bit-nav-group>
       </bit-side-nav>
     `,
   }),
diff --git a/libs/components/src/navigation/nav-item.component.html b/libs/components/src/navigation/nav-item.component.html
index 1de8a9bd167..8a59d474d94 100644
--- a/libs/components/src/navigation/nav-item.component.html
+++ b/libs/components/src/navigation/nav-item.component.html
@@ -2,16 +2,12 @@
   @let open = sideNavService.open$ | async;
   @if (open || icon()) {
     <div
-      [ngStyle]="{
-        'padding-inline-start': navItemIndentationPadding(),
-      }"
+      [style.padding-inline-start]="navItemIndentationPadding()"
       class="tw-relative tw-rounded-md tw-h-10"
-      [ngClass]="[
-        showActiveStyles
-          ? 'tw-bg-background-alt4'
-          : 'tw-bg-background-alt3 hover:tw-bg-hover-contrast',
-        fvwStyles$ | async,
-      ]"
+      [class.tw-bg-background-alt4]="showActiveStyles"
+      [class.tw-bg-background-alt3]="!showActiveStyles"
+      [class.hover:tw-bg-hover-contrast]="!showActiveStyles"
+      [class]="fvwStyles$ | async"
     >
       <div class="tw-relative tw-flex tw-items-center tw-h-full">
         @if (open) {
@@ -26,13 +22,12 @@
         <!-- Main content of `NavItem` -->
         <ng-template #anchorAndButtonContent>
           <div
-            [ngClass]="[
-              variant() === 'tree' || treeDepth() > 0 ? 'tw-py-0' : 'tw-py-2',
-              open ? 'tw-pe-4' : 'tw-text-center',
-            ]"
             [title]="text()"
             class="tw-gap-2 tw-flex tw-items-center tw-font-medium tw-h-full"
-            [ngClass]="{ 'tw-justify-center': !open }"
+            [class.tw-py-0]="variant() === 'tree' || treeDepth() > 0"
+            [class.tw-py-2]="variant() !== 'tree' && treeDepth() === 0"
+            [class.tw-text-center]="!open"
+            [class.tw-justify-center]="!open"
           >
             @if (icon()) {
               <i
@@ -53,7 +48,7 @@
           <!-- The following `class` field should match the `#isButton` class field below -->
           <a
             class="tw-size-full tw-px-4 tw-block tw-truncate tw-border-none tw-bg-transparent tw-text-start !tw-text-alt2 hover:tw-text-alt2 hover:tw-no-underline focus:tw-outline-none [&_i]:tw-leading-[1.5rem]"
-            [ngClass]="{ 'tw-ps-0': variant() === 'tree' || treeDepth() > 0 }"
+            [class.!tw-ps-0]="variant() === 'tree' || treeDepth() > 0"
             data-fvw
             [routerLink]="route()"
             [relativeTo]="relativeTo()"
@@ -74,7 +69,7 @@
           <button
             type="button"
             class="tw-size-full tw-px-4 tw-truncate tw-border-none tw-bg-transparent tw-text-start !tw-text-alt2 hover:tw-text-alt2 hover:tw-no-underline focus:tw-outline-none [&_i]:tw-leading-[1.5rem]"
-            [ngClass]="open ? 'tw-pe-3' : 'tw-pe-4'"
+            [class.!tw-ps-0]="variant() === 'tree' || treeDepth() > 0"
             data-fvw
             (click)="mainContentClicked.emit()"
           >
diff --git a/libs/components/src/navigation/side-nav.component.html b/libs/components/src/navigation/side-nav.component.html
index d2e6aeab2bb..c8b20ecba77 100644
--- a/libs/components/src/navigation/side-nav.component.html
+++ b/libs/components/src/navigation/side-nav.component.html
@@ -7,7 +7,7 @@
 ) {
   <nav
     id="bit-side-nav"
-    class="tw-sticky tw-inset-y-0 tw-left-0 tw-z-30 tw-flex tw-h-screen tw-flex-col tw-overscroll-none tw-overflow-auto tw-bg-background-alt3 tw-outline-none"
+    class="tw-sticky tw-inset-y-0 tw-left-0 tw-z-30 tw-flex tw-h-full tw-flex-col tw-overscroll-none tw-overflow-auto tw-bg-background-alt3 tw-outline-none"
     [ngClass]="{ 'tw-w-60': data.open }"
     [ngStyle]="
       variant() === 'secondary' && {
@@ -23,7 +23,11 @@
     (keydown)="handleKeyDown($event)"
   >
     <ng-content></ng-content>
-    <div class="tw-sticky tw-bottom-0 tw-left-0 tw-z-20 tw-mt-auto tw-w-full tw-bg-background-alt3">
+    <!-- 53rem = ~850px -->
+    <!-- This is a magic number. This number was selected by going to the UI and finding the number that felt the best to me and design. No real rhyme or reason :) -->
+    <div
+      class="[@media(min-height:53rem)]:tw-sticky tw-bottom-0 tw-left-0 tw-z-20 tw-mt-auto tw-w-full tw-bg-background-alt3"
+    >
       <bit-nav-divider></bit-nav-divider>
       @if (data.open) {
         <ng-content select="[slot=footer]"></ng-content>
diff --git a/libs/components/src/navigation/side-nav.component.ts b/libs/components/src/navigation/side-nav.component.ts
index d64db635bbd..cf3d20762fe 100644
--- a/libs/components/src/navigation/side-nav.component.ts
+++ b/libs/components/src/navigation/side-nav.component.ts
@@ -17,6 +17,9 @@ export type SideNavVariant = "primary" | "secondary";
   selector: "bit-side-nav",
   templateUrl: "side-nav.component.html",
   imports: [CommonModule, CdkTrapFocus, NavDividerComponent, BitIconButtonComponent, I18nPipe],
+  host: {
+    class: "tw-block tw-h-full",
+  },
 })
 export class SideNavComponent {
   readonly variant = input<SideNavVariant>("primary");
diff --git a/libs/components/src/toggle-group/toggle-group.component.spec.ts b/libs/components/src/toggle-group/toggle-group.component.spec.ts
index 3a9d35b862b..5c1345df6f6 100644
--- a/libs/components/src/toggle-group/toggle-group.component.spec.ts
+++ b/libs/components/src/toggle-group/toggle-group.component.spec.ts
@@ -1,4 +1,4 @@
-import { Component } from "@angular/core";
+import { ChangeDetectionStrategy, Component, signal, WritableSignal } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { By } from "@angular/platform-browser";
 
@@ -30,31 +30,29 @@ describe("Button", () => {
   });
 
   it("should select second element when setting selected to second", () => {
-    testAppComponent.selected = "second";
+    testAppComponent.selected.set("second");
     fixture.detectChanges();
 
-    expect(buttonElements[1].selected).toBe(true);
+    expect(buttonElements[1].selected()).toBe(true);
   });
 
   it("should not select second element when setting selected to third", () => {
-    testAppComponent.selected = "third";
+    testAppComponent.selected.set("third");
     fixture.detectChanges();
 
-    expect(buttonElements[1].selected).toBe(false);
+    expect(buttonElements[1].selected()).toBe(false);
   });
 
   it("should emit new value when changing selection by clicking on radio button", () => {
-    testAppComponent.selected = "first";
+    testAppComponent.selected.set("first");
     fixture.detectChanges();
 
     radioButtons[1].click();
 
-    expect(testAppComponent.selected).toBe("second");
+    expect(testAppComponent.selected()).toBe("second");
   });
 });
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "test-app",
   template: `
@@ -65,7 +63,8 @@ describe("Button", () => {
     </bit-toggle-group>
   `,
   imports: [ToggleGroupModule],
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class TestAppComponent {
-  selected?: string;
+  readonly selected: WritableSignal<string | undefined> = signal(undefined);
 }
diff --git a/libs/components/src/toggle-group/toggle-group.component.ts b/libs/components/src/toggle-group/toggle-group.component.ts
index bde8f0ea9b6..ee619eb15d7 100644
--- a/libs/components/src/toggle-group/toggle-group.component.ts
+++ b/libs/components/src/toggle-group/toggle-group.component.ts
@@ -1,39 +1,44 @@
 import {
   booleanAttribute,
+  ChangeDetectionStrategy,
   Component,
-  EventEmitter,
-  HostBinding,
-  Output,
+  computed,
   input,
   model,
 } from "@angular/core";
 
 let nextId = 0;
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "bit-toggle-group",
   templateUrl: "./toggle-group.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  host: {
+    role: "radiogroup",
+    "[class]": "classlist()",
+  },
 })
 export class ToggleGroupComponent<TValue = unknown> {
-  private id = nextId++;
-  name = `bit-toggle-group-${this.id}`;
+  private readonly id = nextId++;
 
+  readonly name = `bit-toggle-group-${this.id}`;
+
+  /**
+   * Whether the toggle group should take up the full width of its container.
+   * When true, each toggle button will be equally sized to fill the available space.
+   */
   readonly fullWidth = input<boolean, unknown>(undefined, { transform: booleanAttribute });
-  readonly selected = model<TValue>();
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-output-emitter-ref
-  @Output() selectedChange = new EventEmitter<TValue>();
 
-  @HostBinding("attr.role") role = "radiogroup";
-  @HostBinding("class")
-  get classList() {
-    return ["tw-flex"].concat(this.fullWidth() ? ["tw-w-full", "[&>*]:tw-flex-1"] : []);
-  }
+  /**
+   * The selected value in the toggle group.
+   */
+  readonly selected = model<TValue>();
+
+  protected readonly classlist = computed(() =>
+    ["tw-flex"].concat(this.fullWidth() ? ["tw-w-full", "[&>*]:tw-flex-1"] : []),
+  );
 
   onInputInteraction(value: TValue) {
     this.selected.set(value);
-    this.selectedChange.emit(value);
   }
 }
diff --git a/libs/components/src/toggle-group/toggle.component.html b/libs/components/src/toggle-group/toggle.component.html
index d036b1751ba..5104fbb8646 100644
--- a/libs/components/src/toggle-group/toggle.component.html
+++ b/libs/components/src/toggle-group/toggle.component.html
@@ -1,16 +1,16 @@
 <input
   type="radio"
-  id="bit-toggle-{{ id }}"
+  [id]="id"
   [name]="name"
-  [ngClass]="inputClasses"
-  [checked]="selected"
-  (change)="onInputInteraction()"
+  [class]="inputClasses"
+  [checked]="selected()"
+  (change)="handleInputChange()"
 />
-<label for="bit-toggle-{{ id }}" [ngClass]="labelClasses" [title]="labelTitle()">
+<label [for]="id" [class]="labelClasses" [title]="labelTitle()">
   <span class="tw-line-clamp-2 tw-break-words" #labelContent>
     <ng-content></ng-content>
   </span>
-  <span class="tw-shrink-0" #bitBadgeContainer [hidden]="!bitBadgeContainerHasChidlren()">
+  <span class="tw-shrink-0" [hidden]="!hasBadge()">
     <ng-content select="[bitBadge]"></ng-content>
   </span>
 </label>
diff --git a/libs/components/src/toggle-group/toggle.component.spec.ts b/libs/components/src/toggle-group/toggle.component.spec.ts
index d3bc2e0eeed..6f3c10c0ff3 100644
--- a/libs/components/src/toggle-group/toggle.component.spec.ts
+++ b/libs/components/src/toggle-group/toggle.component.spec.ts
@@ -1,7 +1,9 @@
-import { Component, DebugElement } from "@angular/core";
+import { ChangeDetectionStrategy, Component, DebugElement, signal } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { By } from "@angular/platform-browser";
 
+import { BadgeModule } from "../badge";
+
 import { ToggleGroupComponent } from "./toggle-group.component";
 import { ToggleGroupModule } from "./toggle-group.module";
 
@@ -45,8 +47,45 @@ describe("Toggle", () => {
   });
 });
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
+describe("Toggle with badge content", () => {
+  let fixtureWithBadge: ComponentFixture<TestComponentWithBadgeComponent>;
+  let badgeContainers: DebugElement[];
+
+  beforeEach(async () => {
+    TestBed.configureTestingModule({
+      imports: [TestComponentWithBadgeComponent],
+    });
+
+    await TestBed.compileComponents();
+    fixtureWithBadge = TestBed.createComponent(TestComponentWithBadgeComponent);
+    fixtureWithBadge.detectChanges();
+    badgeContainers = fixtureWithBadge.debugElement.queryAll(By.css(".tw-shrink-0"));
+  });
+
+  it("should hide badge container when no badge content is projected", () => {
+    // First toggle has no badge
+    expect(badgeContainers[0].nativeElement.hidden).toBe(true);
+
+    // Second toggle has a badge
+    expect(badgeContainers[1].nativeElement.hidden).toBe(false);
+
+    // Third toggle has no badge
+    expect(badgeContainers[2].nativeElement.hidden).toBe(true);
+  });
+
+  it("should show badge container when badge content is projected", () => {
+    const badgeElement = fixtureWithBadge.debugElement.query(By.css("[bitBadge]"));
+    expect(badgeElement).toBeTruthy();
+    expect(badgeElement.nativeElement.textContent.trim()).toBe("2");
+  });
+
+  it("should render badge content correctly", () => {
+    const badges = fixtureWithBadge.debugElement.queryAll(By.css("[bitBadge]"));
+    expect(badges.length).toBe(1);
+    expect(badges[0].nativeElement.textContent.trim()).toBe("2");
+  });
+});
+
 @Component({
   selector: "test-component",
   template: `
@@ -56,7 +95,24 @@ describe("Toggle", () => {
     </bit-toggle-group>
   `,
   imports: [ToggleGroupModule],
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class TestComponent {
-  selected = 0;
+  readonly selected = signal(0);
+}
+
+@Component({
+  selector: "test-component-with-badge",
+  template: `
+    <bit-toggle-group [(selected)]="selected">
+      <bit-toggle [value]="0">Zero</bit-toggle>
+      <bit-toggle [value]="1">One <span bitBadge variant="info">2</span></bit-toggle>
+      <bit-toggle [value]="2">Two</bit-toggle>
+    </bit-toggle-group>
+  `,
+  imports: [ToggleGroupModule, BadgeModule],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+class TestComponentWithBadgeComponent {
+  readonly selected = signal(0);
 }
diff --git a/libs/components/src/toggle-group/toggle.component.ts b/libs/components/src/toggle-group/toggle.component.ts
index 538b31f6a32..d3efbb84a8d 100644
--- a/libs/components/src/toggle-group/toggle.component.ts
+++ b/libs/components/src/toggle-group/toggle.component.ts
@@ -1,113 +1,109 @@
-import { NgClass } from "@angular/common";
 import {
-  AfterContentChecked,
-  AfterViewInit,
+  afterNextRender,
+  ChangeDetectionStrategy,
   Component,
+  computed,
+  contentChild,
   ElementRef,
-  HostBinding,
-  signal,
+  inject,
   input,
+  signal,
   viewChild,
 } from "@angular/core";
 
+import { BadgeComponent } from "../badge";
+
 import { ToggleGroupComponent } from "./toggle-group.component";
 
 let nextId = 0;
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "bit-toggle",
   templateUrl: "./toggle.component.html",
-  imports: [NgClass],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  host: {
+    tabindex: "-1",
+    "[class]": "hostClasses",
+  },
 })
-export class ToggleComponent<TValue> implements AfterContentChecked, AfterViewInit {
-  id = nextId++;
+export class ToggleComponent<TValue> {
+  protected readonly id = "bit-toggle-" + nextId++;
+
+  private readonly groupComponent = inject(ToggleGroupComponent<TValue>);
 
   readonly value = input.required<TValue>();
-  readonly labelContent = viewChild<ElementRef<HTMLSpanElement>>("labelContent");
-  readonly bitBadgeContainer = viewChild<ElementRef<HTMLSpanElement>>("bitBadgeContainer");
+  protected readonly labelContent = viewChild<ElementRef<HTMLSpanElement>>("labelContent");
+  protected readonly badgeElement = contentChild(BadgeComponent);
+  protected readonly hasBadge = computed(() => !!this.badgeElement());
 
-  constructor(private groupComponent: ToggleGroupComponent<TValue>) {}
-
-  @HostBinding("tabIndex") tabIndex = "-1";
-  @HostBinding("class") classList = ["tw-group/toggle", "tw-flex", "tw-min-w-16"];
-
-  protected readonly bitBadgeContainerHasChidlren = signal(false);
   protected readonly labelTitle = signal<string | null>(null);
 
-  get name() {
-    return this.groupComponent.name;
+  constructor() {
+    // Set label title after view is initialized
+    afterNextRender(() => {
+      const labelText = this.labelContent()?.nativeElement.innerText;
+      if (labelText) {
+        this.labelTitle.set(labelText);
+      }
+    });
   }
 
-  get selected() {
-    return this.groupComponent.selected() === this.value();
-  }
+  protected readonly name = this.groupComponent.name;
+  readonly selected = computed(() => this.groupComponent.selected() === this.value());
 
-  get inputClasses() {
-    return ["tw-peer/toggle-input", "tw-appearance-none", "tw-outline-none"];
-  }
-
-  get labelClasses() {
-    return [
-      "tw-h-full",
-      "tw-w-full",
-      "tw-flex",
-      "tw-items-center",
-      "tw-justify-center",
-      "tw-gap-1.5",
-      "!tw-font-medium",
-      "tw-leading-5",
-      "tw-transition",
-      "tw-text-center",
-      "tw-text-sm",
-      "tw-border-primary-600",
-      "!tw-text-primary-600",
-      "tw-border-solid",
-      "tw-border-y",
-      "tw-border-r",
-      "tw-border-l-0",
-      "tw-cursor-pointer",
-      "hover:tw-bg-hover-default",
-
-      "group-first-of-type/toggle:tw-border-l",
-      "group-first-of-type/toggle:tw-rounded-s-full",
-      "group-last-of-type/toggle:tw-rounded-e-full",
-
-      "peer-focus-visible/toggle-input:tw-outline-none",
-      "peer-focus-visible/toggle-input:tw-ring",
-      "peer-focus-visible/toggle-input:tw-ring-offset-2",
-      "peer-focus-visible/toggle-input:tw-ring-primary-600",
-      "peer-focus-visible/toggle-input:tw-z-10",
-      "peer-focus-visible/toggle-input:tw-bg-primary-600",
-      "peer-focus-visible/toggle-input:tw-border-primary-600",
-      "peer-focus-visible/toggle-input:!tw-text-contrast",
-
-      "peer-checked/toggle-input:tw-bg-primary-600",
-      "peer-checked/toggle-input:tw-border-primary-600",
-      "peer-checked/toggle-input:!tw-text-contrast",
-      "tw-py-1.5",
-      "tw-px-3",
-
-      // Fix for bootstrap styles that add bottom margin
-      "!tw-mb-0",
-    ];
-  }
-
-  onInputInteraction() {
+  protected handleInputChange() {
     this.groupComponent.onInputInteraction(this.value());
   }
 
-  ngAfterContentChecked() {
-    this.bitBadgeContainerHasChidlren.set(
-      (this.bitBadgeContainer()?.nativeElement.childElementCount ?? 0) > 0,
-    );
-  }
+  protected readonly hostClasses = ["tw-group/toggle", "tw-flex", "tw-min-w-16"];
 
-  ngAfterViewInit() {
-    const labelText = this.labelContent()?.nativeElement.innerText;
-    if (labelText) {
-      this.labelTitle.set(labelText);
-    }
-  }
+  protected readonly inputClasses = [
+    "tw-peer/toggle-input",
+    "tw-appearance-none",
+    "tw-outline-none",
+  ];
+
+  protected readonly labelClasses = [
+    "tw-h-full",
+    "tw-w-full",
+    "tw-flex",
+    "tw-items-center",
+    "tw-justify-center",
+    "tw-gap-1.5",
+    "!tw-font-medium",
+    "tw-leading-5",
+    "tw-transition",
+    "tw-text-center",
+    "tw-text-sm",
+    "tw-border-primary-600",
+    "!tw-text-primary-600",
+    "tw-border-solid",
+    "tw-border-y",
+    "tw-border-r",
+    "tw-border-l-0",
+    "tw-cursor-pointer",
+    "hover:tw-bg-hover-default",
+
+    "group-first-of-type/toggle:tw-border-l",
+    "group-first-of-type/toggle:tw-rounded-s-full",
+    "group-last-of-type/toggle:tw-rounded-e-full",
+
+    "peer-focus-visible/toggle-input:tw-outline-none",
+    "peer-focus-visible/toggle-input:tw-ring",
+    "peer-focus-visible/toggle-input:tw-ring-offset-2",
+    "peer-focus-visible/toggle-input:tw-ring-primary-600",
+    "peer-focus-visible/toggle-input:tw-z-10",
+    "peer-focus-visible/toggle-input:tw-bg-primary-600",
+    "peer-focus-visible/toggle-input:tw-border-primary-600",
+    "peer-focus-visible/toggle-input:!tw-text-contrast",
+
+    "peer-checked/toggle-input:tw-bg-primary-600",
+    "peer-checked/toggle-input:tw-border-primary-600",
+    "peer-checked/toggle-input:!tw-text-contrast",
+    "tw-py-1.5",
+    "tw-px-3",
+
+    // Fix for bootstrap styles that add bottom margin
+    "!tw-mb-0",
+  ];
 }
diff --git a/libs/components/src/tooltip/tooltip.directive.ts b/libs/components/src/tooltip/tooltip.directive.ts
index 12be865243e..cca52526c7d 100644
--- a/libs/components/src/tooltip/tooltip.directive.ts
+++ b/libs/components/src/tooltip/tooltip.directive.ts
@@ -17,6 +17,7 @@ import { TooltipPositionIdentifier, tooltipPositions } from "./tooltip-positions
 import { TooltipComponent, TOOLTIP_DATA } from "./tooltip.component";
 
 export const TOOLTIP_DELAY_MS = 800;
+
 /**
  * Directive to add a tooltip to any element. The tooltip content is provided via the `bitTooltip` input.
  * The position of the tooltip can be set via the `tooltipPosition` input. Default position is "above-center".
diff --git a/libs/components/src/tw-theme.css b/libs/components/src/tw-theme.css
index f8e02a7e668..f0e55ddd9e1 100644
--- a/libs/components/src/tw-theme.css
+++ b/libs/components/src/tw-theme.css
@@ -168,6 +168,18 @@
     text-align: unset;
   }
 
+  /**
+  * tw-app-region-drag and tw-app-region-no-drag are used for Electron window dragging behavior
+  * These will replace direct -webkit-app-region usage as part of the migration to Tailwind CSS
+  */
+  .tw-app-region-drag {
+    -webkit-app-region: drag;
+  }
+
+  .tw-app-region-no-drag {
+    -webkit-app-region: no-drag;
+  }
+
   /**
   * Bootstrap uses z-index: 1050 for modals, dialogs and drag-and-drop previews should appear above them.
   * When bootstrap is removed, test if these styles are still needed and that overlays display properly over other content.
diff --git a/libs/importer/src/components/importer-providers.ts b/libs/importer/src/components/importer-providers.ts
index c48f7c1b096..18c148ebe2e 100644
--- a/libs/importer/src/components/importer-providers.ts
+++ b/libs/importer/src/components/importer-providers.ts
@@ -7,8 +7,8 @@ import { safeProvider, SafeProvider } from "@bitwarden/angular/platform/utils/sa
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -84,7 +84,7 @@ export const ImporterProviders: SafeProvider[] = [
       CollectionService,
       KeyService,
       EncryptService,
-      PinServiceAbstraction,
+      KeyGenerationService,
       AccountService,
       RestrictedItemTypesService,
     ],
diff --git a/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts b/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts
index bf74bcd69fa..1f5be7f18ab 100644
--- a/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts
+++ b/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts
@@ -6,7 +6,6 @@ import { filter, firstValueFrom } from "rxjs";
 // eslint-disable-next-line no-restricted-imports
 import { Collection, CollectionView } from "@bitwarden/admin-console/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import {
@@ -46,6 +45,7 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
   }
 
   async parse(data: string): Promise<ImportResult> {
+    const account = await firstValueFrom(this.accountService.activeAccount$);
     this.result = new ImportResult();
     const results: BitwardenJsonExport = JSON.parse(data);
     if (results == null || results.items == null) {
@@ -54,9 +54,9 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
     }
 
     if (results.encrypted) {
-      await this.parseEncrypted(results as any);
+      await this.parseEncrypted(results as any, account.id);
     } else {
-      await this.parseDecrypted(results as any);
+      await this.parseDecrypted(results as any, account.id);
     }
 
     return this.result;
@@ -64,9 +64,8 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
 
   private async parseEncrypted(
     results: BitwardenEncryptedIndividualJsonExport | BitwardenEncryptedOrgJsonExport,
+    userId: UserId,
   ) {
-    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
-
     if (results.encKeyValidation_DO_NOT_EDIT != null) {
       const orgKeys = await firstValueFrom(this.keyService.orgKeys$(userId));
       let keyForDecryption: SymmetricCryptoKey = orgKeys?.[this.organizationId];
@@ -84,8 +83,8 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
     }
 
     const groupingsMap = this.organization
-      ? await this.parseCollections(userId, results as BitwardenEncryptedOrgJsonExport)
-      : await this.parseFolders(results as BitwardenEncryptedIndividualJsonExport);
+      ? await this.parseCollections(results as BitwardenEncryptedOrgJsonExport, userId)
+      : await this.parseFolders(results as BitwardenEncryptedIndividualJsonExport, userId);
 
     for (const c of results.items) {
       const cipher = CipherWithIdExport.toDomain(c);
@@ -125,12 +124,11 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
 
   private async parseDecrypted(
     results: BitwardenUnEncryptedIndividualJsonExport | BitwardenUnEncryptedOrgJsonExport,
+    userId: UserId,
   ) {
-    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
-
     const groupingsMap = this.organization
-      ? await this.parseCollections(userId, results as BitwardenUnEncryptedOrgJsonExport)
-      : await this.parseFolders(results as BitwardenUnEncryptedIndividualJsonExport);
+      ? await this.parseCollections(results as BitwardenUnEncryptedOrgJsonExport, userId)
+      : await this.parseFolders(results as BitwardenUnEncryptedIndividualJsonExport, userId);
 
     results.items.forEach((c) => {
       const cipher = CipherWithIdExport.toView(c);
@@ -169,11 +167,14 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
 
   private async parseFolders(
     data: BitwardenUnEncryptedIndividualJsonExport | BitwardenEncryptedIndividualJsonExport,
+    userId: UserId,
   ): Promise<Map<string, number>> | null {
     if (data.folders == null) {
       return null;
     }
 
+    const userKey = await firstValueFrom(this.keyService.userKey$(userId));
+
     const groupingsMap = new Map<string, number>();
 
     for (const f of data.folders) {
@@ -181,7 +182,7 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
       if (data.encrypted) {
         const folder = FolderWithIdExport.toDomain(f);
         if (folder != null) {
-          folderView = await folder.decrypt();
+          folderView = await folder.decrypt(userKey);
         }
       } else {
         folderView = FolderWithIdExport.toView(f);
@@ -196,8 +197,8 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
   }
 
   private async parseCollections(
-    userId: UserId,
     data: BitwardenUnEncryptedOrgJsonExport | BitwardenEncryptedOrgJsonExport,
+    userId: UserId,
   ): Promise<Map<string, number>> | null {
     if (data.collections == null) {
       return null;
diff --git a/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.spec.ts b/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.spec.ts
index 44a55af8f62..6e98b21977d 100644
--- a/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.spec.ts
+++ b/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.spec.ts
@@ -2,8 +2,8 @@ import { mock, MockProxy } from "jest-mock-extended";
 import { of } from "rxjs";
 
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { emptyGuid, OrganizationId } from "@bitwarden/common/types/guid";
@@ -24,7 +24,7 @@ describe("BitwardenPasswordProtectedImporter", () => {
   let encryptService: MockProxy<EncryptService>;
   let i18nService: MockProxy<I18nService>;
   let cipherService: MockProxy<CipherService>;
-  let pinService: MockProxy<PinServiceAbstraction>;
+  let keyGenerationService: MockProxy<KeyGenerationService>;
   let accountService: MockProxy<AccountService>;
   const password = Utils.newGuid();
   const promptForPassword_callback = async () => {
@@ -36,7 +36,7 @@ describe("BitwardenPasswordProtectedImporter", () => {
     encryptService = mock<EncryptService>();
     i18nService = mock<I18nService>();
     cipherService = mock<CipherService>();
-    pinService = mock<PinServiceAbstraction>();
+    keyGenerationService = mock<KeyGenerationService>();
     accountService = mock<AccountService>();
 
     accountService.activeAccount$ = of({
@@ -71,7 +71,7 @@ describe("BitwardenPasswordProtectedImporter", () => {
       encryptService,
       i18nService,
       cipherService,
-      pinService,
+      keyGenerationService,
       accountService,
       promptForPassword_callback,
     );
@@ -105,7 +105,7 @@ describe("BitwardenPasswordProtectedImporter", () => {
         encryptService,
         i18nService,
         cipherService,
-        pinService,
+        keyGenerationService,
         accountService,
         promptForPassword_callback,
       );
diff --git a/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.ts b/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.ts
index 7062089482d..b685ddf0fb5 100644
--- a/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.ts
+++ b/libs/importer/src/importers/bitwarden/bitwarden-password-protected-importer.ts
@@ -1,9 +1,9 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
@@ -29,7 +29,7 @@ export class BitwardenPasswordProtectedImporter extends BitwardenJsonImporter im
     encryptService: EncryptService,
     i18nService: I18nService,
     cipherService: CipherService,
-    private pinService: PinServiceAbstraction,
+    private keyGenerationService: KeyGenerationService,
     accountService: AccountService,
     private promptForPassword_callback: () => Promise<string>,
   ) {
@@ -86,7 +86,7 @@ export class BitwardenPasswordProtectedImporter extends BitwardenJsonImporter im
         ? new PBKDF2KdfConfig(jdoc.kdfIterations)
         : new Argon2KdfConfig(jdoc.kdfIterations, jdoc.kdfMemory, jdoc.kdfParallelism);
 
-    this.key = await this.pinService.makePinKey(password, jdoc.salt, kdfConfig);
+    this.key = await this.keyGenerationService.deriveVaultExportKey(password, jdoc.salt, kdfConfig);
 
     const encKeyValidation = new EncString(jdoc.encKeyValidation_DO_NOT_EDIT);
 
diff --git a/libs/importer/src/services/import.service.spec.ts b/libs/importer/src/services/import.service.spec.ts
index b1c028ff063..b82772669de 100644
--- a/libs/importer/src/services/import.service.spec.ts
+++ b/libs/importer/src/services/import.service.spec.ts
@@ -8,8 +8,8 @@ import {
   CollectionView,
 } from "@bitwarden/admin-console/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
@@ -36,7 +36,7 @@ describe("ImportService", () => {
   let collectionService: MockProxy<CollectionService>;
   let keyService: MockProxy<KeyService>;
   let encryptService: MockProxy<EncryptService>;
-  let pinService: MockProxy<PinServiceAbstraction>;
+  let keyGenerationService: MockProxy<KeyGenerationService>;
   let accountService: MockProxy<AccountService>;
   let restrictedItemTypesService: MockProxy<RestrictedItemTypesService>;
 
@@ -48,7 +48,7 @@ describe("ImportService", () => {
     collectionService = mock<CollectionService>();
     keyService = mock<KeyService>();
     encryptService = mock<EncryptService>();
-    pinService = mock<PinServiceAbstraction>();
+    keyGenerationService = mock<KeyGenerationService>();
     restrictedItemTypesService = mock<RestrictedItemTypesService>();
 
     importService = new ImportService(
@@ -59,7 +59,7 @@ describe("ImportService", () => {
       collectionService,
       keyService,
       encryptService,
-      pinService,
+      keyGenerationService,
       accountService,
       restrictedItemTypesService,
     );
diff --git a/libs/importer/src/services/import.service.ts b/libs/importer/src/services/import.service.ts
index f62054f9414..400beae5179 100644
--- a/libs/importer/src/services/import.service.ts
+++ b/libs/importer/src/services/import.service.ts
@@ -12,8 +12,8 @@ import {
 } from "@bitwarden/admin-console/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { ImportCiphersRequest } from "@bitwarden/common/models/request/import-ciphers.request";
 import { ImportOrganizationCiphersRequest } from "@bitwarden/common/models/request/import-organization-ciphers.request";
 import { KvpRequest } from "@bitwarden/common/models/request/kvp.request";
@@ -119,7 +119,7 @@ export class ImportService implements ImportServiceAbstraction {
     private collectionService: CollectionService,
     private keyService: KeyService,
     private encryptService: EncryptService,
-    private pinService: PinServiceAbstraction,
+    private keyGenerationService: KeyGenerationService,
     private accountService: AccountService,
     private restrictedItemTypesService: RestrictedItemTypesService,
   ) {}
@@ -238,7 +238,7 @@ export class ImportService implements ImportServiceAbstraction {
           this.encryptService,
           this.i18nService,
           this.cipherService,
-          this.pinService,
+          this.keyGenerationService,
           this.accountService,
           promptForPassword_callback,
         );
diff --git a/libs/key-management-ui/src/index.ts b/libs/key-management-ui/src/index.ts
index d681d469123..b273b49cb73 100644
--- a/libs/key-management-ui/src/index.ts
+++ b/libs/key-management-ui/src/index.ts
@@ -12,3 +12,4 @@ export { ConfirmKeyConnectorDomainComponent } from "./key-connector/confirm-key-
 export { SessionTimeoutSettingsComponent } from "./session-timeout/components/session-timeout-settings.component";
 export { SessionTimeoutSettingsComponentService } from "./session-timeout/services/session-timeout-settings-component.service";
 export { SessionTimeoutInputComponent } from "./session-timeout/components/session-timeout-input.component";
+export { SessionTimeoutInputLegacyComponent } from "./session-timeout/components/session-timeout-input-legacy.component";
diff --git a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.html b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.html
index 11b34a8409f..b3bed15c698 100644
--- a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.html
+++ b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.html
@@ -8,17 +8,34 @@
     <span class="tw-sr-only">{{ "loading" | i18n }}</span>
   </div>
 } @else {
-  <div class="tw-mb-4">
-    <p class="tw-mb-1 tw-text-sm tw-font-medium">{{ "keyConnectorDomain" | i18n }}:</p>
-    <p class="tw-text-muted tw-break-all">{{ keyConnectorUrl }}</p>
-  </div>
+  @if (organizationName) {
+    <p>{{ "confirmKeyConnectorOrganizationUserDescription" | i18n }}</p>
+
+    <p class="tw-mb-0 tw-font-bold">{{ "organization" | i18n }}</p>
+    <p class="tw-mb-6">{{ organizationName }}</p>
+  } @else {
+    <p>{{ "verifyYourDomainDescription" | i18n }}</p>
+  }
+
+  <p class="tw-mb-0 tw-font-bold tw-inline-flex tw-items-center">
+    {{ "domain" | i18n }}
+    <button
+      type="button"
+      [label]="'keyConnectorDomainTooltip' | i18n"
+      tooltipPosition="above-center"
+      bitIconButton="bwi-info-circle"
+      size="small"
+    ></button>
+  </p>
+  <p class="tw-mb-6 tw-font-mono">{{ keyConnectorHostName }}</p>
 
   <div class="tw-flex tw-flex-col tw-gap-2">
     <button bitButton type="button" buttonType="primary" [bitAction]="confirm" [block]="true">
-      {{ "confirm" | i18n }}
+      {{ "continueWithLogIn" | i18n }}
     </button>
+
     <button bitButton type="button" buttonType="secondary" [bitAction]="cancel" [block]="true">
-      {{ "cancel" | i18n }}
+      {{ "doNotContinue" | i18n }}
     </button>
   </div>
 }
diff --git a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.spec.ts b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.spec.ts
index b53b0a196f5..ad0b783eee3 100644
--- a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.spec.ts
+++ b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.spec.ts
@@ -2,13 +2,17 @@ import { Router } from "@angular/router";
 import { mock } from "jest-mock-extended";
 import { of } from "rxjs";
 
+import { KeyConnectorApiService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector-api.service";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { KeyConnectorDomainConfirmation } from "@bitwarden/common/key-management/key-connector/models/key-connector-domain-confirmation";
+import { KeyConnectorConfirmationDetailsResponse } from "@bitwarden/common/key-management/key-connector/models/response/key-connector-confirmation-details.response";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { mockAccountServiceWith } from "@bitwarden/common/spec";
 import { UserId } from "@bitwarden/common/types/guid";
+import { AnonLayoutWrapperDataService, ToastService } from "@bitwarden/components";
 
 import { ConfirmKeyConnectorDomainComponent } from "./confirm-key-connector-domain.component";
 
@@ -16,8 +20,10 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
   let component: ConfirmKeyConnectorDomainComponent;
 
   const userId = "test-user-id" as UserId;
+  const expectedHostName = "key-connector-url.com";
   const confirmation: KeyConnectorDomainConfirmation = {
     keyConnectorUrl: "https://key-connector-url.com",
+    organizationSsoIdentifier: "org-sso-identifier",
   };
 
   const mockRouter = mock<Router>();
@@ -25,6 +31,10 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
   const mockKeyConnectorService = mock<KeyConnectorService>();
   const mockLogService = mock<LogService>();
   const mockMessagingService = mock<MessagingService>();
+  const mockKeyConnectorApiService = mock<KeyConnectorApiService>();
+  const mockToastService = mock<ToastService>();
+  const mockI18nService = mock<I18nService>();
+  const mockAnonLayoutWrapperDataService = mock<AnonLayoutWrapperDataService>();
   let mockAccountService = mockAccountServiceWith(userId);
   const onBeforeNavigation = jest.fn();
 
@@ -33,6 +43,8 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
 
     mockAccountService = mockAccountServiceWith(userId);
 
+    mockI18nService.t.mockImplementation((key) => `${key}-used-i18n`);
+
     component = new ConfirmKeyConnectorDomainComponent(
       mockRouter,
       mockLogService,
@@ -40,6 +52,10 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
       mockMessagingService,
       mockSyncService,
       mockAccountService,
+      mockKeyConnectorApiService,
+      mockToastService,
+      mockI18nService,
+      mockAnonLayoutWrapperDataService,
     );
 
     jest.spyOn(component, "onBeforeNavigation").mockImplementation(onBeforeNavigation);
@@ -67,17 +83,41 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
       expect(component.loading).toEqual(true);
     });
 
+    it("sets organization name to undefined when getOrganizationName throws error", async () => {
+      mockKeyConnectorApiService.getConfirmationDetails.mockRejectedValue(new Error("API error"));
+
+      await component.ngOnInit();
+
+      expect(component.organizationName).toBeUndefined();
+      expect(component.userId).toEqual(userId);
+      expect(component.keyConnectorUrl).toEqual(confirmation.keyConnectorUrl);
+      expect(component.keyConnectorHostName).toEqual(expectedHostName);
+      expect(component.loading).toEqual(false);
+      expect(mockAnonLayoutWrapperDataService.setAnonLayoutWrapperData).toHaveBeenCalledWith({
+        pageTitle: { key: "verifyYourDomainToLogin" },
+      });
+    });
+
     it("should set component properties correctly", async () => {
+      const expectedOrgName = "Test Organization";
+      mockKeyConnectorApiService.getConfirmationDetails.mockResolvedValue({
+        organizationName: expectedOrgName,
+      } as KeyConnectorConfirmationDetailsResponse);
+
       await component.ngOnInit();
 
       expect(component.userId).toEqual(userId);
+      expect(component.organizationName).toEqual(expectedOrgName);
       expect(component.keyConnectorUrl).toEqual(confirmation.keyConnectorUrl);
+      expect(component.keyConnectorHostName).toEqual(expectedHostName);
       expect(component.loading).toEqual(false);
     });
   });
 
   describe("confirm", () => {
-    it("should call keyConnectorService.convertNewSsoUserToKeyConnector with full sync and navigation to home page", async () => {
+    it("calls domain verified toast when organization name is not set", async () => {
+      mockKeyConnectorApiService.getConfirmationDetails.mockRejectedValue(new Error("API error"));
+
       await component.ngOnInit();
 
       await component.confirm();
@@ -94,6 +134,43 @@ describe("ConfirmKeyConnectorDomainComponent", () => {
       expect(mockSyncService.fullSync.mock.invocationCallOrder[0]).toBeLessThan(
         mockMessagingService.send.mock.invocationCallOrder[0],
       );
+      expect(mockToastService.showToast).toHaveBeenCalledWith({
+        variant: "success",
+        message: "domainVerified-used-i18n",
+      });
+      expect(mockMessagingService.send.mock.invocationCallOrder[0]).toBeLessThan(
+        onBeforeNavigation.mock.invocationCallOrder[0],
+      );
+      expect(onBeforeNavigation.mock.invocationCallOrder[0]).toBeLessThan(
+        mockRouter.navigate.mock.invocationCallOrder[0],
+      );
+    });
+
+    it("should call keyConnectorService.convertNewSsoUserToKeyConnector with full sync and navigation to home page", async () => {
+      mockKeyConnectorApiService.getConfirmationDetails.mockResolvedValue({
+        organizationName: "Test Org Name",
+      } as KeyConnectorConfirmationDetailsResponse);
+
+      await component.ngOnInit();
+
+      await component.confirm();
+
+      expect(mockKeyConnectorService.convertNewSsoUserToKeyConnector).toHaveBeenCalledWith(userId);
+      expect(mockSyncService.fullSync).toHaveBeenCalledWith(true);
+      expect(mockRouter.navigate).toHaveBeenCalledWith(["/"]);
+      expect(mockMessagingService.send).toHaveBeenCalledWith("loggedIn");
+      expect(onBeforeNavigation).toHaveBeenCalled();
+
+      expect(
+        mockKeyConnectorService.convertNewSsoUserToKeyConnector.mock.invocationCallOrder[0],
+      ).toBeLessThan(mockSyncService.fullSync.mock.invocationCallOrder[0]);
+      expect(mockSyncService.fullSync.mock.invocationCallOrder[0]).toBeLessThan(
+        mockMessagingService.send.mock.invocationCallOrder[0],
+      );
+      expect(mockToastService.showToast).toHaveBeenCalledWith({
+        variant: "success",
+        message: "organizationVerified-used-i18n",
+      });
       expect(mockMessagingService.send.mock.invocationCallOrder[0]).toBeLessThan(
         onBeforeNavigation.mock.invocationCallOrder[0],
       );
diff --git a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.ts b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.ts
index fe96e4620ad..aa65f4c43f9 100644
--- a/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.ts
+++ b/libs/key-management-ui/src/key-connector/confirm-key-connector-domain.component.ts
@@ -5,12 +5,21 @@ import { firstValueFrom } from "rxjs";
 
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
+import { KeyConnectorApiService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector-api.service";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
+import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { SyncService } from "@bitwarden/common/platform/sync";
 import { UserId } from "@bitwarden/common/types/guid";
-import { BitActionDirective, ButtonModule } from "@bitwarden/components";
+import {
+  AnonLayoutWrapperDataService,
+  BitActionDirective,
+  ButtonModule,
+  IconButtonModule,
+  ToastService,
+} from "@bitwarden/components";
 import { I18nPipe } from "@bitwarden/ui-common";
 
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
@@ -19,11 +28,13 @@ import { I18nPipe } from "@bitwarden/ui-common";
   selector: "confirm-key-connector-domain",
   templateUrl: "confirm-key-connector-domain.component.html",
   standalone: true,
-  imports: [CommonModule, ButtonModule, I18nPipe, BitActionDirective],
+  imports: [CommonModule, ButtonModule, I18nPipe, BitActionDirective, IconButtonModule],
 })
 export class ConfirmKeyConnectorDomainComponent implements OnInit {
   loading = true;
   keyConnectorUrl!: string;
+  keyConnectorHostName!: string;
+  organizationName: string | undefined;
   userId!: UserId;
 
   // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
@@ -37,6 +48,10 @@ export class ConfirmKeyConnectorDomainComponent implements OnInit {
     private messagingService: MessagingService,
     private syncService: SyncService,
     private accountService: AccountService,
+    private keyConnectorApiService: KeyConnectorApiService,
+    private toastService: ToastService,
+    private i18nService: I18nService,
+    private anonLayoutWrapperDataService: AnonLayoutWrapperDataService,
   ) {}
 
   async ngOnInit() {
@@ -57,14 +72,36 @@ export class ConfirmKeyConnectorDomainComponent implements OnInit {
       return;
     }
 
-    this.keyConnectorUrl = confirmation.keyConnectorUrl;
+    this.organizationName = await this.getOrganizationName(confirmation.organizationSsoIdentifier);
 
+    // PM-29133 Remove during cleanup.
+    if (this.organizationName == undefined) {
+      this.anonLayoutWrapperDataService.setAnonLayoutWrapperData({
+        pageTitle: { key: "verifyYourDomainToLogin" },
+      });
+    }
+
+    this.keyConnectorUrl = confirmation.keyConnectorUrl;
+    this.keyConnectorHostName = Utils.getHostname(confirmation.keyConnectorUrl);
     this.loading = false;
   }
 
   confirm = async () => {
     await this.keyConnectorService.convertNewSsoUserToKeyConnector(this.userId);
 
+    if (this.organizationName) {
+      this.toastService.showToast({
+        variant: "success",
+        message: this.i18nService.t("organizationVerified"),
+      });
+    } else {
+      // PM-29133 Remove during cleanup.
+      this.toastService.showToast({
+        variant: "success",
+        message: this.i18nService.t("domainVerified"),
+      });
+    }
+
     await this.syncService.fullSync(true);
 
     this.messagingService.send("loggedIn");
@@ -77,4 +114,22 @@ export class ConfirmKeyConnectorDomainComponent implements OnInit {
   cancel = async () => {
     this.messagingService.send("logout");
   };
+
+  private async getOrganizationName(
+    organizationSsoIdentifier: string,
+  ): Promise<string | undefined> {
+    try {
+      const details =
+        await this.keyConnectorApiService.getConfirmationDetails(organizationSsoIdentifier);
+      return details.organizationName;
+    } catch (error) {
+      // PM-29133 Remove during cleanup.
+      // Old self hosted servers may not have this endpoint yet. On error log a warning and continue without organization name.
+      this.logService.warning(
+        `[ConfirmKeyConnectorDomainComponent] Unable to get key connector confirmation details for organizationSsoIdentifier ${organizationSsoIdentifier}:`,
+        error,
+      );
+      return undefined;
+    }
+  }
 }
diff --git a/libs/key-management-ui/src/key-connector/remove-password.component.html b/libs/key-management-ui/src/key-connector/remove-password.component.html
new file mode 100644
index 00000000000..42cee2fe168
--- /dev/null
+++ b/libs/key-management-ui/src/key-connector/remove-password.component.html
@@ -0,0 +1,35 @@
+@if (loading) {
+  <div class="tw-text-center">
+    <i
+      class="bwi bwi-spinner bwi-spin bwi-2x tw-text-muted"
+      title="{{ 'loading' | i18n }}"
+      aria-hidden="true"
+    ></i>
+    <span class="tw-sr-only">{{ "loading" | i18n }}</span>
+  </div>
+} @else {
+  <p>{{ "removeMasterPasswordForOrgUserKeyConnector" | i18n }}</p>
+  <p class="tw-mb-0 tw-font-bold">{{ "organization" | i18n }}</p>
+  <p class="tw-mb-6">{{ organization.name }}</p>
+  <p class="tw-mb-0 tw-font-bold tw-inline-flex tw-items-center">
+    {{ "domain" | i18n }}
+    <button
+      type="button"
+      [label]="'keyConnectorDomainTooltip' | i18n"
+      tooltipPosition="above-center"
+      bitIconButton="bwi-info-circle"
+      size="small"
+    ></button>
+  </p>
+  <p class="tw-mb-6 tw-font-mono">{{ keyConnectorHostName }}</p>
+
+  <div class="tw-flex tw-flex-col tw-gap-2">
+    <button bitButton type="button" buttonType="primary" [block]="true" [bitAction]="convert">
+      {{ "continueWithLogIn" | i18n }}
+    </button>
+
+    <button bitButton type="button" buttonType="secondary" [block]="true" [bitAction]="leave">
+      {{ "doNotContinue" | i18n }}
+    </button>
+  </div>
+}
diff --git a/libs/key-management-ui/src/key-connector/remove-password.component.spec.ts b/libs/key-management-ui/src/key-connector/remove-password.component.spec.ts
index eb11932d931..240cddee2f9 100644
--- a/libs/key-management-ui/src/key-connector/remove-password.component.spec.ts
+++ b/libs/key-management-ui/src/key-connector/remove-password.component.spec.ts
@@ -19,6 +19,7 @@ describe("RemovePasswordComponent", () => {
   let component: RemovePasswordComponent;
 
   const userId = "test-user-id" as UserId;
+  const expectedHostName = "key-connector-url.com";
   const organization = {
     id: "test-organization-id",
     name: "test-organization-name",
@@ -62,6 +63,7 @@ describe("RemovePasswordComponent", () => {
       expect(component["activeUserId"]).toBe("test-user-id");
       expect(component.organization).toEqual(organization);
       expect(component.loading).toEqual(false);
+      expect(component.keyConnectorHostName).toBe(expectedHostName);
 
       expect(mockKeyConnectorService.getManagingOrganization).toHaveBeenCalledWith(userId);
       expect(mockSyncService.fullSync).toHaveBeenCalledWith(false);
diff --git a/libs/key-management-ui/src/key-connector/remove-password.component.ts b/libs/key-management-ui/src/key-connector/remove-password.component.ts
index a31989ffc49..bb17475230d 100644
--- a/libs/key-management-ui/src/key-connector/remove-password.component.ts
+++ b/libs/key-management-ui/src/key-connector/remove-password.component.ts
@@ -1,4 +1,5 @@
-import { Directive, OnInit } from "@angular/core";
+import { CommonModule } from "@angular/common";
+import { Component, OnInit } from "@angular/core";
 import { Router } from "@angular/router";
 import { firstValueFrom } from "rxjs";
 
@@ -9,17 +10,33 @@ import { KeyConnectorService } from "@bitwarden/common/key-management/key-connec
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { UserId } from "@bitwarden/common/types/guid";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
-import { DialogService, ToastService } from "@bitwarden/components";
+import {
+  DialogService,
+  ToastService,
+  ButtonModule,
+  BitActionDirective,
+  IconButtonModule,
+} from "@bitwarden/components";
+import { I18nPipe } from "@bitwarden/ui-common";
 
-@Directive()
+// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
+// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
+@Component({
+  selector: "km-ui-remove-password",
+  templateUrl: "remove-password.component.html",
+  standalone: true,
+  imports: [CommonModule, ButtonModule, I18nPipe, BitActionDirective, IconButtonModule],
+})
 export class RemovePasswordComponent implements OnInit {
   continuing = false;
   leaving = false;
 
   loading = true;
   organization!: Organization;
+  keyConnectorHostName!: string;
   private activeUserId!: UserId;
 
   constructor(
@@ -55,6 +72,7 @@ export class RemovePasswordComponent implements OnInit {
       await this.router.navigate(["/"]);
       return;
     }
+    this.keyConnectorHostName = Utils.getHostname(this.organization.keyConnectorUrl);
     this.loading = false;
   }
 
@@ -73,7 +91,7 @@ export class RemovePasswordComponent implements OnInit {
 
       this.toastService.showToast({
         variant: "success",
-        message: this.i18nService.t("removedMasterPassword"),
+        message: this.i18nService.t("organizationVerified"),
       });
 
       await this.router.navigate(["/"]);
@@ -86,9 +104,11 @@ export class RemovePasswordComponent implements OnInit {
 
   leave = async () => {
     const confirmed = await this.dialogService.openSimpleDialog({
-      title: this.organization.name,
-      content: { key: "leaveOrganizationConfirmation" },
+      title: { key: "leaveOrganization" },
+      content: { key: "leaveOrganizationContent" },
       type: "warning",
+      acceptButtonText: { key: "leaveNow" },
+      cancelButtonText: { key: "cancel" },
     });
 
     if (!confirmed) {
diff --git a/libs/key-management-ui/src/lock/components/lock.component.html b/libs/key-management-ui/src/lock/components/lock.component.html
index 77f603204b3..71201361a0c 100644
--- a/libs/key-management-ui/src/lock/components/lock.component.html
+++ b/libs/key-management-ui/src/lock/components/lock.component.html
@@ -16,6 +16,7 @@
       [disabled]="unlockingViaBiometrics || !biometricsAvailable"
       [loading]="unlockingViaBiometrics"
       block
+      [bitTooltip]="biometricUnavailabilityReason"
       (click)="unlockViaBiometrics()"
     >
       <span> {{ biometricUnlockBtnText | i18n }}</span>
diff --git a/libs/key-management-ui/src/lock/components/lock.component.spec.ts b/libs/key-management-ui/src/lock/components/lock.component.spec.ts
index b51d4c13490..5d35746ff19 100644
--- a/libs/key-management-ui/src/lock/components/lock.component.spec.ts
+++ b/libs/key-management-ui/src/lock/components/lock.component.spec.ts
@@ -2,7 +2,7 @@ import { DebugElement } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { By } from "@angular/platform-browser";
-import { Router } from "@angular/router";
+import { ActivatedRoute, Router } from "@angular/router";
 import { mock } from "jest-mock-extended";
 import { firstValueFrom, interval, map, of, takeWhile, timeout } from "rxjs";
 import { ZXCVBNResult } from "zxcvbn";
@@ -11,7 +11,7 @@ import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { LogoutService } from "@bitwarden/auth/common";
 import { InternalPolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { Account, AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
@@ -22,6 +22,7 @@ import {
 } from "@bitwarden/common/auth/types/verification";
 import { ClientType, DeviceType } from "@bitwarden/common/enums";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
@@ -56,6 +57,7 @@ import {
 import {
   LockComponentService,
   UnlockOption,
+  UnlockOptionValue,
   UnlockOptions,
 } from "../services/lock-component.service";
 
@@ -91,7 +93,15 @@ describe("LockComponent", () => {
   const mockLockComponentService = mock<LockComponentService>();
   const mockAnonLayoutWrapperDataService = mock<AnonLayoutWrapperDataService>();
   const mockBroadcasterService = mock<BroadcasterService>();
+  const mockEncryptedMigrator = mock<EncryptedMigrator>();
   const mockConfigService = mock<ConfigService>();
+  const mockActivatedRoute = {
+    snapshot: {
+      paramMap: {
+        get: jest.fn().mockReturnValue(null), // return null for 'disable-redirect' param
+      },
+    },
+  };
 
   beforeEach(async () => {
     jest.resetAllMocks();
@@ -149,6 +159,8 @@ describe("LockComponent", () => {
         { provide: LockComponentService, useValue: mockLockComponentService },
         { provide: AnonLayoutWrapperDataService, useValue: mockAnonLayoutWrapperDataService },
         { provide: BroadcasterService, useValue: mockBroadcasterService },
+        { provide: ActivatedRoute, useValue: mockActivatedRoute },
+        { provide: EncryptedMigrator, useValue: mockEncryptedMigrator },
         { provide: ConfigService, useValue: mockConfigService },
       ],
     })
@@ -464,6 +476,14 @@ describe("LockComponent", () => {
         component.clientType = clientType;
         mockLockComponentService.getPreviousUrl.mockReturnValue(null);
 
+        jest.spyOn(component as any, "doContinue").mockImplementation(async () => {
+          await mockBiometricStateService.resetUserPromptCancelled();
+          mockMessagingService.send("unlocked");
+          await mockSyncService.fullSync(false);
+          await mockUserAsymmetricKeysRegenerationService.regenerateIfNeeded(userId);
+          await mockRouter.navigate([navigateUrl]);
+        });
+
         await component.successfulMasterPasswordUnlock({ userKey: mockUserKey, masterPassword });
 
         assertUnlocked();
@@ -475,6 +495,16 @@ describe("LockComponent", () => {
       component.shouldClosePopout = true;
       mockPlatformUtilsService.getDevice.mockReturnValue(DeviceType.FirefoxExtension);
 
+      jest.spyOn(component as any, "doContinue").mockImplementation(async () => {
+        await mockBiometricStateService.resetUserPromptCancelled();
+        mockMessagingService.send("unlocked");
+        await mockSyncService.fullSync(false);
+        await mockUserAsymmetricKeysRegenerationService.regenerateIfNeeded(
+          component.activeAccount!.id,
+        );
+        mockLockComponentService.closeBrowserExtensionPopout();
+      });
+
       await component.successfulMasterPasswordUnlock({ userKey: mockUserKey, masterPassword });
 
       assertUnlocked();
@@ -608,6 +638,32 @@ describe("LockComponent", () => {
     ])(
       "should unlock and force set password change = %o when master password on login = %o and evaluated password against policy = %o and policy set during user verification by master password",
       async (forceSetPassword, masterPasswordPolicyOptions, evaluatedMasterPassword) => {
+        jest.spyOn(component as any, "doContinue").mockImplementation(async () => {
+          await mockBiometricStateService.resetUserPromptCancelled();
+          mockMessagingService.send("unlocked");
+
+          if (masterPasswordPolicyOptions?.enforceOnLogin) {
+            const passwordStrengthResult = mockPasswordStrengthService.getPasswordStrength(
+              masterPassword,
+              component.activeAccount!.email,
+            );
+            const evaluated = mockPolicyService.evaluateMasterPassword(
+              passwordStrengthResult.score,
+              masterPassword,
+              masterPasswordPolicyOptions,
+            );
+            if (!evaluated) {
+              await mockMasterPasswordService.setForceSetPasswordReason(
+                ForceSetPasswordReason.WeakMasterPassword,
+                userId,
+              );
+            }
+          }
+
+          await mockSyncService.fullSync(false);
+          await mockUserAsymmetricKeysRegenerationService.regenerateIfNeeded(userId);
+        });
+
         mockUserVerificationService.verifyUserByMasterPassword.mockResolvedValue({
           ...masterPasswordVerificationResponse,
           policyOptions:
@@ -722,6 +778,14 @@ describe("LockComponent", () => {
         component.clientType = clientType;
         mockLockComponentService.getPreviousUrl.mockReturnValue(null);
 
+        jest.spyOn(component as any, "doContinue").mockImplementation(async () => {
+          await mockBiometricStateService.resetUserPromptCancelled();
+          mockMessagingService.send("unlocked");
+          await mockSyncService.fullSync(false);
+          await mockUserAsymmetricKeysRegenerationService.regenerateIfNeeded(userId);
+          await mockRouter.navigate([navigateUrl]);
+        });
+
         await component.unlockViaMasterPassword();
 
         assertUnlocked();
@@ -733,6 +797,16 @@ describe("LockComponent", () => {
       component.shouldClosePopout = true;
       mockPlatformUtilsService.getDevice.mockReturnValue(DeviceType.FirefoxExtension);
 
+      jest.spyOn(component as any, "doContinue").mockImplementation(async () => {
+        await mockBiometricStateService.resetUserPromptCancelled();
+        mockMessagingService.send("unlocked");
+        await mockSyncService.fullSync(false);
+        await mockUserAsymmetricKeysRegenerationService.regenerateIfNeeded(
+          component.activeAccount!.id,
+        );
+        mockLockComponentService.closeBrowserExtensionPopout();
+      });
+
       await component.unlockViaMasterPassword();
 
       assertUnlocked();
@@ -805,4 +879,250 @@ describe("LockComponent", () => {
       expect(mockRouter.navigate).not.toHaveBeenCalled();
     });
   });
+
+  describe("setDefaultActiveUnlockOption", () => {
+    it.each([
+      [
+        "biometrics enabled",
+        {
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "biometrics disabled, pin enabled",
+        {
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.NotEnabledLocally },
+          pin: { enabled: true },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Pin,
+      ],
+      [
+        "biometrics and pin disabled, masterPassword enabled",
+        {
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.NotEnabledLocally },
+          pin: { enabled: false },
+          masterPassword: { enabled: true },
+        } as UnlockOptions,
+        UnlockOption.MasterPassword,
+      ],
+      [
+        "hardware unavailable, no other options",
+        {
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.HardwareUnavailable },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "desktop disconnected, no other options",
+        {
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.DesktopDisconnected },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "not enabled in connected desktop app, no other options",
+        {
+          biometrics: {
+            enabled: false,
+            biometricsStatus: BiometricsStatus.NotEnabledInConnectedDesktopApp,
+          },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "biometrics over pin priority",
+        {
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: true },
+          masterPassword: { enabled: false },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "biometrics over masterPassword priority",
+        {
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: false },
+          masterPassword: { enabled: true },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+      [
+        "pin over masterPassword priority",
+        {
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.NotEnabledLocally },
+          pin: { enabled: true },
+          masterPassword: { enabled: true },
+        } as UnlockOptions,
+        UnlockOption.Pin,
+      ],
+      [
+        "all options enabled",
+        {
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: true },
+          masterPassword: { enabled: true },
+        } as UnlockOptions,
+        UnlockOption.Biometrics,
+      ],
+    ])(
+      "should set active unlock option to $1 when %s",
+      async (
+        description: string,
+        unlockOptions: UnlockOptions,
+        expectedOption: UnlockOptionValue,
+      ) => {
+        await component["setDefaultActiveUnlockOption"](unlockOptions);
+
+        expect(component.activeUnlockOption).toBe(expectedOption);
+      },
+    );
+  });
+
+  describe("handleActiveAccountChange", () => {
+    const mockActiveAccount: Account = {
+      id: userId,
+      email: "test@example.com",
+      name: "Test User",
+    } as Account;
+
+    beforeEach(async () => {
+      component.activeAccount = mockActiveAccount;
+    });
+
+    it("should return early when account already has user key", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(true);
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockKeyService.hasUserKey).toHaveBeenCalledWith(userId);
+      expect(mockAnonLayoutWrapperDataService.setAnonLayoutWrapperData).not.toHaveBeenCalled();
+    });
+
+    it("should set email as page subtitle when account is unlocked", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(BiometricsStatus.Available);
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockAnonLayoutWrapperDataService.setAnonLayoutWrapperData).toHaveBeenCalledWith({
+        pageSubtitle: mockActiveAccount.email,
+      });
+    });
+
+    it("should logout user when no unlock options are available", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.UnlockNeeded },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(
+        BiometricsStatus.UnlockNeeded,
+      );
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockLogService.warning).toHaveBeenCalledWith(
+        "[LockComponent] User cannot unlock again. Logging out!",
+      );
+      expect(mockLogoutService.logout).toHaveBeenCalledWith(userId);
+    });
+
+    it("should not logout when master password is enabled", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.UnlockNeeded },
+          pin: { enabled: false },
+          masterPassword: { enabled: true },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(
+        BiometricsStatus.UnlockNeeded,
+      );
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockLogoutService.logout).not.toHaveBeenCalled();
+      expect(component.activeUnlockOption).toBe(UnlockOption.MasterPassword);
+    });
+
+    it("should not logout when pin is enabled", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: { enabled: false, biometricsStatus: BiometricsStatus.UnlockNeeded },
+          pin: { enabled: true },
+          masterPassword: { enabled: false },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(
+        BiometricsStatus.UnlockNeeded,
+      );
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockLogoutService.logout).not.toHaveBeenCalled();
+      expect(component.activeUnlockOption).toBe(UnlockOption.Pin);
+    });
+
+    it("should not logout when biometrics is available", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: { enabled: true, biometricsStatus: BiometricsStatus.Available },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(BiometricsStatus.Available);
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockLogoutService.logout).not.toHaveBeenCalled();
+      expect(component.activeUnlockOption).toBe(UnlockOption.Biometrics);
+    });
+
+    it("should not logout when biometrics is temporarily unavailable but no other options", async () => {
+      mockKeyService.hasUserKey.mockResolvedValue(false);
+      mockLockComponentService.getAvailableUnlockOptions$.mockReturnValue(
+        of({
+          biometrics: {
+            enabled: false,
+            biometricsStatus: BiometricsStatus.HardwareUnavailable,
+          },
+          pin: { enabled: false },
+          masterPassword: { enabled: false },
+        } as UnlockOptions),
+      );
+      mockBiometricService.getBiometricsStatusForUser.mockResolvedValue(
+        BiometricsStatus.HardwareUnavailable,
+      );
+
+      await component["handleActiveAccountChange"](mockActiveAccount);
+
+      expect(mockLogoutService.logout).not.toHaveBeenCalled();
+      expect(component.activeUnlockOption).toBe(UnlockOption.Biometrics);
+    });
+  });
 });
diff --git a/libs/key-management-ui/src/lock/components/lock.component.ts b/libs/key-management-ui/src/lock/components/lock.component.ts
index 801a9d191f5..ec7ef822335 100644
--- a/libs/key-management-ui/src/lock/components/lock.component.ts
+++ b/libs/key-management-ui/src/lock/components/lock.component.ts
@@ -1,7 +1,7 @@
 import { CommonModule } from "@angular/common";
 import { Component, NgZone, OnDestroy, OnInit } from "@angular/core";
 import { FormBuilder, FormGroup, ReactiveFormsModule, Validators } from "@angular/forms";
-import { Router } from "@angular/router";
+import { Router, ActivatedRoute } from "@angular/router";
 import {
   BehaviorSubject,
   filter,
@@ -31,6 +31,7 @@ import {
 import { ClientType, DeviceType } from "@bitwarden/common/enums";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
+import { EncryptedMigrator } from "@bitwarden/common/key-management/encrypted-migrator/encrypted-migrator.abstraction";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
@@ -43,6 +44,7 @@ import { SyncService } from "@bitwarden/common/platform/sync";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
 import { UserKey } from "@bitwarden/common/types/key";
 import {
+  TooltipDirective,
   AsyncActionsModule,
   AnonLayoutWrapperDataService,
   ButtonModule,
@@ -86,6 +88,12 @@ type AfterUnlockActions = {
 /// Fixes safari autoprompt behavior
 const AUTOPROMPT_BIOMETRICS_PROCESS_RELOAD_DELAY = 5000;
 
+const BIOMETRIC_UNLOCK_TEMPORARY_UNAVAILABLE_STATUSES = [
+  BiometricsStatus.HardwareUnavailable,
+  BiometricsStatus.DesktopDisconnected,
+  BiometricsStatus.NotEnabledInConnectedDesktopApp,
+];
+
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
 // eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
@@ -100,6 +108,7 @@ const AUTOPROMPT_BIOMETRICS_PROCESS_RELOAD_DELAY = 5000;
     AsyncActionsModule,
     IconButtonModule,
     MasterPasswordLockComponent,
+    TooltipDirective,
   ],
 })
 export class LockComponent implements OnInit, OnDestroy {
@@ -159,6 +168,7 @@ export class LockComponent implements OnInit, OnDestroy {
     private keyService: KeyService,
     private platformUtilsService: PlatformUtilsService,
     private router: Router,
+    private activatedRoute: ActivatedRoute,
     private dialogService: DialogService,
     private messagingService: MessagingService,
     private biometricStateService: BiometricStateService,
@@ -177,6 +187,8 @@ export class LockComponent implements OnInit, OnDestroy {
     private logoutService: LogoutService,
     private lockComponentService: LockComponentService,
     private anonLayoutWrapperDataService: AnonLayoutWrapperDataService,
+    private encryptedMigrator: EncryptedMigrator,
+
     private configService: ConfigService,
     // desktop deps
     private broadcasterService: BroadcasterService,
@@ -208,6 +220,10 @@ export class LockComponent implements OnInit, OnDestroy {
             this.unlockOptions = await firstValueFrom(
               this.lockComponentService.getAvailableUnlockOptions$(this.activeAccount.id),
             );
+            if (this.activeUnlockOption == null) {
+              this.loading = false;
+              await this.setDefaultActiveUnlockOption(this.unlockOptions);
+            }
           }
         }),
         takeUntil(this.destroy$),
@@ -276,7 +292,22 @@ export class LockComponent implements OnInit, OnDestroy {
       this.lockComponentService.getAvailableUnlockOptions$(activeAccount.id),
     );
 
-    this.setDefaultActiveUnlockOption(this.unlockOptions);
+    const canUseBiometrics = [
+      BiometricsStatus.Available,
+      ...BIOMETRIC_UNLOCK_TEMPORARY_UNAVAILABLE_STATUSES,
+    ].includes(await this.biometricService.getBiometricsStatusForUser(activeAccount.id));
+    if (
+      !this.unlockOptions?.masterPassword.enabled &&
+      !this.unlockOptions?.pin.enabled &&
+      !canUseBiometrics
+    ) {
+      // User has no available unlock options, force logout. This happens for TDE users without a masterpassword, that don't have a persistent unlock method set.
+      this.logService.warning("[LockComponent] User cannot unlock again. Logging out!");
+      await this.logoutService.logout(activeAccount.id);
+      return;
+    }
+
+    await this.setDefaultActiveUnlockOption(this.unlockOptions);
 
     if (this.unlockOptions?.biometrics.enabled) {
       await this.handleBiometricsUnlockEnabled();
@@ -299,7 +330,7 @@ export class LockComponent implements OnInit, OnDestroy {
     });
   }
 
-  private setDefaultActiveUnlockOption(unlockOptions: UnlockOptions | null) {
+  private async setDefaultActiveUnlockOption(unlockOptions: UnlockOptions | null) {
     // Priorities should be Biometrics > Pin > Master Password for speed
     if (unlockOptions?.biometrics.enabled) {
       this.activeUnlockOption = UnlockOption.Biometrics;
@@ -307,6 +338,15 @@ export class LockComponent implements OnInit, OnDestroy {
       this.activeUnlockOption = UnlockOption.Pin;
     } else if (unlockOptions?.masterPassword.enabled) {
       this.activeUnlockOption = UnlockOption.MasterPassword;
+    } else if (
+      unlockOptions != null &&
+      BIOMETRIC_UNLOCK_TEMPORARY_UNAVAILABLE_STATUSES.includes(
+        unlockOptions.biometrics.biometricsStatus,
+      )
+    ) {
+      // If biometrics is temporarily unavailable for masterpassword-less users, but they have biometrics configured,
+      // then show the biometrics screen so the user knows why they can't unlock, and to give them the option to log out.
+      this.activeUnlockOption = UnlockOption.Biometrics;
     }
   }
 
@@ -639,6 +679,16 @@ export class LockComponent implements OnInit, OnDestroy {
     }
 
     await this.biometricStateService.resetUserPromptCancelled();
+
+    try {
+      await this.encryptedMigrator.runMigrations(
+        this.activeAccount.id,
+        afterUnlockActions.passwordEvaluation?.masterPassword ?? null,
+      );
+    } catch {
+      // Don't block login success on migration failure
+    }
+
     this.messagingService.send("unlocked");
 
     if (afterUnlockActions.passwordEvaluation) {
@@ -697,7 +747,13 @@ export class LockComponent implements OnInit, OnDestroy {
     }
 
     // determine success route based on client type
-    if (this.clientType != null) {
+    // The disable-redirect parameter allows callers to prevent automatic navigation after unlock,
+    // useful when the lock component is used in contexts where custom post-unlock behavior is needed
+    // such as passkey modals.
+    if (
+      this.clientType != null &&
+      this.activatedRoute.snapshot.paramMap.get("disable-redirect") === null
+    ) {
       const successRoute = clientTypeToSuccessRouteRecord[this.clientType];
       await this.router.navigate([successRoute]);
     }
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.html b/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.html
new file mode 100644
index 00000000000..4f1b27a8127
--- /dev/null
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.html
@@ -0,0 +1,47 @@
+<div [formGroup]="form" class="tw-mb-4">
+  <bit-form-field [disableMargin]="!showCustom">
+    <bit-label>{{ "vaultTimeout1" | i18n }}</bit-label>
+    <bit-select formControlName="vaultTimeout">
+      <bit-option
+        *ngFor="let o of filteredVaultTimeoutOptions"
+        [value]="o.value"
+        [label]="o.name"
+      ></bit-option>
+    </bit-select>
+  </bit-form-field>
+  <div class="tw-grid tw-grid-cols-12 tw-gap-4" *ngIf="showCustom" formGroupName="custom">
+    <bit-form-field class="tw-col-span-6" disableMargin>
+      <input
+        bitInput
+        type="number"
+        min="0"
+        formControlName="hours"
+        aria-labelledby="maximum-error"
+      />
+      <bit-label>{{ "hours" | i18n }}</bit-label>
+    </bit-form-field>
+    <bit-form-field class="tw-col-span-6 tw-self-end" disableMargin>
+      <input
+        bitInput
+        type="number"
+        min="0"
+        name="minutes"
+        formControlName="minutes"
+        aria-labelledby="maximum-error"
+      />
+      <bit-label>{{ "minutes" | i18n }}</bit-label>
+    </bit-form-field>
+  </div>
+  <bit-hint *ngIf="vaultTimeoutPolicy != null && !exceedsMaximumTimeout">
+    {{ "vaultTimeoutPolicyInEffect1" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes }}
+  </bit-hint>
+  <small *ngIf="!exceedsMinimumTimeout" class="tw-text-danger">
+    <i class="bwi bwi-error" aria-hidden="true"></i> {{ "vaultCustomTimeoutMinimum" | i18n }}
+  </small>
+  <small class="tw-text-danger" *ngIf="exceedsMaximumTimeout" id="maximum-error">
+    <i class="bwi bwi-error" aria-hidden="true"></i>
+    {{
+      "vaultTimeoutPolicyMaximumError" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes
+    }}
+  </small>
+</div>
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.ts b/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.ts
new file mode 100644
index 00000000000..22a53f6a53e
--- /dev/null
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-input-legacy.component.ts
@@ -0,0 +1,296 @@
+// FIXME: Update this file to be type safe and remove this and next line
+// @ts-strict-ignore
+import { CommonModule } from "@angular/common";
+import { Component, Input, OnChanges, OnDestroy, OnInit } from "@angular/core";
+import {
+  AbstractControl,
+  ControlValueAccessor,
+  FormBuilder,
+  FormControl,
+  FormGroup,
+  NG_VALIDATORS,
+  NG_VALUE_ACCESSOR,
+  ReactiveFormsModule,
+  ValidationErrors,
+  Validator,
+} from "@angular/forms";
+import { filter, map, Observable, Subject, switchMap, takeUntil } from "rxjs";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
+import { getFirstPolicy } from "@bitwarden/common/admin-console/services/policy/default-policy.service";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { getUserId } from "@bitwarden/common/auth/services/account.service";
+import {
+  VaultTimeout,
+  VaultTimeoutAction,
+  VaultTimeoutOption,
+  VaultTimeoutSettingsService,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { FormFieldModule, SelectModule } from "@bitwarden/components";
+
+type VaultTimeoutForm = FormGroup<{
+  vaultTimeout: FormControl<VaultTimeout | null>;
+  custom: FormGroup<{
+    hours: FormControl<number | null>;
+    minutes: FormControl<number | null>;
+  }>;
+}>;
+
+type VaultTimeoutFormValue = VaultTimeoutForm["value"];
+
+/**
+ * @deprecated Use {@link SessionTimeoutInputComponent} instead.
+ *
+ * TODO Cleanup once feature flag enabled: https://bitwarden.atlassian.net/browse/PM-27297
+ */
+// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
+// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
+@Component({
+  selector: "bit-session-timeout-input-legacy",
+  templateUrl: "session-timeout-input-legacy.component.html",
+  imports: [CommonModule, JslibModule, ReactiveFormsModule, FormFieldModule, SelectModule],
+  providers: [
+    {
+      provide: NG_VALUE_ACCESSOR,
+      multi: true,
+      useExisting: SessionTimeoutInputLegacyComponent,
+    },
+    {
+      provide: NG_VALIDATORS,
+      multi: true,
+      useExisting: SessionTimeoutInputLegacyComponent,
+    },
+  ],
+})
+export class SessionTimeoutInputLegacyComponent
+  implements ControlValueAccessor, Validator, OnInit, OnDestroy, OnChanges
+{
+  static CUSTOM_VALUE = -100;
+  static MIN_CUSTOM_MINUTES = 0;
+  form: VaultTimeoutForm = this.formBuilder.group({
+    vaultTimeout: [null],
+    custom: this.formBuilder.group({
+      hours: [null],
+      minutes: [null],
+    }),
+  });
+
+  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
+  // eslint-disable-next-line @angular-eslint/prefer-signals
+  @Input() vaultTimeoutOptions: VaultTimeoutOption[];
+
+  vaultTimeoutPolicy: Policy;
+  vaultTimeoutPolicyHours: number;
+  vaultTimeoutPolicyMinutes: number;
+
+  protected readonly VaultTimeoutAction = VaultTimeoutAction;
+
+  protected canLockVault$: Observable<boolean>;
+  private onChange: (vaultTimeout: VaultTimeout) => void;
+  private validatorChange: () => void;
+  private destroy$ = new Subject<void>();
+
+  constructor(
+    private formBuilder: FormBuilder,
+    private policyService: PolicyService,
+    private vaultTimeoutSettingsService: VaultTimeoutSettingsService,
+    private i18nService: I18nService,
+    private accountService: AccountService,
+  ) {}
+
+  get showCustom() {
+    return this.form.get("vaultTimeout").value === SessionTimeoutInputLegacyComponent.CUSTOM_VALUE;
+  }
+
+  get exceedsMinimumTimeout(): boolean {
+    return (
+      !this.showCustom ||
+      this.customTimeInMinutes() > SessionTimeoutInputLegacyComponent.MIN_CUSTOM_MINUTES
+    );
+  }
+
+  get exceedsMaximumTimeout(): boolean {
+    return (
+      this.showCustom &&
+      this.customTimeInMinutes() >
+        this.vaultTimeoutPolicyMinutes + 60 * this.vaultTimeoutPolicyHours
+    );
+  }
+
+  get filteredVaultTimeoutOptions(): VaultTimeoutOption[] {
+    // by policy max value
+    if (this.vaultTimeoutPolicy == null || this.vaultTimeoutPolicy.data == null) {
+      return this.vaultTimeoutOptions;
+    }
+
+    return this.vaultTimeoutOptions.filter((option) => {
+      if (typeof option.value === "number") {
+        return option.value <= this.vaultTimeoutPolicy.data.minutes;
+      }
+
+      return false;
+    });
+  }
+
+  async ngOnInit() {
+    this.accountService.activeAccount$
+      .pipe(
+        getUserId,
+        switchMap((userId) =>
+          this.policyService.policiesByType$(PolicyType.MaximumVaultTimeout, userId),
+        ),
+        getFirstPolicy,
+        filter((policy) => policy != null),
+        takeUntil(this.destroy$),
+      )
+      .subscribe((policy) => {
+        this.vaultTimeoutPolicy = policy;
+        this.applyVaultTimeoutPolicy();
+      });
+    this.form.valueChanges
+      .pipe(takeUntil(this.destroy$))
+      .subscribe((value: VaultTimeoutFormValue) => {
+        if (this.onChange) {
+          this.onChange(this.getVaultTimeout(value));
+        }
+      });
+
+    // Assign the current value to the custom fields
+    // so that if the user goes from a numeric value to custom
+    // we can initialize the custom fields with the current value
+    // ex: user picks 5 min, goes to custom, we want to show 0 hr, 5 min in the custom fields
+    this.form.controls.vaultTimeout.valueChanges
+      .pipe(
+        filter((value) => value !== SessionTimeoutInputLegacyComponent.CUSTOM_VALUE),
+        takeUntil(this.destroy$),
+      )
+      .subscribe((value) => {
+        const current = typeof value === "string" ? 0 : Math.max(value, 0);
+
+        // This cannot emit an event b/c it would cause form.valueChanges to fire again
+        // and we are already handling that above so just silently update
+        // custom fields when vaultTimeout changes to a non-custom value
+        this.form.patchValue(
+          {
+            custom: {
+              hours: Math.floor(current / 60),
+              minutes: current % 60,
+            },
+          },
+          { emitEvent: false },
+        );
+      });
+
+    this.canLockVault$ = this.vaultTimeoutSettingsService
+      .availableVaultTimeoutActions$()
+      .pipe(map((actions) => actions.includes(VaultTimeoutAction.Lock)));
+  }
+
+  ngOnDestroy() {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+
+  ngOnChanges() {
+    if (
+      !this.vaultTimeoutOptions.find(
+        (p) => p.value === SessionTimeoutInputLegacyComponent.CUSTOM_VALUE,
+      )
+    ) {
+      this.vaultTimeoutOptions.push({
+        name: this.i18nService.t("custom"),
+        value: SessionTimeoutInputLegacyComponent.CUSTOM_VALUE,
+      });
+    }
+  }
+
+  getVaultTimeout(value: VaultTimeoutFormValue) {
+    if (value.vaultTimeout !== SessionTimeoutInputLegacyComponent.CUSTOM_VALUE) {
+      return value.vaultTimeout;
+    }
+
+    return value.custom.hours * 60 + value.custom.minutes;
+  }
+
+  writeValue(value: number): void {
+    if (value == null) {
+      return;
+    }
+
+    if (this.vaultTimeoutOptions.every((p) => p.value !== value)) {
+      this.form.setValue({
+        vaultTimeout: SessionTimeoutInputLegacyComponent.CUSTOM_VALUE,
+        custom: {
+          hours: Math.floor(value / 60),
+          minutes: value % 60,
+        },
+      });
+      return;
+    }
+
+    this.form.patchValue({
+      vaultTimeout: value,
+    });
+  }
+
+  registerOnChange(onChange: any): void {
+    this.onChange = onChange;
+  }
+
+  registerOnTouched(onTouched: any): void {
+    // Empty
+  }
+
+  setDisabledState?(isDisabled: boolean): void {
+    // Empty
+  }
+
+  validate(control: AbstractControl): ValidationErrors {
+    if (this.vaultTimeoutPolicy && this.vaultTimeoutPolicy?.data?.minutes < control.value) {
+      return { policyError: true };
+    }
+
+    if (!this.exceedsMinimumTimeout) {
+      return { minTimeoutError: true };
+    }
+
+    return null;
+  }
+
+  registerOnValidatorChange(fn: () => void): void {
+    this.validatorChange = fn;
+  }
+
+  private customTimeInMinutes() {
+    return this.form.value.custom.hours * 60 + this.form.value.custom.minutes;
+  }
+
+  private applyVaultTimeoutPolicy() {
+    this.vaultTimeoutPolicyHours = Math.floor(this.vaultTimeoutPolicy.data.minutes / 60);
+    this.vaultTimeoutPolicyMinutes = this.vaultTimeoutPolicy.data.minutes % 60;
+
+    this.vaultTimeoutOptions = this.vaultTimeoutOptions.filter((vaultTimeoutOption) => {
+      // Always include the custom option
+      if (vaultTimeoutOption.value === SessionTimeoutInputLegacyComponent.CUSTOM_VALUE) {
+        return true;
+      }
+
+      if (typeof vaultTimeoutOption.value === "number") {
+        // Include numeric values that are less than or equal to the policy minutes
+        return vaultTimeoutOption.value <= this.vaultTimeoutPolicy.data.minutes;
+      }
+
+      // Exclude all string cases when there's a numeric policy defined
+      return false;
+    });
+
+    // Only call validator change if it's been set
+    if (this.validatorChange) {
+      this.validatorChange();
+    }
+  }
+}
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.html b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.html
index 4f1b27a8127..9a8de253d5f 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.html
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.html
@@ -1,47 +1,51 @@
 <div [formGroup]="form" class="tw-mb-4">
-  <bit-form-field [disableMargin]="!showCustom">
+  <bit-form-field [disableMargin]="!isCustomTimeoutType">
     <bit-label>{{ "vaultTimeout1" | i18n }}</bit-label>
     <bit-select formControlName="vaultTimeout">
-      <bit-option
-        *ngFor="let o of filteredVaultTimeoutOptions"
-        [value]="o.value"
-        [label]="o.name"
-      ></bit-option>
+      @for (option of availableTimeoutOptions(); track option.value) {
+        <bit-option [value]="option.value" [label]="option.name | i18n"></bit-option>
+      }
     </bit-select>
   </bit-form-field>
-  <div class="tw-grid tw-grid-cols-12 tw-gap-4" *ngIf="showCustom" formGroupName="custom">
-    <bit-form-field class="tw-col-span-6" disableMargin>
-      <input
-        bitInput
-        type="number"
-        min="0"
-        formControlName="hours"
-        aria-labelledby="maximum-error"
-      />
-      <bit-label>{{ "hours" | i18n }}</bit-label>
-    </bit-form-field>
-    <bit-form-field class="tw-col-span-6 tw-self-end" disableMargin>
-      <input
-        bitInput
-        type="number"
-        min="0"
-        name="minutes"
-        formControlName="minutes"
-        aria-labelledby="maximum-error"
-      />
-      <bit-label>{{ "minutes" | i18n }}</bit-label>
-    </bit-form-field>
-  </div>
-  <bit-hint *ngIf="vaultTimeoutPolicy != null && !exceedsMaximumTimeout">
-    {{ "vaultTimeoutPolicyInEffect1" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes }}
-  </bit-hint>
-  <small *ngIf="!exceedsMinimumTimeout" class="tw-text-danger">
-    <i class="bwi bwi-error" aria-hidden="true"></i> {{ "vaultCustomTimeoutMinimum" | i18n }}
-  </small>
-  <small class="tw-text-danger" *ngIf="exceedsMaximumTimeout" id="maximum-error">
-    <i class="bwi bwi-error" aria-hidden="true"></i>
-    {{
-      "vaultTimeoutPolicyMaximumError" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes
-    }}
-  </small>
+  @if (isCustomTimeoutType) {
+    <div class="tw-grid tw-grid-cols-12 tw-gap-4" formGroupName="custom">
+      <bit-form-field class="tw-col-span-6" disableMargin>
+        <input
+          bitInput
+          type="number"
+          min="0"
+          formControlName="hours"
+          aria-describedby="session-timeout-maximum-error"
+        />
+        <bit-label>{{ "hours" | i18n }}</bit-label>
+      </bit-form-field>
+      <bit-form-field class="tw-col-span-6 tw-self-start" disableMargin>
+        <input
+          bitInput
+          type="number"
+          [min]="customMinutesMin"
+          max="59"
+          formControlName="minutes"
+          aria-describedby="session-timeout-maximum-error"
+        />
+        <bit-label>{{ "minutes" | i18n }}</bit-label>
+      </bit-form-field>
+    </div>
+  }
+  @if (form.hasError("maxTimeoutError")) {
+    <div class="tw-mt-1 tw-text-danger tw-text-xs" id="session-timeout-maximum-error">
+      <i class="bwi bwi-error" aria-hidden="true"></i>
+      {{
+        "sessionTimeoutSettingsPolicyMaximumError"
+          | i18n: maxSessionTimeoutPolicyHours : maxSessionTimeoutPolicyMinutes
+      }}
+    </div>
+  } @else if (maxSessionTimeoutPolicyData != null) {
+    @let policyTimeoutMessage = policyTimeoutMessage$ | async;
+    @if (policyTimeoutMessage != null) {
+      <bit-hint class="tw-mb-1" id="session-timeout-maximum-error">
+        {{ policyTimeoutMessage }}
+      </bit-hint>
+    }
+  }
 </div>
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.spec.ts b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.spec.ts
index ca9b1230beb..cbe532de5b2 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.spec.ts
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.spec.ts
@@ -1,90 +1,819 @@
-import { ComponentFixture, TestBed } from "@angular/core/testing";
-import { BehaviorSubject } from "rxjs";
+import { ComponentFixture, fakeAsync, flush, TestBed } from "@angular/core/testing";
+import { mock, MockProxy } from "jest-mock-extended";
+import { BehaviorSubject, of } from "rxjs";
 
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import {
-  VaultTimeoutSettingsService,
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutTypeService,
+} from "@bitwarden/common/key-management/session-timeout";
+import {
+  VaultTimeout,
+  VaultTimeoutOption,
   VaultTimeoutStringType,
 } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { mockAccountServiceWith } from "@bitwarden/common/spec";
 import { UserId } from "@bitwarden/common/types/guid";
+import { LogService } from "@bitwarden/logging";
+
+import { SessionTimeoutSettingsComponentService } from "../services/session-timeout-settings-component.service";
 
 import { SessionTimeoutInputComponent } from "./session-timeout-input.component";
 
 describe("SessionTimeoutInputComponent", () => {
   let component: SessionTimeoutInputComponent;
   let fixture: ComponentFixture<SessionTimeoutInputComponent>;
-  const policiesByType$ = jest.fn().mockReturnValue(new BehaviorSubject({}));
-  const availableVaultTimeoutActions$ = jest.fn().mockReturnValue(new BehaviorSubject([]));
-  const mockUserId = Utils.newGuid() as UserId;
-  const accountService = mockAccountServiceWith(mockUserId);
+
+  // Test constants
+  const MOCK_USER_ID = "user-id" as UserId;
+  const ONE_MINUTE = 1;
+  const FIVE_MINUTES = 5;
+  const FIFTEEN_MINUTES = 15;
+  const THIRTY_MINUTES = 30;
+  const ONE_HOUR = 60;
+  const FOUR_HOURS = 240;
+  const NINETY_MINUTES = 90;
+
+  // Mock services
+  let mockPolicyService: MockProxy<PolicyService>;
+  let mockSessionTimeoutSettingsComponentService: MockProxy<SessionTimeoutSettingsComponentService>;
+  let mockSessionTimeoutTypeService: MockProxy<SessionTimeoutTypeService>;
+  let mockI18nService: MockProxy<I18nService>;
+  let mockLogService: MockProxy<LogService>;
+  let accountService: AccountService;
+
+  // BehaviorSubjects for reactive testing
+  let policies$: BehaviorSubject<Policy[]>;
+  let availableTimeoutOptions: VaultTimeoutOption[];
 
   beforeEach(async () => {
+    // Initialize BehaviorSubjects
+    policies$ = new BehaviorSubject<Policy[]>([]);
+
+    // Initialize available timeout options
+    availableTimeoutOptions = [
+      { name: "oneMinute-used-i18n", value: ONE_MINUTE },
+      { name: "fiveMinutes-used-i18n", value: FIVE_MINUTES },
+      { name: "fifteenMinutes-used-i18n", value: FIFTEEN_MINUTES },
+      { name: "thirtyMinutes-used-i18n", value: THIRTY_MINUTES },
+      { name: "oneHour-used-i18n", value: ONE_HOUR },
+      { name: "fourHours-used-i18n", value: FOUR_HOURS },
+      { name: "onRestart-used-i18n", value: VaultTimeoutStringType.OnRestart },
+      { name: "onLocked-used-i18n", value: VaultTimeoutStringType.OnLocked },
+      { name: "never-used-i18n", value: VaultTimeoutStringType.Never },
+    ];
+
+    // Initialize mocks
+    mockPolicyService = mock<PolicyService>();
+    mockPolicyService.policiesByType$.mockReturnValue(policies$.asObservable());
+
+    accountService = mockAccountServiceWith(MOCK_USER_ID);
+
+    mockI18nService = mock<I18nService>();
+    mockI18nService.t.mockImplementation((key, ...args) => {
+      if (args.length > 0) {
+        return `${key}-used-i18n-${args.join("-")}`;
+      }
+      return `${key}-used-i18n`;
+    });
+
+    mockLogService = mock<LogService>();
+
+    mockSessionTimeoutSettingsComponentService = mock<SessionTimeoutSettingsComponentService>();
+    mockSessionTimeoutSettingsComponentService.policyFilteredTimeoutOptions$.mockReturnValue(
+      of(availableTimeoutOptions),
+    );
+
+    mockSessionTimeoutTypeService = mock<SessionTimeoutTypeService>();
+    mockSessionTimeoutTypeService.isAvailable.mockResolvedValue(true);
+    mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockImplementation(
+      async (timeout: VaultTimeout) => timeout,
+    );
+
     await TestBed.configureTestingModule({
       imports: [SessionTimeoutInputComponent],
       providers: [
-        { provide: PolicyService, useValue: { policiesByType$ } },
+        { provide: PolicyService, useValue: mockPolicyService },
         { provide: AccountService, useValue: accountService },
-        { provide: VaultTimeoutSettingsService, useValue: { availableVaultTimeoutActions$ } },
-        { provide: I18nService, useValue: { t: (key: string) => key } },
+        { provide: I18nService, useValue: mockI18nService },
+        { provide: LogService, useValue: mockLogService },
+        {
+          provide: SessionTimeoutSettingsComponentService,
+          useValue: mockSessionTimeoutSettingsComponentService,
+        },
+        { provide: SessionTimeoutTypeService, useValue: mockSessionTimeoutTypeService },
       ],
     }).compileComponents();
 
     fixture = TestBed.createComponent(SessionTimeoutInputComponent);
     component = fixture.componentInstance;
-    component.vaultTimeoutOptions = [
-      { name: "oneMinute", value: 1 },
-      { name: "fiveMinutes", value: 5 },
-      { name: "fifteenMinutes", value: 15 },
-      { name: "thirtyMinutes", value: 30 },
-      { name: "oneHour", value: 60 },
-      { name: "fourHours", value: 240 },
-      { name: "onRefresh", value: VaultTimeoutStringType.OnRestart },
-    ];
-    fixture.detectChanges();
+    fixture.componentRef.setInput("availableTimeoutOptions", availableTimeoutOptions);
   });
 
-  describe("form", () => {
-    beforeEach(async () => {
-      await component.ngOnInit();
+  it("should create", () => {
+    expect(component).toBeTruthy();
+  });
+
+  describe("ngOnInit", () => {
+    describe("policy data subscription and initialization", () => {
+      it("should initialize maxSessionTimeoutPolicyData to null when no policy exists", fakeAsync(() => {
+        fixture.detectChanges();
+        flush();
+
+        expect(component["maxSessionTimeoutPolicyData"]).toBeNull();
+      }));
+
+      it("should set maxSessionTimeoutPolicyData when policy exists", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes: NINETY_MINUTES,
+        };
+
+        fixture.detectChanges();
+        flush();
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component["maxSessionTimeoutPolicyData"]).toEqual(policyData);
+      }));
+
+      it("should trigger validatorChange callback when policy data changes", fakeAsync(() => {
+        const validatorChangeFn = jest.fn();
+        component.registerOnValidatorChange(validatorChangeFn);
+
+        fixture.detectChanges();
+        flush();
+
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes: NINETY_MINUTES,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(validatorChangeFn).toHaveBeenCalled();
+      }));
+
+      it("should update form validation when policy data changes", fakeAsync(() => {
+        const updateSpy = jest.spyOn(component.form.controls.custom, "updateValueAndValidity");
+
+        fixture.detectChanges();
+        flush();
+
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes: FIFTEEN_MINUTES,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(updateSpy).toHaveBeenCalled();
+      }));
     });
 
-    it("invokes the onChange associated with `ControlValueAccessor`", () => {
-      const onChange = jest.fn();
-      component.registerOnChange(onChange);
+    describe("policyTimeoutMessage$ observable", () => {
+      it("should emit custom timeout message when policy has custom type", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes: NINETY_MINUTES,
+        };
 
-      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.OnRestart);
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
 
-      expect(onChange).toHaveBeenCalledWith(VaultTimeoutStringType.OnRestart);
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe(
+          "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes-used-i18n-1-30",
+        );
+      }));
+
+      it("should emit immediately message when policy has immediately type", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "immediately",
+          minutes: 0,
+        };
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe(
+          "sessionTimeoutSettingsPolicySetDefaultTimeoutToImmediately-used-i18n",
+        );
+      }));
+
+      it("should emit onLocked message when policy has onSystemLock type", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "onSystemLock",
+          minutes: 0,
+        };
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnLocked-used-i18n");
+      }));
+
+      it("should emit onRestart message when policy has onAppRestart type", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "onAppRestart",
+          minutes: 0,
+        };
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart-used-i18n");
+      }));
+
+      it("should emit null when policy has never type and promoted value is Never", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "never",
+          minutes: 0,
+        };
+
+        mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(
+          VaultTimeoutStringType.Never,
+        );
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = "initial";
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBeNull();
+      }));
+
+      it("should emit numeric timeout message when immediately is promoted to 1 minute", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "immediately",
+          minutes: 0,
+        };
+
+        mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(ONE_MINUTE);
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe(
+          "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes-used-i18n-0-1",
+        );
+      }));
+
+      it("should emit onRestart message when onSystemLock is promoted to OnRestart", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "onSystemLock",
+          minutes: 0,
+        };
+
+        mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(
+          VaultTimeoutStringType.OnRestart,
+        );
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart-used-i18n");
+      }));
+
+      it("should emit onRestart message when never is promoted to OnRestart", fakeAsync(() => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "never",
+          minutes: 0,
+        };
+
+        mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(
+          VaultTimeoutStringType.OnRestart,
+        );
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+
+        fixture.detectChanges();
+        flush();
+
+        let message: string | null = null;
+        component["policyTimeoutMessage$"].subscribe((msg) => (message = msg));
+        flush();
+
+        expect(message).toBe("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart-used-i18n");
+      }));
     });
 
-    it("updates custom value to match preset option", () => {
-      // 1 hour
-      component.form.controls.vaultTimeout.setValue(60);
+    describe("form value changes subscription", () => {
+      it("should call onChange with vault timeout when form is valid and in custom mode", fakeAsync(() => {
+        const onChange = jest.fn();
+        component.registerOnChange(onChange);
 
-      expect(component.form.value.custom).toEqual({ hours: 1, minutes: 0 });
+        fixture.detectChanges();
+        flush();
 
-      // 17 minutes
-      component.form.controls.vaultTimeout.setValue(17);
+        component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+        component.form.controls.custom.setValue({ hours: 1, minutes: 30 });
+        flush();
 
-      expect(component.form.value.custom).toEqual({ hours: 0, minutes: 17 });
+        expect(onChange).toHaveBeenCalledWith(NINETY_MINUTES);
+      }));
 
-      // 2.25 hours
-      component.form.controls.vaultTimeout.setValue(135);
+      it("should call onChange when form changes to non-custom mode", fakeAsync(() => {
+        const onChange = jest.fn();
+        component.registerOnChange(onChange);
 
-      expect(component.form.value.custom).toEqual({ hours: 2, minutes: 15 });
+        fixture.detectChanges();
+        flush();
+
+        onChange.mockClear();
+
+        component.form.controls.vaultTimeout.setValue(FIFTEEN_MINUTES);
+        flush();
+
+        expect(onChange).toHaveBeenCalledWith(FIFTEEN_MINUTES);
+      }));
+
+      it("should not call onChange when custom controls are invalid", fakeAsync(() => {
+        const onChange = jest.fn();
+        component.registerOnChange(onChange);
+
+        fixture.detectChanges();
+        flush();
+
+        component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+        flush();
+
+        onChange.mockClear();
+
+        component.form.controls.custom.controls.hours.setValue(null);
+        flush();
+
+        expect(onChange).not.toHaveBeenCalled();
+      }));
+
+      it("should not call onChange when vaultTimeout is null", fakeAsync(() => {
+        const onChange = jest.fn();
+        component.registerOnChange(onChange);
+
+        fixture.detectChanges();
+        flush();
+
+        onChange.mockClear();
+
+        component.form.controls.vaultTimeout.setValue(null);
+        flush();
+
+        expect(onChange).not.toHaveBeenCalled();
+      }));
     });
 
-    it("sets custom timeout to 0 when a preset string option is selected", () => {
-      // Set custom value to random values
-      component.form.controls.custom.setValue({ hours: 1, minutes: 1 });
+    describe("custom fields initialization from vaultTimeout changes", () => {
+      it("should update custom fields when vaultTimeout changes to numeric value", fakeAsync(() => {
+        fixture.detectChanges();
+        flush();
 
-      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.OnLocked);
+        component.form.controls.vaultTimeout.setValue(NINETY_MINUTES);
+        flush();
 
-      expect(component.form.value.custom).toEqual({ hours: 0, minutes: 0 });
+        expect(component.form.value.custom).toEqual({ hours: 1, minutes: 30 });
+      }));
+
+      it.each([
+        VaultTimeoutStringType.OnRestart,
+        VaultTimeoutStringType.OnLocked,
+        VaultTimeoutStringType.Never,
+        VaultTimeoutStringType.OnSleep,
+        VaultTimeoutStringType.OnIdle,
+      ])(
+        "should set custom fields to 8 hours when vaultTimeout changes to %s",
+        fakeAsync((timeoutType: VaultTimeout) => {
+          fixture.detectChanges();
+          flush();
+
+          component.form.controls.custom.setValue({ hours: 1, minutes: 30 });
+          component.form.controls.vaultTimeout.setValue(timeoutType);
+          flush();
+
+          expect(component.form.value.custom).toEqual({ hours: 8, minutes: 0 });
+        }),
+      );
+
+      it("should mark custom fields as touched after update", fakeAsync(() => {
+        fixture.detectChanges();
+        flush();
+
+        component.form.controls.vaultTimeout.setValue(ONE_HOUR);
+        flush();
+
+        expect(component.form.controls.custom.controls.hours.touched).toBe(true);
+        expect(component.form.controls.custom.controls.minutes.touched).toBe(true);
+      }));
+
+      it("should not update custom fields when vaultTimeout changes to Custom", fakeAsync(() => {
+        fixture.detectChanges();
+        flush();
+
+        component.form.controls.custom.setValue({ hours: 5, minutes: 15 });
+
+        component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+        flush();
+
+        expect(component.form.value.custom).toEqual({ hours: 5, minutes: 15 });
+      }));
     });
   });
+
+  describe("isCustomTimeoutType", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return true when vaultTimeout is Custom", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      flush();
+
+      expect(component.isCustomTimeoutType).toBe(true);
+    }));
+
+    it.each([
+      ONE_MINUTE,
+      FIFTEEN_MINUTES,
+      ONE_HOUR,
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.Never,
+    ])(
+      "should return false when vaultTimeout is %s",
+      fakeAsync((timeout: VaultTimeout) => {
+        component.form.controls.vaultTimeout.setValue(timeout);
+        flush();
+
+        expect(component.isCustomTimeoutType).toBe(false);
+      }),
+    );
+  });
+
+  describe("customMinutesMin", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return 1 when hours is 0", fakeAsync(() => {
+      component.form.controls.custom.controls.hours.setValue(0);
+      flush();
+
+      expect(component.customMinutesMin).toBe(1);
+    }));
+
+    it.each([1, 2, 5, 10])(
+      "should return 0 when hours is %s",
+      fakeAsync((hours: number) => {
+        component.form.controls.custom.controls.hours.setValue(hours);
+        flush();
+
+        expect(component.customMinutesMin).toBe(0);
+      }),
+    );
+  });
+
+  describe("maxSessionTimeoutPolicyHours", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return 0 when no policy exists", fakeAsync(() => {
+      expect(component.maxSessionTimeoutPolicyHours).toBe(0);
+    }));
+
+    it.each([
+      { minutes: ONE_HOUR, expectedHours: 1 },
+      { minutes: NINETY_MINUTES, expectedHours: 1 },
+      { minutes: FOUR_HOURS, expectedHours: 4 },
+      { minutes: 300, expectedHours: 5 },
+    ])(
+      "should return $expectedHours when policy minutes is $minutes",
+      fakeAsync(({ minutes, expectedHours }: { minutes: number; expectedHours: number }) => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component.maxSessionTimeoutPolicyHours).toBe(expectedHours);
+      }),
+    );
+  });
+
+  describe("maxSessionTimeoutPolicyMinutes", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return 0 when no policy exists", fakeAsync(() => {
+      expect(component.maxSessionTimeoutPolicyMinutes).toBe(0);
+    }));
+
+    it.each([
+      { minutes: ONE_HOUR, expectedMinutes: 0 },
+      { minutes: NINETY_MINUTES, expectedMinutes: 30 },
+      { minutes: 65, expectedMinutes: 5 },
+      { minutes: 137, expectedMinutes: 17 },
+    ])(
+      "should return $expectedMinutes when policy minutes is $minutes",
+      fakeAsync(({ minutes, expectedMinutes }: { minutes: number; expectedMinutes: number }) => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "custom",
+          minutes,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component.maxSessionTimeoutPolicyMinutes).toBe(expectedMinutes);
+      }),
+    );
+  });
+
+  describe("exceedsPolicyMaximumTimeout", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return true when custom timeout exceeds policy maximum", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: ONE_HOUR,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 2, minutes: 0 });
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(true);
+    }));
+
+    it("should return false when no policy exists", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 100, minutes: 0 });
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(false);
+    }));
+
+    it("should return false when policy type is not custom", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "immediately",
+        minutes: 0,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 10, minutes: 0 });
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(false);
+    }));
+
+    it("should return false when policy type is custom and form timeout is not custom", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: FIFTEEN_MINUTES,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(ONE_HOUR);
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(false);
+    }));
+
+    it("should return false when custom timeout equals policy maximum", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: ONE_HOUR,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 1, minutes: 0 });
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(false);
+    }));
+
+    it("should return false when custom timeout is below policy maximum", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: FOUR_HOURS,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 2, minutes: 30 });
+      flush();
+
+      expect(component.exceedsPolicyMaximumTimeout).toBe(false);
+    }));
+  });
+
+  describe("writeValue", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should do nothing when value is null", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(ONE_HOUR);
+      flush();
+
+      component.writeValue(null);
+      flush();
+
+      expect(component.form.controls.vaultTimeout.value).toBe(ONE_HOUR);
+    }));
+
+    it("should set form to custom mode when value doesn't match any available option", fakeAsync(() => {
+      component.writeValue(NINETY_MINUTES);
+      flush();
+
+      expect(component.form.controls.vaultTimeout.value).toBe(VaultTimeoutStringType.Custom);
+      expect(component.form.controls.custom.value).toEqual({ hours: 1, minutes: 30 });
+    }));
+
+    it.each([ONE_MINUTE, FIVE_MINUTES, FIFTEEN_MINUTES, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS])(
+      "should set vaultTimeout directly when numeric value %s matches preset option",
+      fakeAsync((timeout: number) => {
+        component.writeValue(timeout);
+        flush();
+
+        expect(component.form.controls.vaultTimeout.value).toBe(timeout);
+      }),
+    );
+
+    it.each([
+      VaultTimeoutStringType.OnRestart,
+      VaultTimeoutStringType.OnLocked,
+      VaultTimeoutStringType.Never,
+    ])(
+      "should set vaultTimeout directly when string value %s matches preset option",
+      fakeAsync((timeout: VaultTimeout) => {
+        component.writeValue(timeout);
+        flush();
+
+        expect(component.form.controls.vaultTimeout.value).toBe(timeout);
+      }),
+    );
+  });
+
+  describe("validate", () => {
+    beforeEach(fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+    }));
+
+    it("should return null when vaultTimeout is not custom", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(ONE_HOUR);
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toBeNull();
+    }));
+
+    it("should return required error when vaultTimeout is custom and hours is null", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.controls.hours.setValue(null);
+      component.form.controls.custom.controls.minutes.setValue(30);
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toEqual({ required: true });
+    }));
+
+    it("should return required error when vaultTimeout is custom and minutes is null", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.controls.hours.setValue(1);
+      component.form.controls.custom.controls.minutes.setValue(null);
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toEqual({ required: true });
+    }));
+
+    it("should return required error when vaultTimeout is custom and both hours and minutes are null", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.controls.hours.setValue(null);
+      component.form.controls.custom.controls.minutes.setValue(null);
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toEqual({ required: true });
+    }));
+
+    it("should return minTimeoutError when total minutes is 0", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 0, minutes: 0 });
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toEqual({ minTimeoutError: true });
+    }));
+
+    it("should return maxTimeoutError when exceeds policy maximum", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: ONE_HOUR,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 2, minutes: 0 });
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toEqual({ maxTimeoutError: true });
+    }));
+
+    it("should return null when custom values are valid and within policy limit", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        type: "custom",
+        minutes: FOUR_HOURS,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 2, minutes: 30 });
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toBeNull();
+    }));
+
+    it("should return null when custom values are valid and no policy exists", fakeAsync(() => {
+      component.form.controls.vaultTimeout.setValue(VaultTimeoutStringType.Custom);
+      component.form.controls.custom.setValue({ hours: 5, minutes: 15 });
+      flush();
+
+      const result = component.validate(component.form);
+
+      expect(result).toBeNull();
+    }));
+  });
 });
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.ts b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.ts
index e9a5722ff4e..f8bbf9c215e 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.ts
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-input.component.ts
@@ -1,9 +1,16 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CommonModule } from "@angular/common";
-import { Component, Input, OnChanges, OnDestroy, OnInit } from "@angular/core";
+import {
+  ChangeDetectionStrategy,
+  Component,
+  DestroyRef,
+  inject,
+  input,
+  OnInit,
+} from "@angular/core";
+import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
 import {
   AbstractControl,
+  AbstractControlOptions,
   ControlValueAccessor,
   FormBuilder,
   FormControl,
@@ -13,26 +20,32 @@ import {
   ReactiveFormsModule,
   ValidationErrors,
   Validator,
+  Validators,
 } from "@angular/forms";
-import { filter, map, Observable, Subject, switchMap, takeUntil } from "rxjs";
+import { filter, map, Observable, switchMap } from "rxjs";
 
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { PolicyType } from "@bitwarden/common/admin-console/enums";
-import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
 import { getFirstPolicy } from "@bitwarden/common/admin-console/services/policy/default-policy.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import {
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutTypeService,
+} from "@bitwarden/common/key-management/session-timeout";
+import {
+  isVaultTimeoutTypeNumeric,
   VaultTimeout,
-  VaultTimeoutAction,
   VaultTimeoutOption,
-  VaultTimeoutSettingsService,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
 } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { FormFieldModule, SelectModule } from "@bitwarden/components";
+import { LogService } from "@bitwarden/logging";
 
-type VaultTimeoutForm = FormGroup<{
+type SessionTimeoutForm = FormGroup<{
   vaultTimeout: FormControl<VaultTimeout | null>;
   custom: FormGroup<{
     hours: FormControl<number | null>;
@@ -40,10 +53,8 @@ type VaultTimeoutForm = FormGroup<{
   }>;
 }>;
 
-type VaultTimeoutFormValue = VaultTimeoutForm["value"];
+type SessionTimeoutFormValue = SessionTimeoutForm["value"];
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "bit-session-timeout-input",
   templateUrl: "session-timeout-input.component.html",
@@ -60,111 +71,110 @@ type VaultTimeoutFormValue = VaultTimeoutForm["value"];
       useExisting: SessionTimeoutInputComponent,
     },
   ],
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class SessionTimeoutInputComponent
-  implements ControlValueAccessor, Validator, OnInit, OnDestroy, OnChanges
-{
-  static CUSTOM_VALUE = -100;
-  static MIN_CUSTOM_MINUTES = 0;
-  form: VaultTimeoutForm = this.formBuilder.group({
-    vaultTimeout: [null],
-    custom: this.formBuilder.group({
-      hours: [null],
-      minutes: [null],
-    }),
-  });
+export class SessionTimeoutInputComponent implements ControlValueAccessor, Validator, OnInit {
+  static readonly MIN_CUSTOM_MINUTES = 0;
 
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() vaultTimeoutOptions: VaultTimeoutOption[];
+  private readonly formBuilder = inject(FormBuilder);
+  private readonly policyService = inject(PolicyService);
+  private readonly i18nService = inject(I18nService);
+  private readonly accountService = inject(AccountService);
+  private readonly destroyRef = inject(DestroyRef);
+  private readonly sessionTimeoutTypeService = inject(SessionTimeoutTypeService);
+  private readonly logService = inject(LogService);
 
-  vaultTimeoutPolicy: Policy;
-  vaultTimeoutPolicyHours: number;
-  vaultTimeoutPolicyMinutes: number;
+  readonly availableTimeoutOptions = input.required<VaultTimeoutOption[]>();
 
-  protected readonly VaultTimeoutAction = VaultTimeoutAction;
+  protected maxSessionTimeoutPolicyData: MaximumSessionTimeoutPolicyData | null = null;
+  protected policyTimeoutMessage$!: Observable<string | null>;
 
-  protected canLockVault$: Observable<boolean>;
-  private onChange: (vaultTimeout: VaultTimeout) => void;
-  private validatorChange: () => void;
-  private destroy$ = new Subject<void>();
+  readonly form: SessionTimeoutForm = this.formBuilder.group(
+    {
+      vaultTimeout: [null as VaultTimeout | null],
+      custom: this.formBuilder.group({
+        hours: [0, [Validators.required, Validators.min(0)]],
+        minutes: [0, [Validators.required, Validators.min(0), Validators.max(59)]],
+      }),
+    },
+    { validators: [this.formValidator.bind(this)] } as AbstractControlOptions,
+  );
 
-  constructor(
-    private formBuilder: FormBuilder,
-    private policyService: PolicyService,
-    private vaultTimeoutSettingsService: VaultTimeoutSettingsService,
-    private i18nService: I18nService,
-    private accountService: AccountService,
-  ) {}
+  private onChange: ((vaultTimeout: VaultTimeout) => void) | null = null;
+  private validatorChange: (() => void) | null = null;
 
-  get showCustom() {
-    return this.form.get("vaultTimeout").value === SessionTimeoutInputComponent.CUSTOM_VALUE;
+  get isCustomTimeoutType(): boolean {
+    return this.form.controls.vaultTimeout.value === VaultTimeoutStringType.Custom;
   }
 
-  get exceedsMinimumTimeout(): boolean {
+  get customMinutesMin(): number {
+    return this.form.controls.custom.controls.hours.value === 0 ? 1 : 0;
+  }
+
+  get exceedsPolicyMaximumTimeout(): boolean {
     return (
-      !this.showCustom ||
-      this.customTimeInMinutes() > SessionTimeoutInputComponent.MIN_CUSTOM_MINUTES
+      this.maxSessionTimeoutPolicyData?.type === VaultTimeoutStringType.Custom &&
+      this.isCustomTimeoutType &&
+      this.getTotalMinutesFromCustomValue(this.form.value.custom) >
+        this.maxSessionTimeoutPolicyMinutes + 60 * this.maxSessionTimeoutPolicyHours
     );
   }
 
-  get exceedsMaximumTimeout(): boolean {
-    return (
-      this.showCustom &&
-      this.customTimeInMinutes() >
-        this.vaultTimeoutPolicyMinutes + 60 * this.vaultTimeoutPolicyHours
+  ngOnInit(): void {
+    const maximumSessionTimeoutPolicyData$ = this.accountService.activeAccount$.pipe(
+      getUserId,
+      switchMap((userId) =>
+        this.policyService.policiesByType$(PolicyType.MaximumVaultTimeout, userId),
+      ),
+      getFirstPolicy,
+      filter((policy) => policy != null),
+      map((policy) => policy.data as MaximumSessionTimeoutPolicyData),
     );
-  }
 
-  get filteredVaultTimeoutOptions(): VaultTimeoutOption[] {
-    // by policy max value
-    if (this.vaultTimeoutPolicy == null || this.vaultTimeoutPolicy.data == null) {
-      return this.vaultTimeoutOptions;
-    }
+    this.policyTimeoutMessage$ = maximumSessionTimeoutPolicyData$.pipe(
+      switchMap((policyData) => this.getPolicyTimeoutMessage(policyData)),
+    );
 
-    return this.vaultTimeoutOptions.filter((option) => {
-      if (typeof option.value === "number") {
-        return option.value <= this.vaultTimeoutPolicy.data.minutes;
-      }
-
-      return false;
-    });
-  }
-
-  async ngOnInit() {
-    this.accountService.activeAccount$
-      .pipe(
-        getUserId,
-        switchMap((userId) =>
-          this.policyService.policiesByType$(PolicyType.MaximumVaultTimeout, userId),
-        ),
-        getFirstPolicy,
-        filter((policy) => policy != null),
-        takeUntil(this.destroy$),
-      )
-      .subscribe((policy) => {
-        this.vaultTimeoutPolicy = policy;
-        this.applyVaultTimeoutPolicy();
-      });
-    this.form.valueChanges
-      .pipe(takeUntil(this.destroy$))
-      .subscribe((value: VaultTimeoutFormValue) => {
-        if (this.onChange) {
-          this.onChange(this.getVaultTimeout(value));
+    maximumSessionTimeoutPolicyData$
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe((policyData) => {
+        this.maxSessionTimeoutPolicyData = policyData;
+        // Re-validate custom form group with new policy data
+        this.form.controls.custom.updateValueAndValidity();
+        // Trigger validator change when policy data changes
+        if (this.validatorChange) {
+          this.validatorChange();
         }
       });
 
+    // Subscribe to form value changes
+    this.form.valueChanges.pipe(takeUntilDestroyed(this.destroyRef)).subscribe((value) => {
+      if (this.onChange) {
+        const vaultTimeout = this.getVaultTimeout(value);
+        if (vaultTimeout != null) {
+          // Only call onChange if the form is valid
+          // For non-numeric values, we don't need to validate custom fields
+          const isValid = !this.isCustomTimeoutType || this.form.controls.custom.valid;
+          if (isValid) {
+            this.onChange(vaultTimeout);
+          }
+        }
+      }
+    });
+
     // Assign the current value to the custom fields
     // so that if the user goes from a numeric value to custom
     // we can initialize the custom fields with the current value
     // ex: user picks 5 min, goes to custom, we want to show 0 hr, 5 min in the custom fields
     this.form.controls.vaultTimeout.valueChanges
       .pipe(
-        filter((value) => value !== SessionTimeoutInputComponent.CUSTOM_VALUE),
-        takeUntil(this.destroy$),
+        filter((value) => value != null && value !== VaultTimeoutStringType.Custom),
+        takeUntilDestroyed(this.destroyRef),
       )
       .subscribe((value) => {
-        const current = typeof value === "string" ? 0 : Math.max(value, 0);
+        const current = isVaultTimeoutTypeNumeric(value)
+          ? (value as number)
+          : VaultTimeoutNumberType.EightHours;
 
         // This cannot emit an event b/c it would cause form.valueChanges to fire again
         // and we are already handling that above so just silently update
@@ -178,112 +188,169 @@ export class SessionTimeoutInputComponent
           },
           { emitEvent: false },
         );
+
+        this.form.controls.custom.markAllAsTouched();
       });
-
-    this.canLockVault$ = this.vaultTimeoutSettingsService
-      .availableVaultTimeoutActions$()
-      .pipe(map((actions) => actions.includes(VaultTimeoutAction.Lock)));
   }
 
-  ngOnDestroy() {
-    this.destroy$.next();
-    this.destroy$.complete();
+  get maxSessionTimeoutPolicyHours(): number {
+    return Math.floor((this.maxSessionTimeoutPolicyData?.minutes ?? 0) / 60);
   }
 
-  ngOnChanges() {
-    if (
-      !this.vaultTimeoutOptions.find((p) => p.value === SessionTimeoutInputComponent.CUSTOM_VALUE)
-    ) {
-      this.vaultTimeoutOptions.push({
-        name: this.i18nService.t("custom"),
-        value: SessionTimeoutInputComponent.CUSTOM_VALUE,
-      });
-    }
+  get maxSessionTimeoutPolicyMinutes(): number {
+    return (this.maxSessionTimeoutPolicyData?.minutes ?? 0) % 60;
   }
 
-  getVaultTimeout(value: VaultTimeoutFormValue) {
-    if (value.vaultTimeout !== SessionTimeoutInputComponent.CUSTOM_VALUE) {
-      return value.vaultTimeout;
-    }
-
-    return value.custom.hours * 60 + value.custom.minutes;
-  }
-
-  writeValue(value: number): void {
+  writeValue(value: VaultTimeout | null): void {
     if (value == null) {
       return;
     }
 
-    if (this.vaultTimeoutOptions.every((p) => p.value !== value)) {
+    // Normalize the custom numeric value to preset (i.e. 1 minute), otherwise set as custom
+    const options = this.availableTimeoutOptions();
+    const matchingOption = options.some((opt) => opt.value === value);
+    if (!matchingOption) {
+      this.logService.debug(
+        `[SessionTimeoutInputComponent] form control write value as custom ${value}`,
+      );
       this.form.setValue({
-        vaultTimeout: SessionTimeoutInputComponent.CUSTOM_VALUE,
+        vaultTimeout: VaultTimeoutStringType.Custom,
         custom: {
-          hours: Math.floor(value / 60),
-          minutes: value % 60,
+          hours: Math.floor((value as number) / 60),
+          minutes: (value as number) % 60,
         },
       });
       return;
     }
 
+    this.logService.debug(
+      `[SessionTimeoutInputComponent] form control write value as preset ${value}`,
+    );
+
+    // For string values (e.g., "onLocked", "never"), set directly
     this.form.patchValue({
       vaultTimeout: value,
     });
   }
 
-  registerOnChange(onChange: any): void {
+  registerOnChange(onChange: (vaultTimeout: VaultTimeout) => void): void {
     this.onChange = onChange;
   }
 
-  registerOnTouched(onTouched: any): void {
+  registerOnTouched(_onTouched: () => void): void {
     // Empty
   }
 
-  setDisabledState?(isDisabled: boolean): void {
+  setDisabledState?(_isDisabled: boolean): void {
     // Empty
   }
 
-  validate(control: AbstractControl): ValidationErrors {
-    if (this.vaultTimeoutPolicy && this.vaultTimeoutPolicy?.data?.minutes < control.value) {
-      return { policyError: true };
-    }
-
-    if (!this.exceedsMinimumTimeout) {
-      return { minTimeoutError: true };
-    }
-
-    return null;
+  validate(_: AbstractControl): ValidationErrors | null {
+    return this.form.errors;
   }
 
   registerOnValidatorChange(fn: () => void): void {
     this.validatorChange = fn;
   }
 
-  private customTimeInMinutes() {
-    return this.form.value.custom.hours * 60 + this.form.value.custom.minutes;
+  private getTotalMinutesFromCustomValue(customValue: SessionTimeoutFormValue["custom"]): number {
+    const hours = customValue?.hours ?? 0;
+    const minutes = customValue?.minutes ?? 0;
+    return hours * 60 + minutes;
   }
 
-  private applyVaultTimeoutPolicy() {
-    this.vaultTimeoutPolicyHours = Math.floor(this.vaultTimeoutPolicy.data.minutes / 60);
-    this.vaultTimeoutPolicyMinutes = this.vaultTimeoutPolicy.data.minutes % 60;
+  private formValidator(control: AbstractControl): ValidationErrors | null {
+    const formValue = control.value as SessionTimeoutFormValue;
+    const isCustomMode = formValue.vaultTimeout === VaultTimeoutStringType.Custom;
 
-    this.vaultTimeoutOptions = this.vaultTimeoutOptions.filter((vaultTimeoutOption) => {
-      // Always include the custom option
-      if (vaultTimeoutOption.value === SessionTimeoutInputComponent.CUSTOM_VALUE) {
-        return true;
+    // Only validate when in custom mode
+    if (!isCustomMode) {
+      return null;
+    }
+
+    const hours = formValue.custom?.hours;
+    const minutes = formValue.custom?.minutes;
+
+    if (hours == null || minutes == null) {
+      return { required: true };
+    }
+
+    const totalMinutes = this.getTotalMinutesFromCustomValue(formValue.custom);
+    if (totalMinutes === 0) {
+      return { minTimeoutError: true };
+    }
+
+    if (this.exceedsPolicyMaximumTimeout) {
+      return { maxTimeoutError: true };
+    }
+
+    return null;
+  }
+
+  private getVaultTimeout(value: SessionTimeoutFormValue): VaultTimeout | null {
+    if (value.vaultTimeout !== VaultTimeoutStringType.Custom) {
+      return value.vaultTimeout ?? null;
+    }
+
+    return this.getTotalMinutesFromCustomValue(value.custom);
+  }
+
+  private async getPolicyTimeoutMessage(
+    policyData: MaximumSessionTimeoutPolicyData,
+  ): Promise<string | null> {
+    const timeout = await this.getPolicyAppliedTimeout(policyData);
+
+    switch (timeout) {
+      case null:
+        // Don't display the policy message
+        return null;
+      case VaultTimeoutNumberType.Immediately:
+        return this.i18nService.t("sessionTimeoutSettingsPolicySetDefaultTimeoutToImmediately");
+      case VaultTimeoutStringType.OnLocked:
+        return this.i18nService.t("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnLocked");
+      case VaultTimeoutStringType.OnRestart:
+        return this.i18nService.t("sessionTimeoutSettingsPolicySetDefaultTimeoutToOnRestart");
+      default:
+        if (isVaultTimeoutTypeNumeric(timeout)) {
+          const hours = Math.floor((timeout as number) / 60);
+          const minutes = (timeout as number) % 60;
+          return this.i18nService.t(
+            "sessionTimeoutSettingsPolicySetMaximumTimeoutToHoursMinutes",
+            hours,
+            minutes,
+          );
+        }
+        throw new Error("Invalid timeout parameter");
+    }
+  }
+
+  private async getPolicyAppliedTimeout(
+    policyData: MaximumSessionTimeoutPolicyData,
+  ): Promise<VaultTimeout | null> {
+    switch (policyData.type) {
+      case "immediately":
+        return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+          VaultTimeoutNumberType.Immediately,
+        );
+      case "onSystemLock":
+        return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+          VaultTimeoutStringType.OnLocked,
+        );
+      case "onAppRestart":
+        return VaultTimeoutStringType.OnRestart;
+      case "never": {
+        const timeout = await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+          VaultTimeoutStringType.Never,
+        );
+        if (timeout == VaultTimeoutStringType.Never) {
+          // Don't display policy message, when the policy doesn't change the available timeout options
+          return null;
+        }
+        return timeout;
       }
-
-      if (typeof vaultTimeoutOption.value === "number") {
-        // Include numeric values that are less than or equal to the policy minutes
-        return vaultTimeoutOption.value <= this.vaultTimeoutPolicy.data.minutes;
-      }
-
-      // Exclude all string cases when there's a numeric policy defined
-      return false;
-    });
-
-    // Only call validator change if it's been set
-    if (this.validatorChange) {
-      this.validatorChange();
+      case "custom":
+      default:
+        return policyData.minutes;
     }
   }
 }
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.html b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.html
index 4d607ce5d7b..e6de54dc38e 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.html
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.html
@@ -1,10 +1,11 @@
 <div [formGroup]="formGroup">
-  <bit-session-timeout-input
-    [vaultTimeoutOptions]="availableTimeoutOptions$ | async"
-    [formControl]="formGroup.controls.timeout"
-    ngDefaultControl
-  >
-  </bit-session-timeout-input>
+  @if (availableTimeoutOptions$ | async; as options) {
+    <bit-session-timeout-input
+      [availableTimeoutOptions]="options"
+      [formControl]="formGroup.controls.timeout"
+    >
+    </bit-session-timeout-input>
+  }
 
   <bit-form-field [disableMargin]="true">
     <bit-label>{{ "sessionTimeoutSettingsAction" | i18n }}</bit-label>
@@ -18,14 +19,10 @@
       }
     </bit-select>
 
-    @if (!canLock) {
-      <bit-hint>{{ "unlockMethodNeededToChangeTimeoutActionDesc" | i18n }}<br /></bit-hint>
+    @if (!canLock && supportsLock) {
+      <bit-hint>{{ "sessionTimeoutSettingsSetUnlockMethodToChangeTimeoutAction" | i18n }}</bit-hint>
+    } @else if ((sessionTimeoutActionFromPolicy$ | async) != null) {
+      <bit-hint>{{ "sessionTimeoutSettingsManagedByOrganization" | i18n }}</bit-hint>
     }
   </bit-form-field>
-
-  @if (hasVaultTimeoutPolicy$ | async) {
-    <bit-hint class="tw-mt-4">
-      {{ "vaultTimeoutPolicyAffectingOptions" | i18n }}
-    </bit-hint>
-  }
 </div>
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.spec.ts b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.spec.ts
index 4c3f41d738c..7b69ee13dc3 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.spec.ts
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.spec.ts
@@ -4,11 +4,15 @@ import { NoopAnimationsModule } from "@angular/platform-browser/animations";
 import { mock, MockProxy } from "jest-mock-extended";
 import { BehaviorSubject, filter, firstValueFrom, of } from "rxjs";
 
+import { ClientType } from "@bitwarden/client-type";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import {
-  MaximumVaultTimeoutPolicyData,
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutTypeService,
+} from "@bitwarden/common/key-management/session-timeout";
+import {
   VaultTimeout,
   VaultTimeoutAction,
   VaultTimeoutOption,
@@ -16,6 +20,7 @@ import {
   VaultTimeoutStringType,
 } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { FakeAccountService, mockAccountServiceWith } from "@bitwarden/common/spec";
 import { UserId } from "@bitwarden/common/types/guid";
 import { DialogService, ToastService } from "@bitwarden/components";
@@ -39,6 +44,8 @@ describe("SessionTimeoutSettingsComponent", () => {
   let accountService: FakeAccountService;
   let mockDialogService: MockProxy<DialogService>;
   let mockLogService: MockProxy<LogService>;
+  const mockPlatformUtilsService = mock<PlatformUtilsService>();
+  const mockSessionTimeoutTypeService = mock<SessionTimeoutTypeService>();
 
   const mockUserId = "user-id" as UserId;
   const mockEmail = "test@example.com";
@@ -46,6 +53,7 @@ describe("SessionTimeoutSettingsComponent", () => {
   const mockInitialTimeoutAction = VaultTimeoutAction.Lock;
   let refreshTimeoutActionSettings$: BehaviorSubject<void>;
   let availableTimeoutOptions$: BehaviorSubject<VaultTimeoutOption[]>;
+  let policies$: BehaviorSubject<Policy[]>;
 
   beforeEach(async () => {
     refreshTimeoutActionSettings$ = new BehaviorSubject<void>(undefined);
@@ -58,6 +66,7 @@ describe("SessionTimeoutSettingsComponent", () => {
       { name: "onIdle-used-i18n", value: VaultTimeoutStringType.OnIdle },
       { name: "never-used-i18n", value: VaultTimeoutStringType.Never },
     ]);
+    policies$ = new BehaviorSubject<Policy[]>([]);
 
     mockVaultTimeoutSettingsService = mock<VaultTimeoutSettingsService>();
     mockSessionTimeoutSettingsComponentService = mock<SessionTimeoutSettingsComponentService>();
@@ -79,9 +88,10 @@ describe("SessionTimeoutSettingsComponent", () => {
     mockVaultTimeoutSettingsService.availableVaultTimeoutActions$.mockImplementation(() =>
       of([VaultTimeoutAction.Lock, VaultTimeoutAction.LogOut]),
     );
-    mockSessionTimeoutSettingsComponentService.availableTimeoutOptions$ =
-      availableTimeoutOptions$.asObservable();
-    mockPolicyService.policiesByType$.mockImplementation(() => of([]));
+    mockSessionTimeoutSettingsComponentService.policyFilteredTimeoutOptions$.mockImplementation(
+      (userId) => availableTimeoutOptions$.asObservable(),
+    );
+    mockPolicyService.policiesByType$.mockReturnValue(policies$.asObservable());
 
     await TestBed.configureTestingModule({
       imports: [
@@ -102,6 +112,8 @@ describe("SessionTimeoutSettingsComponent", () => {
         { provide: AccountService, useValue: accountService },
         { provide: LogService, useValue: mockLogService },
         { provide: DialogService, useValue: mockDialogService },
+        { provide: PlatformUtilsService, useValue: mockPlatformUtilsService },
+        { provide: SessionTimeoutTypeService, useValue: mockSessionTimeoutTypeService },
       ],
     })
       .overrideComponent(SessionTimeoutSettingsComponent, {
@@ -145,6 +157,83 @@ describe("SessionTimeoutSettingsComponent", () => {
     }));
   });
 
+  describe("supportsLock", () => {
+    it.each([ClientType.Desktop, ClientType.Browser, ClientType.Cli])(
+      "should return true when client is %s and policy action is null",
+      fakeAsync((clientType: ClientType) => {
+        mockPlatformUtilsService.getClientType.mockReturnValue(clientType);
+
+        fixture.detectChanges();
+        flush();
+
+        expect(component.supportsLock).toBe(true);
+      }),
+    );
+
+    it.each([ClientType.Desktop, ClientType.Browser, ClientType.Cli])(
+      "should return true when client is %s and policy action is lock",
+      fakeAsync((clientType: ClientType) => {
+        mockPlatformUtilsService.getClientType.mockReturnValue(clientType);
+
+        fixture.detectChanges();
+        flush();
+
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          minutes: 15,
+          action: VaultTimeoutAction.Lock,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component.supportsLock).toBe(true);
+      }),
+    );
+
+    it.each([ClientType.Desktop, ClientType.Browser, ClientType.Cli, ClientType.Web])(
+      "should return false when client is %s and policy action is logOut",
+      fakeAsync((clientType: ClientType) => {
+        mockPlatformUtilsService.getClientType.mockReturnValue(clientType);
+
+        fixture.detectChanges();
+        flush();
+
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          minutes: 15,
+          action: VaultTimeoutAction.LogOut,
+        };
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component.supportsLock).toBe(false);
+      }),
+    );
+
+    it("should return false when client is Web and policy action is null", fakeAsync(() => {
+      mockPlatformUtilsService.getClientType.mockReturnValue(ClientType.Web);
+
+      fixture.detectChanges();
+      flush();
+
+      expect(component.supportsLock).toBe(false);
+    }));
+
+    it("should return false when client is Web and policy action is lock", fakeAsync(() => {
+      mockPlatformUtilsService.getClientType.mockReturnValue(ClientType.Web);
+
+      fixture.detectChanges();
+      flush();
+
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        minutes: 15,
+        action: VaultTimeoutAction.Lock,
+      };
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      expect(component.supportsLock).toBe(false);
+    }));
+  });
+
   describe("ngOnInit", () => {
     it("should initialize available timeout options", fakeAsync(async () => {
       fixture.detectChanges();
@@ -178,7 +267,7 @@ describe("SessionTimeoutSettingsComponent", () => {
       });
     }));
 
-    it("should initialize available timeout actions", fakeAsync(() => {
+    it("should initialize available timeout actions signal", fakeAsync(() => {
       const expectedActions = [VaultTimeoutAction.Lock, VaultTimeoutAction.LogOut];
 
       mockVaultTimeoutSettingsService.availableVaultTimeoutActions$.mockImplementation(() =>
@@ -209,27 +298,55 @@ describe("SessionTimeoutSettingsComponent", () => {
       expect(component.formGroup.value.timeoutAction).toBe(expectedAction);
     }));
 
-    it("should fall back to OnRestart when current option is not available", fakeAsync(() => {
-      availableTimeoutOptions$.next([
-        { name: "oneMinute-used-i18n", value: 1 },
-        { name: "fiveMinutes-used-i18n", value: 5 },
-        { name: "onRestart-used-i18n", value: VaultTimeoutStringType.OnRestart },
-      ]);
+    it("should initialize userId from active account", fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
 
-      const unavailableTimeout = VaultTimeoutStringType.Never;
+      expect(component["userId"]).toBe(mockUserId);
+    }));
 
-      mockVaultTimeoutSettingsService.getVaultTimeoutByUserId$.mockImplementation(() =>
-        of(unavailableTimeout),
-      );
+    it("should initialize sessionTimeoutActionFromPolicy signal with null when no policy exists", fakeAsync(() => {
+      fixture.detectChanges();
+      flush();
+
+      expect(component["sessionTimeoutActionFromPolicy"]()).toBeNull();
+    }));
+
+    it.each([VaultTimeoutAction.Lock, VaultTimeoutAction.LogOut])(
+      "should initialize sessionTimeoutActionFromPolicy signal with policy action %s when policy exists",
+      fakeAsync((timeoutAction: VaultTimeoutAction) => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          minutes: 15,
+          action: timeoutAction,
+        };
+
+        fixture.detectChanges();
+        flush();
+
+        policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+        flush();
+
+        expect(component["sessionTimeoutActionFromPolicy"]()).toBe(timeoutAction);
+      }),
+    );
+
+    it("should initialize sessionTimeoutActionFromPolicy signal with null when policy exists and action is user preference", fakeAsync(() => {
+      const policyData: MaximumSessionTimeoutPolicyData = {
+        minutes: 15,
+        action: null,
+      };
 
       fixture.detectChanges();
       flush();
 
-      expect(component.formGroup.value.timeout).toBe(VaultTimeoutStringType.OnRestart);
+      policies$.next([{ id: "1", enabled: true, data: policyData } as Policy]);
+      flush();
+
+      expect(component["sessionTimeoutActionFromPolicy"]()).toBeNull();
     }));
 
     it("should disable timeout action control when policy enforces action", fakeAsync(() => {
-      const policyData: MaximumVaultTimeoutPolicyData = {
+      const policyData: MaximumSessionTimeoutPolicyData = {
         minutes: 15,
         action: VaultTimeoutAction.LogOut,
       };
@@ -273,7 +390,7 @@ describe("SessionTimeoutSettingsComponent", () => {
 
       expect(component.formGroup.controls.timeoutAction.enabled).toBe(true);
 
-      const policyData: MaximumVaultTimeoutPolicyData = {
+      const policyData: MaximumSessionTimeoutPolicyData = {
         minutes: 15,
         action: VaultTimeoutAction.LogOut,
       };
@@ -355,6 +472,56 @@ describe("SessionTimeoutSettingsComponent", () => {
 
       expect(saveSpy).toHaveBeenCalledWith(VaultTimeoutAction.LogOut);
     }));
+
+    it("should sync form timeout when service emits new timeout value", fakeAsync(() => {
+      const timeout$ = new BehaviorSubject<VaultTimeout>(mockInitialTimeout);
+      mockVaultTimeoutSettingsService.getVaultTimeoutByUserId$.mockReturnValue(timeout$);
+
+      fixture.detectChanges();
+      flush();
+
+      expect(component.formGroup.controls.timeout.value).toBe(mockInitialTimeout);
+
+      const newTimeout = 30;
+      timeout$.next(newTimeout);
+      flush();
+
+      expect(component.formGroup.controls.timeout.value).toBe(newTimeout);
+    }));
+
+    it("should not sync form timeout when service emits same timeout value", fakeAsync(() => {
+      const timeout$ = new BehaviorSubject<VaultTimeout>(mockInitialTimeout);
+      mockVaultTimeoutSettingsService.getVaultTimeoutByUserId$.mockReturnValue(timeout$);
+
+      fixture.detectChanges();
+      flush();
+
+      const setValueSpy = jest.spyOn(component.formGroup.controls.timeout, "setValue");
+
+      timeout$.next(mockInitialTimeout);
+      flush();
+
+      expect(setValueSpy).not.toHaveBeenCalled();
+    }));
+
+    it("should update availableTimeoutActions signal when service emits new actions", fakeAsync(() => {
+      const actions$ = new BehaviorSubject<VaultTimeoutAction[]>([VaultTimeoutAction.Lock]);
+      mockVaultTimeoutSettingsService.availableVaultTimeoutActions$.mockReturnValue(actions$);
+
+      fixture.detectChanges();
+      flush();
+
+      expect(component["availableTimeoutActions"]()).toEqual([VaultTimeoutAction.Lock]);
+
+      actions$.next([VaultTimeoutAction.Lock, VaultTimeoutAction.LogOut]);
+      refreshTimeoutActionSettings$.next(undefined);
+      flush();
+
+      expect(component["availableTimeoutActions"]()).toEqual([
+        VaultTimeoutAction.Lock,
+        VaultTimeoutAction.LogOut,
+      ]);
+    }));
   });
 
   describe("saveTimeout", () => {
diff --git a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.ts b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.ts
index ecdd0ee89ad..89f085e5127 100644
--- a/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.ts
+++ b/libs/key-management-ui/src/session-timeout/components/session-timeout-settings.component.ts
@@ -1,6 +1,6 @@
 import { CommonModule } from "@angular/common";
-import { Component, DestroyRef, input, OnInit, signal } from "@angular/core";
-import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
+import { Component, DestroyRef, inject, input, OnInit, signal } from "@angular/core";
+import { takeUntilDestroyed, toSignal } from "@angular/core/rxjs-interop";
 import {
   FormControl,
   FormGroup,
@@ -18,27 +18,28 @@ import {
   firstValueFrom,
   map,
   Observable,
-  of,
   pairwise,
   startWith,
   switchMap,
+  tap,
 } from "rxjs";
 
 import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { ClientType } from "@bitwarden/client-type";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
 import { PolicyType } from "@bitwarden/common/admin-console/enums";
 import { getFirstPolicy } from "@bitwarden/common/admin-console/services/policy/default-policy.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
+import { MaximumSessionTimeoutPolicyData } from "@bitwarden/common/key-management/session-timeout";
 import {
-  MaximumVaultTimeoutPolicyData,
   VaultTimeout,
   VaultTimeoutAction,
-  VaultTimeoutOption,
   VaultTimeoutSettingsService,
   VaultTimeoutStringType,
 } from "@bitwarden/common/key-management/vault-timeout";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { UserId } from "@bitwarden/common/types/guid";
 import {
   CheckboxModule,
@@ -86,6 +87,19 @@ export class SessionTimeoutSettingsComponent implements OnInit {
     new BehaviorSubject<void>(undefined),
   );
 
+  private readonly vaultTimeoutSettingsService = inject(VaultTimeoutSettingsService);
+  private readonly sessionTimeoutSettingsComponentService = inject(
+    SessionTimeoutSettingsComponentService,
+  );
+  private readonly i18nService = inject(I18nService);
+  private readonly toastService = inject(ToastService);
+  private readonly policyService = inject(PolicyService);
+  private readonly accountService = inject(AccountService);
+  private readonly dialogService = inject(DialogService);
+  private readonly logService = inject(LogService);
+  private readonly destroyRef = inject(DestroyRef);
+  private readonly platformUtilsService = inject(PlatformUtilsService);
+
   formGroup = new FormGroup({
     timeout: new FormControl<VaultTimeout | null>(null, [Validators.required]),
     timeoutAction: new FormControl<VaultTimeoutAction>(VaultTimeoutAction.Lock, [
@@ -93,63 +107,48 @@ export class SessionTimeoutSettingsComponent implements OnInit {
     ]),
   });
   protected readonly availableTimeoutActions = signal<VaultTimeoutAction[]>([]);
-  protected readonly availableTimeoutOptions$ =
-    this.sessionTimeoutSettingsComponentService.availableTimeoutOptions$.pipe(
-      startWith([] as VaultTimeoutOption[]),
-    );
-  protected hasVaultTimeoutPolicy$: Observable<boolean> = of(false);
+  protected readonly availableTimeoutOptions$ = this.accountService.activeAccount$.pipe(
+    getUserId,
+    switchMap((userId) =>
+      this.sessionTimeoutSettingsComponentService.policyFilteredTimeoutOptions$(userId),
+    ),
+    tap((options) => {
+      this.logService.debug("[SessionTimeoutSettings] Available timeout options", options);
+    }),
+  );
+  protected readonly sessionTimeoutActionFromPolicy$ = this.accountService.activeAccount$.pipe(
+    getUserId,
+    switchMap((userId) =>
+      this.policyService.policiesByType$(PolicyType.MaximumVaultTimeout, userId),
+    ),
+    getFirstPolicy,
+    map((policy) => policy?.data as MaximumSessionTimeoutPolicyData | undefined),
+    map((data) => data?.action ?? null),
+  );
+  protected readonly sessionTimeoutActionFromPolicy = toSignal(
+    this.sessionTimeoutActionFromPolicy$,
+  );
 
   private userId!: UserId;
 
-  constructor(
-    private readonly vaultTimeoutSettingsService: VaultTimeoutSettingsService,
-    private readonly sessionTimeoutSettingsComponentService: SessionTimeoutSettingsComponentService,
-    private readonly i18nService: I18nService,
-    private readonly toastService: ToastService,
-    private readonly policyService: PolicyService,
-    private readonly accountService: AccountService,
-    private readonly dialogService: DialogService,
-    private readonly logService: LogService,
-    private readonly destroyRef: DestroyRef,
-  ) {}
-
   get canLock() {
     return this.availableTimeoutActions().includes(VaultTimeoutAction.Lock);
   }
 
+  get supportsLock() {
+    return (
+      this.platformUtilsService.getClientType() !== ClientType.Web &&
+      this.sessionTimeoutActionFromPolicy() !== "logOut"
+    );
+  }
+
   async ngOnInit(): Promise<void> {
-    const availableTimeoutOptions = await firstValueFrom(
-      this.sessionTimeoutSettingsComponentService.availableTimeoutOptions$,
-    );
-
-    this.logService.debug(
-      "[SessionTimeoutSettings] Available timeout options",
-      availableTimeoutOptions,
-    );
-
     this.userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
 
-    const maximumVaultTimeoutPolicy$ = this.policyService
-      .policiesByType$(PolicyType.MaximumVaultTimeout, this.userId)
-      .pipe(getFirstPolicy);
-
-    this.hasVaultTimeoutPolicy$ = maximumVaultTimeoutPolicy$.pipe(map((policy) => policy != null));
-
-    let timeout = await firstValueFrom(
+    const timeout = await firstValueFrom(
       this.vaultTimeoutSettingsService.getVaultTimeoutByUserId$(this.userId),
     );
 
-    // Fallback if current timeout option is not available on this platform
-    // Only applies to string-based timeout types, not numeric values
-    const hasCurrentOption = availableTimeoutOptions.some((opt) => opt.value === timeout);
-    if (!hasCurrentOption && typeof timeout !== "number") {
-      this.logService.debug(
-        "[SessionTimeoutSettings] Current timeout option not available, falling back from",
-        { timeout },
-      );
-      timeout = VaultTimeoutStringType.OnRestart;
-    }
-
     this.formGroup.patchValue(
       {
         timeout: timeout,
@@ -160,6 +159,23 @@ export class SessionTimeoutSettingsComponent implements OnInit {
       { emitEvent: false },
     );
 
+    // Sync form with reactive timeout updates to handle race condition where policies
+    // load asynchronously and may override the initially set timeout value
+    this.vaultTimeoutSettingsService
+      .getVaultTimeoutByUserId$(this.userId)
+      .pipe(
+        filter((timeout) => this.formGroup.controls.timeout.value !== timeout),
+        tap((timeout) =>
+          this.logService.debug(
+            `[SessionTimeoutSettings] Updating initial form timeout from ${this.formGroup.controls.timeout.value} to ${timeout}`,
+          ),
+        ),
+        takeUntilDestroyed(this.destroyRef),
+      )
+      .subscribe((timeout) => {
+        this.formGroup.controls.timeout.setValue(timeout, { emitEvent: false });
+      });
+
     this.refreshTimeoutActionSettings()
       .pipe(
         startWith(undefined),
@@ -167,19 +183,17 @@ export class SessionTimeoutSettingsComponent implements OnInit {
           combineLatest([
             this.vaultTimeoutSettingsService.availableVaultTimeoutActions$(this.userId),
             this.vaultTimeoutSettingsService.getVaultTimeoutActionByUserId$(this.userId),
-            maximumVaultTimeoutPolicy$,
+            this.sessionTimeoutActionFromPolicy$,
           ]),
         ),
         takeUntilDestroyed(this.destroyRef),
       )
-      .subscribe(([availableActions, action, policy]) => {
+      .subscribe(([availableActions, action, sessionTimeoutActionFromPolicy]) => {
         this.availableTimeoutActions.set(availableActions);
         this.formGroup.controls.timeoutAction.setValue(action, { emitEvent: false });
 
-        const policyData = policy?.data as MaximumVaultTimeoutPolicyData | undefined;
-
         // Enable/disable the action control based on policy or available actions
-        if (policyData?.action != null || availableActions.length <= 1) {
+        if (sessionTimeoutActionFromPolicy != null || availableActions.length <= 1) {
           this.formGroup.controls.timeoutAction.disable({ emitEvent: false });
         } else {
           this.formGroup.controls.timeoutAction.enable({ emitEvent: false });
diff --git a/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.spec.ts b/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.spec.ts
new file mode 100644
index 00000000000..9fe8ba6747b
--- /dev/null
+++ b/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.spec.ts
@@ -0,0 +1,337 @@
+import { fakeAsync, flush } from "@angular/core/testing";
+import { mock, MockProxy } from "jest-mock-extended";
+import { firstValueFrom, of } from "rxjs";
+
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
+import {
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutTypeService,
+} from "@bitwarden/common/key-management/session-timeout";
+import {
+  VaultTimeout,
+  VaultTimeoutOption,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { UserId } from "@bitwarden/common/types/guid";
+
+import { SessionTimeoutSettingsComponentService } from "./session-timeout-settings-component.service";
+
+describe("SessionTimeoutSettingsComponentService", () => {
+  let service: SessionTimeoutSettingsComponentService;
+  let mockI18nService: MockProxy<I18nService>;
+  let mockSessionTimeoutTypeService: MockProxy<SessionTimeoutTypeService>;
+  let mockPolicyService: MockProxy<PolicyService>;
+
+  const mockUserId = "test-user-id" as UserId;
+
+  beforeEach(() => {
+    mockI18nService = mock<I18nService>();
+    mockSessionTimeoutTypeService = mock<SessionTimeoutTypeService>();
+    mockPolicyService = mock<PolicyService>();
+
+    mockI18nService.t.mockImplementation((key) => `${key}-used-i18n`);
+    mockSessionTimeoutTypeService.isAvailable.mockResolvedValue(true);
+    mockPolicyService.policiesByType$.mockReturnValue(of([]));
+
+    service = new SessionTimeoutSettingsComponentService(
+      mockI18nService,
+      mockSessionTimeoutTypeService,
+      mockPolicyService,
+    );
+  });
+
+  it("should create", () => {
+    expect(service).toBeTruthy();
+  });
+
+  describe("availableTimeoutOptions$", () => {
+    it("should return all options when isAvailable returns true for all", fakeAsync(async () => {
+      mockSessionTimeoutTypeService.isAvailable.mockResolvedValue(true);
+      flush();
+
+      const options = await firstValueFrom(service["availableTimeoutOptions$"]);
+
+      assertAllTimeoutTypes(options);
+    }));
+
+    it("should filter options based on isAvailable() results", fakeAsync(async () => {
+      mockSessionTimeoutTypeService.isAvailable.mockImplementation(async (value: VaultTimeout) => {
+        return (
+          value === VaultTimeoutNumberType.OnMinute ||
+          value === 5 ||
+          value === VaultTimeoutStringType.OnLocked
+        );
+      });
+      flush();
+
+      const options = await firstValueFrom(service["availableTimeoutOptions$"]);
+
+      expect(options).toHaveLength(3);
+      expect(options).toContainEqual({ name: "oneMinute", value: VaultTimeoutNumberType.OnMinute });
+      expect(options).toContainEqual({ name: "fiveMinutes", value: 5 });
+      expect(options).toContainEqual({ name: "onLocked", value: VaultTimeoutStringType.OnLocked });
+      expect(options).not.toContainEqual({
+        name: "immediately",
+        value: VaultTimeoutNumberType.Immediately,
+      });
+    }));
+  });
+
+  describe("policyFilteredTimeoutOptions$", () => {
+    it("should return all available options when no policy for user", fakeAsync(async () => {
+      mockPolicyService.policiesByType$.mockReturnValue(of([]));
+      flush();
+
+      const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+      assertAllTimeoutTypes(options);
+    }));
+
+    describe('policy type "immediately"', () => {
+      it.each([VaultTimeoutNumberType.Immediately, VaultTimeoutNumberType.OnMinute])(
+        "should only return immediately option or fallback",
+        fakeAsync(async (availableTimeoutOrPromoted: VaultTimeout) => {
+          const policyData: MaximumSessionTimeoutPolicyData = {
+            type: "immediately",
+            minutes: 0,
+          };
+          const policy = {
+            id: "policy-id",
+            organizationId: "org-id",
+            type: PolicyType.MaximumVaultTimeout,
+            data: policyData,
+            enabled: true,
+          } as Policy;
+
+          mockPolicyService.policiesByType$.mockReturnValue(of([policy]));
+          mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(
+            availableTimeoutOrPromoted,
+          );
+          flush();
+
+          const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+          expect(options).toHaveLength(1);
+          if (availableTimeoutOrPromoted === VaultTimeoutNumberType.Immediately) {
+            expect(options[0]).toEqual({
+              name: "immediately",
+              value: VaultTimeoutNumberType.Immediately,
+            });
+          } else {
+            expect(options[0]).toEqual({
+              name: "oneMinute",
+              value: VaultTimeoutNumberType.OnMinute,
+            });
+          }
+        }),
+      );
+    });
+
+    describe('policy type "onSystemLock"', () => {
+      it.each([VaultTimeoutStringType.OnLocked, VaultTimeoutStringType.OnRestart])(
+        "should allow immediately, numeric, custom, onLocked, onIdle, onSleep or fallback",
+        fakeAsync(async (availableTimeoutOrPromoted: VaultTimeout) => {
+          const policyData: MaximumSessionTimeoutPolicyData = {
+            type: "onSystemLock",
+            minutes: 0,
+          };
+          const policy = {
+            id: "policy-id",
+            organizationId: "org-id",
+            type: PolicyType.MaximumVaultTimeout,
+            data: policyData,
+            enabled: true,
+          } as Policy;
+
+          mockPolicyService.policiesByType$.mockReturnValue(of([policy]));
+          mockSessionTimeoutTypeService.getOrPromoteToAvailable.mockResolvedValue(
+            availableTimeoutOrPromoted,
+          );
+          flush();
+
+          const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+          assertNumericTimeoutTypes(options);
+          expect(options).toContainEqual({
+            name: "onLocked",
+            value: VaultTimeoutStringType.OnLocked,
+          });
+          expect(options).toContainEqual({ name: "onIdle", value: VaultTimeoutStringType.OnIdle });
+          expect(options).toContainEqual({
+            name: "onSleep",
+            value: VaultTimeoutStringType.OnSleep,
+          });
+          expect(options).toContainEqual({ name: "custom", value: VaultTimeoutStringType.Custom });
+          expect(options).not.toContainEqual({
+            name: "never",
+            value: VaultTimeoutStringType.Never,
+          });
+          if (availableTimeoutOrPromoted === VaultTimeoutStringType.OnLocked) {
+            expect(options).not.toContainEqual({
+              name: "sessionTimeoutOnRestart",
+              value: VaultTimeoutStringType.OnRestart,
+            });
+          } else {
+            expect(options).toContainEqual({
+              name: "sessionTimeoutOnRestart",
+              value: VaultTimeoutStringType.OnRestart,
+            });
+          }
+        }),
+      );
+    });
+
+    describe('policy type "onAppRestart"', () => {
+      it("should allow immediately, numeric, custom, and onRestart", fakeAsync(async () => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "onAppRestart",
+          minutes: 0,
+        };
+        const policy = {
+          id: "policy-id",
+          organizationId: "org-id",
+          type: PolicyType.MaximumVaultTimeout,
+          data: policyData,
+          enabled: true,
+        } as Policy;
+
+        mockPolicyService.policiesByType$.mockReturnValue(of([policy]));
+        flush();
+
+        const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+        assertNumericTimeoutTypes(options);
+        expect(options).toContainEqual({
+          name: "sessionTimeoutOnRestart",
+          value: VaultTimeoutStringType.OnRestart,
+        });
+        expect(options).toContainEqual({ name: "custom", value: VaultTimeoutStringType.Custom });
+        expect(options).not.toContainEqual({
+          name: "onLocked",
+          value: VaultTimeoutStringType.OnLocked,
+        });
+        expect(options).not.toContainEqual({
+          name: "onIdle",
+          value: VaultTimeoutStringType.OnIdle,
+        });
+        expect(options).not.toContainEqual({
+          name: "onSleep",
+          value: VaultTimeoutStringType.OnSleep,
+        });
+        expect(options).not.toContainEqual({ name: "never", value: VaultTimeoutStringType.Never });
+      }));
+    });
+
+    describe('policy type "custom", null, or undefined', () => {
+      it.each(["custom", null, undefined])(
+        "should allow immediately, custom, and numeric values within policy limit when type is %s",
+        fakeAsync(async (policyType: "custom" | null | undefined) => {
+          const policyData: MaximumSessionTimeoutPolicyData = {
+            type: policyType as "custom" | null | undefined,
+            minutes: 15,
+          };
+          const policy = {
+            id: "policy-id",
+            organizationId: "org-id",
+            type: PolicyType.MaximumVaultTimeout,
+            data: policyData,
+            enabled: true,
+          } as Policy;
+
+          mockPolicyService.policiesByType$.mockReturnValue(of([policy]));
+          flush();
+
+          const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+          expect(options).toContainEqual({
+            name: "immediately",
+            value: VaultTimeoutNumberType.Immediately,
+          });
+          expect(options).toContainEqual({
+            name: "oneMinute",
+            value: VaultTimeoutNumberType.OnMinute,
+          });
+          expect(options).toContainEqual({ name: "fiveMinutes", value: 5 });
+          expect(options).toContainEqual({ name: "fifteenMinutes", value: 15 });
+          expect(options).toContainEqual({ name: "custom", value: VaultTimeoutStringType.Custom });
+          expect(options).not.toContainEqual({ name: "thirtyMinutes", value: 30 });
+          expect(options).not.toContainEqual({ name: "oneHour", value: 60 });
+          expect(options).not.toContainEqual({ name: "fourHours", value: 240 });
+          expect(options).not.toContainEqual({
+            name: "onLocked",
+            value: VaultTimeoutStringType.OnLocked,
+          });
+          expect(options).not.toContainEqual({
+            name: "onIdle",
+            value: VaultTimeoutStringType.OnIdle,
+          });
+          expect(options).not.toContainEqual({
+            name: "onSleep",
+            value: VaultTimeoutStringType.OnSleep,
+          });
+          expect(options).not.toContainEqual({
+            name: "sessionTimeoutOnRestart",
+            value: VaultTimeoutStringType.OnRestart,
+          });
+          expect(options).not.toContainEqual({
+            name: "never",
+            value: VaultTimeoutStringType.Never,
+          });
+        }),
+      );
+    });
+
+    describe('policy type "never"', () => {
+      it("should return all available options", fakeAsync(async () => {
+        const policyData: MaximumSessionTimeoutPolicyData = {
+          type: "never",
+          minutes: 0,
+        };
+        const policy = {
+          id: "policy-id",
+          organizationId: "org-id",
+          type: PolicyType.MaximumVaultTimeout,
+          data: policyData,
+          enabled: true,
+        } as Policy;
+
+        mockPolicyService.policiesByType$.mockReturnValue(of([policy]));
+        flush();
+
+        const options = await firstValueFrom(service.policyFilteredTimeoutOptions$(mockUserId));
+
+        assertAllTimeoutTypes(options);
+      }));
+    });
+  });
+
+  function assertAllTimeoutTypes(options: VaultTimeoutOption[]) {
+    assertNumericTimeoutTypes(options);
+    expect(options).toContainEqual({ name: "onIdle", value: VaultTimeoutStringType.OnIdle });
+    expect(options).toContainEqual({ name: "onSleep", value: VaultTimeoutStringType.OnSleep });
+    expect(options).toContainEqual({ name: "onLocked", value: VaultTimeoutStringType.OnLocked });
+    expect(options).toContainEqual({
+      name: "sessionTimeoutOnRestart",
+      value: VaultTimeoutStringType.OnRestart,
+    });
+    expect(options).toContainEqual({ name: "never", value: VaultTimeoutStringType.Never });
+    expect(options).toContainEqual({ name: "custom", value: VaultTimeoutStringType.Custom });
+  }
+
+  function assertNumericTimeoutTypes(options: VaultTimeoutOption[]) {
+    expect(options).toContainEqual({
+      name: "immediately",
+      value: VaultTimeoutNumberType.Immediately,
+    });
+    expect(options).toContainEqual({ name: "oneMinute", value: VaultTimeoutNumberType.OnMinute });
+    expect(options).toContainEqual({ name: "fiveMinutes", value: 5 });
+    expect(options).toContainEqual({ name: "fifteenMinutes", value: 15 });
+    expect(options).toContainEqual({ name: "thirtyMinutes", value: 30 });
+    expect(options).toContainEqual({ name: "oneHour", value: 60 });
+    expect(options).toContainEqual({ name: "fourHours", value: 240 });
+  }
+});
diff --git a/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.ts b/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.ts
index 7b9efeac9cb..d974eb25468 100644
--- a/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.ts
+++ b/libs/key-management-ui/src/session-timeout/services/session-timeout-settings-component.service.ts
@@ -1,9 +1,158 @@
-import { Observable } from "rxjs";
+import { combineLatest, concatMap, defer, map, Observable } from "rxjs";
 
-import { VaultTimeout, VaultTimeoutOption } from "@bitwarden/common/key-management/vault-timeout";
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import { getFirstPolicy } from "@bitwarden/common/admin-console/services/policy/default-policy.service";
+import {
+  MaximumSessionTimeoutPolicyData,
+  SessionTimeoutTypeService,
+} from "@bitwarden/common/key-management/session-timeout";
+import {
+  isVaultTimeoutTypeNumeric,
+  VaultTimeout,
+  VaultTimeoutOption,
+  VaultTimeoutNumberType,
+  VaultTimeoutStringType,
+} from "@bitwarden/common/key-management/vault-timeout";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { UserId } from "@bitwarden/user-core";
 
-export abstract class SessionTimeoutSettingsComponentService {
-  abstract availableTimeoutOptions$: Observable<VaultTimeoutOption[]>;
+export class SessionTimeoutSettingsComponentService {
+  private readonly availableTimeoutOptions$: Observable<VaultTimeoutOption[]>;
 
-  abstract onTimeoutSave(timeout: VaultTimeout): void;
+  constructor(
+    protected readonly i18nService: I18nService,
+    protected readonly sessionTimeoutTypeService: SessionTimeoutTypeService,
+    protected readonly policyService: PolicyService,
+  ) {
+    this.availableTimeoutOptions$ = defer(async () => {
+      const allOptions = this.getAllTimeoutOptions();
+      const availabilityResults = await Promise.all(
+        allOptions.map(async (option) => ({
+          option,
+          available: await this.sessionTimeoutTypeService.isAvailable(option.value),
+        })),
+      );
+
+      return availabilityResults
+        .filter((result) => result.available)
+        .map((result) => result.option);
+    });
+  }
+
+  onTimeoutSave(_timeout: VaultTimeout): void {
+    // Default implementation does nothing, but other clients might want to override this
+  }
+
+  policyFilteredTimeoutOptions$(userId: UserId): Observable<VaultTimeoutOption[]> {
+    const policyData$ = this.policyService
+      .policiesByType$(PolicyType.MaximumVaultTimeout, userId)
+      .pipe(
+        getFirstPolicy,
+        map((policy) => (policy?.data ?? null) as MaximumSessionTimeoutPolicyData | null),
+      );
+
+    return combineLatest([
+      this.availableTimeoutOptions$,
+      policyData$,
+      policyData$.pipe(
+        concatMap(async (policyData) => {
+          if (policyData == null) {
+            return null;
+          }
+          switch (policyData.type) {
+            case "immediately":
+              return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+                VaultTimeoutNumberType.Immediately,
+              );
+            case "onSystemLock":
+              return await this.sessionTimeoutTypeService.getOrPromoteToAvailable(
+                VaultTimeoutStringType.OnLocked,
+              );
+          }
+
+          return null;
+        }),
+      ),
+    ]).pipe(
+      concatMap(
+        async ([availableOptions, policyData, highestAvailableEnforcedByPolicyTimeoutType]) => {
+          if (policyData == null) {
+            return availableOptions;
+          }
+
+          return availableOptions.filter((option) => {
+            switch (policyData.type) {
+              case "immediately": {
+                // Policy requires immediate lock.
+                return option.value === highestAvailableEnforcedByPolicyTimeoutType;
+              }
+
+              case "onSystemLock": {
+                // Allow immediately, numeric values, custom, and any system lock-related options.
+                if (
+                  option.value === VaultTimeoutNumberType.Immediately ||
+                  isVaultTimeoutTypeNumeric(option.value) ||
+                  option.value === VaultTimeoutStringType.Custom ||
+                  option.value === VaultTimeoutStringType.OnLocked ||
+                  option.value === VaultTimeoutStringType.OnIdle ||
+                  option.value === VaultTimeoutStringType.OnSleep
+                ) {
+                  return true;
+                }
+
+                // When on locked is not supported, fallback.
+                return option.value === highestAvailableEnforcedByPolicyTimeoutType;
+              }
+
+              case "onAppRestart":
+                // Allow immediately, numeric values, custom, and on app restart
+                return (
+                  option.value === VaultTimeoutNumberType.Immediately ||
+                  isVaultTimeoutTypeNumeric(option.value) ||
+                  option.value === VaultTimeoutStringType.Custom ||
+                  option.value === VaultTimeoutStringType.OnRestart
+                );
+
+              case "custom":
+              case null:
+              case undefined:
+                // Allow immediately, custom, and numeric values within policy limit
+                return (
+                  option.value === VaultTimeoutNumberType.Immediately ||
+                  option.value === VaultTimeoutStringType.Custom ||
+                  (isVaultTimeoutTypeNumeric(option.value) &&
+                    (option.value as number) <= policyData.minutes)
+                );
+
+              case "never":
+                // No policy restriction
+                return true;
+
+              default:
+                throw Error(`Unsupported policy type: ${policyData.type}`);
+            }
+          });
+        },
+      ),
+    );
+  }
+
+  private getAllTimeoutOptions(): VaultTimeoutOption[] {
+    return [
+      { name: "immediately", value: VaultTimeoutNumberType.Immediately },
+      { name: "oneMinute", value: VaultTimeoutNumberType.OnMinute },
+      { name: "fiveMinutes", value: 5 },
+      { name: "fifteenMinutes", value: 15 },
+      { name: "thirtyMinutes", value: 30 },
+      { name: "oneHour", value: 60 },
+      { name: "fourHours", value: 240 },
+      { name: "onIdle", value: VaultTimeoutStringType.OnIdle },
+      { name: "onSleep", value: VaultTimeoutStringType.OnSleep },
+      { name: "onLocked", value: VaultTimeoutStringType.OnLocked },
+      { name: "sessionTimeoutOnRestart", value: VaultTimeoutStringType.OnRestart },
+      { name: "never", value: VaultTimeoutStringType.Never },
+      { name: "custom", value: VaultTimeoutStringType.Custom },
+    ];
+  }
 }
diff --git a/libs/key-management/src/abstractions/key.service.ts b/libs/key-management/src/abstractions/key.service.ts
index f86ca922c9e..feb4a38ac27 100644
--- a/libs/key-management/src/abstractions/key.service.ts
+++ b/libs/key-management/src/abstractions/key.service.ts
@@ -7,7 +7,7 @@ import {
   EncryptedString,
   EncString,
 } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { WrappedSigningKey } from "@bitwarden/common/key-management/types";
+import { SignedPublicKey, WrappedSigningKey } from "@bitwarden/common/key-management/types";
 import { KeySuffixOptions, HashPurpose } from "@bitwarden/common/platform/enums";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { OrganizationId, ProviderId, UserId } from "@bitwarden/common/types/guid";
@@ -428,4 +428,8 @@ export abstract class KeyService {
    * @param userId The user id for the key
    */
   abstract validateUserKey(key: UserKey, userId: UserId): Promise<boolean>;
+
+  abstract setSignedPublicKey(signedPublicKey: SignedPublicKey, userId: UserId): Promise<void>;
+
+  abstract userSignedPublicKey$(userId: UserId): Observable<SignedPublicKey | null>;
 }
diff --git a/libs/key-management/src/key.service.ts b/libs/key-management/src/key.service.ts
index f2c3c0eff7a..f0e5f6ee08e 100644
--- a/libs/key-management/src/key.service.ts
+++ b/libs/key-management/src/key.service.ts
@@ -28,7 +28,7 @@ import {
   EncryptedString,
 } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { WrappedSigningKey } from "@bitwarden/common/key-management/types";
+import { SignedPublicKey, WrappedSigningKey } from "@bitwarden/common/key-management/types";
 import { VaultTimeoutStringType } from "@bitwarden/common/key-management/vault-timeout";
 import { VAULT_TIMEOUT } from "@bitwarden/common/key-management/vault-timeout/services/vault-timeout-settings.state";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -46,6 +46,7 @@ import {
   USER_EVER_HAD_USER_KEY,
   USER_KEY,
   USER_KEY_ENCRYPTED_SIGNING_KEY,
+  USER_SIGNED_PUBLIC_KEY,
 } from "@bitwarden/common/platform/services/key-state/user-key.state";
 import { StateProvider } from "@bitwarden/common/platform/state";
 import { CsprngArray } from "@bitwarden/common/types/csprng";
@@ -1013,4 +1014,12 @@ export class DefaultKeyService implements KeyServiceAbstraction {
       }),
     );
   }
+
+  async setSignedPublicKey(signedPublicKey: SignedPublicKey, userId: UserId): Promise<void> {
+    await this.stateProvider.setUserState(USER_SIGNED_PUBLIC_KEY, signedPublicKey, userId);
+  }
+
+  userSignedPublicKey$(userId: UserId): Observable<SignedPublicKey | null> {
+    return this.stateProvider.getUserState$(USER_SIGNED_PUBLIC_KEY, userId);
+  }
 }
diff --git a/libs/key-management/src/user-asymmetric-key-regeneration/abstractions/user-asymmetric-key-regeneration.service.ts b/libs/key-management/src/user-asymmetric-key-regeneration/abstractions/user-asymmetric-key-regeneration.service.ts
index 4703d836db7..58620f49ed1 100644
--- a/libs/key-management/src/user-asymmetric-key-regeneration/abstractions/user-asymmetric-key-regeneration.service.ts
+++ b/libs/key-management/src/user-asymmetric-key-regeneration/abstractions/user-asymmetric-key-regeneration.service.ts
@@ -7,4 +7,11 @@ export abstract class UserAsymmetricKeysRegenerationService {
    * @param userId The user id.
    */
   abstract regenerateIfNeeded(userId: UserId): Promise<void>;
+
+  /**
+   * Performs the regeneration of the user's public/private key pair without checking any preconditions.
+   * This should only be used for V1 encryption accounts
+   * @param userId The user id.
+   */
+  abstract regenerateUserPublicKeyEncryptionKeyPair(userId: UserId): Promise<void>;
 }
diff --git a/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.spec.ts b/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.spec.ts
index e57ab74de6b..92e5240a187 100644
--- a/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.spec.ts
+++ b/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.spec.ts
@@ -370,3 +370,52 @@ describe("regenerateIfNeeded", () => {
     );
   });
 });
+
+describe("regenerateUserPublicKeyEncryptionKeyPair", () => {
+  let sut: DefaultUserAsymmetricKeysRegenerationService;
+  const userId = "userId" as UserId;
+
+  let keyService: MockProxy<KeyService>;
+  let cipherService: MockProxy<CipherService>;
+  let userAsymmetricKeysRegenerationApiService: MockProxy<UserAsymmetricKeysRegenerationApiService>;
+  let logService: MockProxy<LogService>;
+  let sdkService: MockSdkService;
+  let apiService: MockProxy<ApiService>;
+  let configService: MockProxy<ConfigService>;
+
+  beforeEach(() => {
+    keyService = mock<KeyService>();
+    cipherService = mock<CipherService>();
+    userAsymmetricKeysRegenerationApiService = mock<UserAsymmetricKeysRegenerationApiService>();
+    logService = mock<LogService>();
+    sdkService = new MockSdkService();
+    apiService = mock<ApiService>();
+    configService = mock<ConfigService>();
+
+    sut = new DefaultUserAsymmetricKeysRegenerationService(
+      keyService,
+      cipherService,
+      userAsymmetricKeysRegenerationApiService,
+      logService,
+      sdkService,
+      apiService,
+      configService,
+    );
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it("should throw error when user key is not V1 encryption type", async () => {
+    const mockUserKey = {
+      keyB64: "mockKeyB64",
+      inner: () => ({ type: 7 }),
+    } as unknown as UserKey;
+    keyService.userKey$.mockReturnValue(of(mockUserKey));
+
+    await expect(sut.regenerateUserPublicKeyEncryptionKeyPair(userId)).rejects.toThrow(
+      "User key is not V1 encryption type",
+    );
+  });
+});
diff --git a/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.ts b/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.ts
index 335f45b0ce2..48fe3a1686f 100644
--- a/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.ts
+++ b/libs/key-management/src/user-asymmetric-key-regeneration/services/default-user-asymmetric-key-regeneration.service.ts
@@ -37,7 +37,7 @@ export class DefaultUserAsymmetricKeysRegenerationService
       if (privateKeyRegenerationFlag) {
         const shouldRegenerate = await this.shouldRegenerate(userId);
         if (shouldRegenerate) {
-          await this.regenerateUserAsymmetricKeys(userId);
+          await this.regenerateUserPublicKeyEncryptionKeyPair(userId);
         }
       }
     } catch (error) {
@@ -125,11 +125,14 @@ export class DefaultUserAsymmetricKeysRegenerationService
     return false;
   }
 
-  private async regenerateUserAsymmetricKeys(userId: UserId): Promise<void> {
+  async regenerateUserPublicKeyEncryptionKeyPair(userId: UserId): Promise<void> {
     const userKey = await firstValueFrom(this.keyService.userKey$(userId));
     if (userKey == null) {
       throw new Error("User key not found");
     }
+    if (userKey.inner().type !== EncryptionType.AesCbc256_HmacSha256_B64) {
+      throw new Error("User key is not V1 encryption type");
+    }
     const makeKeyPairResponse = await firstValueFrom(
       this.sdkService.client$.pipe(
         map((sdk) => {
diff --git a/libs/node/src/services/node-crypto-function.service.spec.ts b/libs/node/src/services/node-crypto-function.service.spec.ts
index 3256d85110f..28a6c127d44 100644
--- a/libs/node/src/services/node-crypto-function.service.spec.ts
+++ b/libs/node/src/services/node-crypto-function.service.spec.ts
@@ -1,9 +1,17 @@
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { EcbDecryptParameters } from "@bitwarden/common/platform/models/domain/decrypt-parameters";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 
 import { NodeCryptoFunctionService } from "./node-crypto-function.service";
 
+class TestSdkLoadService extends SdkLoadService {
+  protected override load(): Promise<void> {
+    // Simulate successful WASM load
+    return Promise.resolve();
+  }
+}
+
 const RsaPublicKey =
   "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl0Vawl/toXzkEvB82FEtqHP" +
   "4xlU2ab/v0crqIfXfIoWF/XXdHGIdrZeilnRXPPJT1B9dTsasttEZNnua/0Rek/cjNDHtzT52irfoZYS7X6HNIfOi54Q+egP" +
@@ -37,6 +45,10 @@ const Sha512Mac =
   "5ea7817a0b7c5d4d9b00364ccd214669131fc17fe4aca";
 
 describe("NodeCrypto Function Service", () => {
+  beforeAll(async () => {
+    await new TestSdkLoadService().loadAndInit();
+  });
+
   describe("pbkdf2", () => {
     const regular256Key = "pj9prw/OHPleXI6bRdmlaD+saJS4awrMiQsQiDjeu2I=";
     const utf8256Key = "yqvoFXgMRmHR3QPYr5pyR4uVuoHkltv9aHUP63p8n7I=";
@@ -279,7 +291,6 @@ describe("NodeCrypto Function Service", () => {
   });
 
   describe("rsaGenerateKeyPair", () => {
-    testRsaGenerateKeyPair(1024);
     testRsaGenerateKeyPair(2048);
 
     // Generating 4096 bit keys is really slow with Forge lib.
@@ -514,7 +525,7 @@ function testCompare(fast = false) {
   });
 }
 
-function testRsaGenerateKeyPair(length: 1024 | 2048 | 4096) {
+function testRsaGenerateKeyPair(length: 2048) {
   it(
     "should successfully generate a " + length + " bit key pair",
     async () => {
diff --git a/libs/node/src/services/node-crypto-function.service.ts b/libs/node/src/services/node-crypto-function.service.ts
index 22cc5756f30..49dbc65ca84 100644
--- a/libs/node/src/services/node-crypto-function.service.ts
+++ b/libs/node/src/services/node-crypto-function.service.ts
@@ -4,6 +4,7 @@ import * as forge from "node-forge";
 
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { UnsignedPublicKey } from "@bitwarden/common/key-management/types";
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
 import { EncryptionType } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import {
@@ -12,6 +13,7 @@ import {
 } from "@bitwarden/common/platform/models/domain/decrypt-parameters";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { CsprngArray } from "@bitwarden/common/types/csprng";
+import { PureCrypto } from "@bitwarden/sdk-internal";
 
 export class NodeCryptoFunctionService implements CryptoFunctionService {
   pbkdf2(
@@ -205,72 +207,34 @@ export class NodeCryptoFunctionService implements CryptoFunctionService {
     return Promise.resolve(this.toUint8Buffer(decBuf));
   }
 
-  rsaEncrypt(
+  async rsaEncrypt(
     data: Uint8Array,
     publicKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    _algorithm: "sha1",
   ): Promise<Uint8Array> {
-    if (algorithm === "sha256") {
-      throw new Error("Node crypto does not support RSA-OAEP SHA-256");
-    }
-
-    const pem = this.toPemPublicKey(publicKey);
-    const decipher = crypto.publicEncrypt(pem, this.toNodeBuffer(data));
-    return Promise.resolve(this.toUint8Buffer(decipher));
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_encrypt_data(data, publicKey);
   }
 
-  rsaDecrypt(
+  async rsaDecrypt(
     data: Uint8Array,
     privateKey: Uint8Array,
-    algorithm: "sha1" | "sha256",
+    _algorithm: "sha1",
   ): Promise<Uint8Array> {
-    if (algorithm === "sha256") {
-      throw new Error("Node crypto does not support RSA-OAEP SHA-256");
-    }
-
-    const pem = this.toPemPrivateKey(privateKey);
-    const decipher = crypto.privateDecrypt(pem, this.toNodeBuffer(data));
-    return Promise.resolve(this.toUint8Buffer(decipher));
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_decrypt_data(data, privateKey);
   }
 
   async rsaExtractPublicKey(privateKey: Uint8Array): Promise<UnsignedPublicKey> {
-    const privateKeyByteString = Utils.fromBufferToByteString(privateKey);
-    const privateKeyAsn1 = forge.asn1.fromDer(privateKeyByteString);
-    const forgePrivateKey: any = forge.pki.privateKeyFromAsn1(privateKeyAsn1);
-    const forgePublicKey = (forge.pki as any).setRsaPublicKey(forgePrivateKey.n, forgePrivateKey.e);
-    const publicKeyAsn1 = forge.pki.publicKeyToAsn1(forgePublicKey);
-    const publicKeyByteString = forge.asn1.toDer(publicKeyAsn1).data;
-    const publicKeyArray = Utils.fromByteStringToArray(publicKeyByteString);
-    return publicKeyArray as UnsignedPublicKey;
+    await SdkLoadService.Ready;
+    return PureCrypto.rsa_extract_public_key(privateKey) as UnsignedPublicKey;
   }
 
-  async rsaGenerateKeyPair(length: 1024 | 2048 | 4096): Promise<[UnsignedPublicKey, Uint8Array]> {
-    return new Promise<[UnsignedPublicKey, Uint8Array]>((resolve, reject) => {
-      forge.pki.rsa.generateKeyPair(
-        {
-          bits: length,
-          workers: -1,
-          e: 0x10001, // 65537
-        },
-        (error, keyPair) => {
-          if (error != null) {
-            reject(error);
-            return;
-          }
-
-          const publicKeyAsn1 = forge.pki.publicKeyToAsn1(keyPair.publicKey);
-          const publicKeyByteString = forge.asn1.toDer(publicKeyAsn1).getBytes();
-          const publicKey = Utils.fromByteStringToArray(publicKeyByteString);
-
-          const privateKeyAsn1 = forge.pki.privateKeyToAsn1(keyPair.privateKey);
-          const privateKeyPkcs8 = forge.pki.wrapRsaPrivateKey(privateKeyAsn1);
-          const privateKeyByteString = forge.asn1.toDer(privateKeyPkcs8).getBytes();
-          const privateKey = Utils.fromByteStringToArray(privateKeyByteString);
-
-          resolve([publicKey as UnsignedPublicKey, privateKey]);
-        },
-      );
-    });
+  async rsaGenerateKeyPair(_length: 2048): Promise<[UnsignedPublicKey, Uint8Array]> {
+    await SdkLoadService.Ready;
+    const privateKey = PureCrypto.rsa_generate_keypair();
+    const publicKey = await this.rsaExtractPublicKey(privateKey);
+    return [publicKey, privateKey];
   }
 
   aesGenerateKey(bitLength: 128 | 192 | 256 | 512): Promise<CsprngArray> {
diff --git a/libs/state/src/core/state-definitions.ts b/libs/state/src/core/state-definitions.ts
index 9d404f14dd7..156c03620b7 100644
--- a/libs/state/src/core/state-definitions.ts
+++ b/libs/state/src/core/state-definitions.ts
@@ -54,8 +54,6 @@ export const DEVICE_TRUST_DISK_LOCAL = new StateDefinition("deviceTrust", "disk"
   web: "disk-local",
   browser: "disk-backup-local-storage",
 });
-export const KDF_CONFIG_DISK = new StateDefinition("kdfConfig", "disk");
-export const KEY_CONNECTOR_DISK = new StateDefinition("keyConnector", "disk");
 export const LOGIN_EMAIL_DISK = new StateDefinition("loginEmail", "disk", {
   web: "disk-local",
 });
@@ -64,8 +62,6 @@ export const LOGIN_STRATEGY_MEMORY = new StateDefinition("loginStrategy", "memor
 export const MASTER_PASSWORD_DISK = new StateDefinition("masterPassword", "disk");
 export const MASTER_PASSWORD_MEMORY = new StateDefinition("masterPassword", "memory");
 export const MASTER_PASSWORD_UNLOCK_DISK = new StateDefinition("masterPasswordUnlock", "disk");
-export const PIN_DISK = new StateDefinition("pinUnlock", "disk");
-export const PIN_MEMORY = new StateDefinition("pinUnlock", "memory");
 export const ROUTER_DISK = new StateDefinition("router", "disk");
 export const SSO_DISK = new StateDefinition("ssoLogin", "disk");
 export const SSO_DISK_LOCAL = new StateDefinition("ssoLoginLocal", "disk", { web: "disk-local" });
@@ -117,13 +113,10 @@ export const PHISHING_DETECTION_DISK = new StateDefinition("phishingDetection",
 export const APPLICATION_ID_DISK = new StateDefinition("applicationId", "disk", {
   web: "disk-local",
 });
-export const BIOMETRIC_SETTINGS_DISK = new StateDefinition("biometricSettings", "disk");
 export const CLEAR_EVENT_DISK = new StateDefinition("clearEvent", "disk");
 export const CONFIG_DISK = new StateDefinition("config", "disk", {
   web: "disk-local",
 });
-export const CRYPTO_DISK = new StateDefinition("crypto", "disk");
-export const CRYPTO_MEMORY = new StateDefinition("crypto", "memory");
 export const DESKTOP_SETTINGS_DISK = new StateDefinition("desktopSettings", "disk");
 export const ENVIRONMENT_DISK = new StateDefinition("environment", "disk");
 export const ENVIRONMENT_MEMORY = new StateDefinition("environment", "memory");
@@ -225,3 +218,14 @@ export const VAULT_BROWSER_INTRO_CAROUSEL = new StateDefinition(
   "disk",
 );
 export const VAULT_AT_RISK_PASSWORDS_MEMORY = new StateDefinition("vaultAtRiskPasswords", "memory");
+
+// KM
+
+export const BIOMETRIC_SETTINGS_DISK = new StateDefinition("biometricSettings", "disk");
+export const ENCRYPTED_MIGRATION_DISK = new StateDefinition("encryptedMigration", "disk");
+export const PIN_DISK = new StateDefinition("pinUnlock", "disk");
+export const PIN_MEMORY = new StateDefinition("pinUnlock", "memory");
+export const CRYPTO_DISK = new StateDefinition("crypto", "disk");
+export const CRYPTO_MEMORY = new StateDefinition("crypto", "memory");
+export const KDF_CONFIG_DISK = new StateDefinition("kdfConfig", "disk");
+export const KEY_CONNECTOR_DISK = new StateDefinition("keyConnector", "disk");
diff --git a/libs/state/src/state-migrations/migrate.ts b/libs/state/src/state-migrations/migrate.ts
index bf4cd17adba..a051c25695a 100644
--- a/libs/state/src/state-migrations/migrate.ts
+++ b/libs/state/src/state-migrations/migrate.ts
@@ -70,12 +70,13 @@ import { RemoveAcBannersDismissed } from "./migrations/70-remove-ac-banner-dismi
 import { RemoveNewCustomizationOptionsCalloutDismissed } from "./migrations/71-remove-new-customization-options-callout-dismissed";
 import { RemoveAccountDeprovisioningBannerDismissed } from "./migrations/72-remove-account-deprovisioning-banner-dismissed";
 import { AddMasterPasswordUnlockData } from "./migrations/73-add-master-password-unlock-data";
+import { RemoveLegacyPin } from "./migrations/74-remove-legacy-pin";
 import { MoveStateVersionMigrator } from "./migrations/8-move-state-version";
 import { MoveBrowserSettingsToGlobal } from "./migrations/9-move-browser-settings-to-global";
 import { MinVersionMigrator } from "./migrations/min-version";
 
 export const MIN_VERSION = 3;
-export const CURRENT_VERSION = 73;
+export const CURRENT_VERSION = 74;
 export type MinVersion = typeof MIN_VERSION;
 
 export function createMigrationBuilder() {
@@ -150,7 +151,8 @@ export function createMigrationBuilder() {
     .with(RemoveAcBannersDismissed, 69, 70)
     .with(RemoveNewCustomizationOptionsCalloutDismissed, 70, 71)
     .with(RemoveAccountDeprovisioningBannerDismissed, 71, 72)
-    .with(AddMasterPasswordUnlockData, 72, CURRENT_VERSION);
+    .with(AddMasterPasswordUnlockData, 72, 73)
+    .with(RemoveLegacyPin, 73, CURRENT_VERSION);
 }
 
 export async function currentVersion(
diff --git a/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.spec.ts b/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.spec.ts
new file mode 100644
index 00000000000..842410b2706
--- /dev/null
+++ b/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.spec.ts
@@ -0,0 +1,50 @@
+import { runMigrator } from "../migration-helper.spec";
+import { IRREVERSIBLE } from "../migrator";
+
+import { RemoveLegacyPin } from "./74-remove-legacy-pin";
+
+describe("RemoveLegacyPin", () => {
+  const sut = new RemoveLegacyPin(73, 74);
+
+  describe("migrate", () => {
+    it("deletes legacy pin from all users", async () => {
+      const output = await runMigrator(sut, {
+        global_account_accounts: {
+          user1: {
+            email: "user1@email.com",
+            name: "User 1",
+            emailVerified: true,
+          },
+          user2: {
+            email: "user2@email.com",
+            name: "User 2",
+            emailVerified: true,
+          },
+        },
+        user_user1_pinUnlock_pinKeyEncryptedUserKeyPersistent: "abc",
+        user_user2_pinUnlock_pinKeyEncryptedUserKeyPersistent: "def",
+      });
+
+      expect(output).toEqual({
+        global_account_accounts: {
+          user1: {
+            email: "user1@email.com",
+            name: "User 1",
+            emailVerified: true,
+          },
+          user2: {
+            email: "user2@email.com",
+            name: "User 2",
+            emailVerified: true,
+          },
+        },
+      });
+    });
+  });
+
+  describe("rollback", () => {
+    it("is irreversible", async () => {
+      await expect(runMigrator(sut, {}, "rollback")).rejects.toThrow(IRREVERSIBLE);
+    });
+  });
+});
diff --git a/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.ts b/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.ts
new file mode 100644
index 00000000000..277ae5832b5
--- /dev/null
+++ b/libs/state/src/state-migrations/migrations/74-remove-legacy-pin.ts
@@ -0,0 +1,30 @@
+import { KeyDefinitionLike, MigrationHelper } from "../migration-helper";
+import { IRREVERSIBLE, Migrator } from "../migrator";
+
+type ExpectedAccountType = NonNullable<unknown>;
+
+export const PinProtectedUserKey: KeyDefinitionLike = {
+  key: "pinKeyEncryptedUserKeyPersistent",
+  stateDefinition: {
+    name: "pinUnlock",
+  },
+};
+
+export class RemoveLegacyPin extends Migrator<73, 74> {
+  async migrate(helper: MigrationHelper): Promise<void> {
+    const accounts = await helper.getAccounts<ExpectedAccountType>();
+    async function migrateAccount(userId: string, account: ExpectedAccountType): Promise<void> {
+      const pinProtectedUserKey = await helper.getFromUser(userId, PinProtectedUserKey);
+
+      if (pinProtectedUserKey != null) {
+        await helper.removeFromUser(userId, PinProtectedUserKey);
+      }
+    }
+
+    await Promise.all([...accounts.map(({ userId, account }) => migrateAccount(userId, account))]);
+  }
+
+  async rollback(helper: MigrationHelper): Promise<void> {
+    throw IRREVERSIBLE;
+  }
+}
diff --git a/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts b/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts
index c11ab3d9e6b..620f465789c 100644
--- a/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts
@@ -1,8 +1,8 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { UserId } from "@bitwarden/common/types/guid";
 import { CipherType } from "@bitwarden/common/vault/enums";
@@ -12,7 +12,7 @@ import { KdfConfig, KdfConfigService, KdfType } from "@bitwarden/key-management"
 import { BitwardenCsvExportType, BitwardenPasswordProtectedFileFormat } from "../types";
 export class BaseVaultExportService {
   constructor(
-    protected pinService: PinServiceAbstraction,
+    protected keyGenerationService: KeyGenerationService,
     protected encryptService: EncryptService,
     private cryptoFunctionService: CryptoFunctionService,
     private kdfConfigService: KdfConfigService,
@@ -26,7 +26,8 @@ export class BaseVaultExportService {
     const kdfConfig: KdfConfig = await this.kdfConfigService.getKdfConfig(userId);
 
     const salt = Utils.fromBufferToB64(await this.cryptoFunctionService.randomBytes(16));
-    const key = await this.pinService.makePinKey(password, salt, kdfConfig);
+
+    const key = await this.keyGenerationService.deriveVaultExportKey(password, salt, kdfConfig);
 
     const encKeyValidation = await this.encryptService.encryptString(Utils.newGuid(), key);
     const encText = await this.encryptService.encryptString(clearText, key);
diff --git a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts
index 4214873feed..33dde9ae51a 100644
--- a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts
@@ -3,13 +3,13 @@ import * as JSZip from "jszip";
 import { BehaviorSubject, of } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import {
   EncryptedString,
   EncString,
 } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { CipherWithIdExport } from "@bitwarden/common/models/export/cipher-with-ids.export";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherId, emptyGuid, UserId } from "@bitwarden/common/types/guid";
@@ -169,7 +169,7 @@ describe("VaultExportService", () => {
   let exportService: IndividualVaultExportService;
   let cryptoFunctionService: MockProxy<CryptoFunctionService>;
   let cipherService: MockProxy<CipherService>;
-  let pinService: MockProxy<PinServiceAbstraction>;
+  let keyGenerationService: MockProxy<KeyGenerationService>;
   let folderService: MockProxy<FolderService>;
   let keyService: MockProxy<KeyService>;
   let encryptService: MockProxy<EncryptService>;
@@ -184,7 +184,7 @@ describe("VaultExportService", () => {
   beforeEach(() => {
     cryptoFunctionService = mock<CryptoFunctionService>();
     cipherService = mock<CipherService>();
-    pinService = mock<PinServiceAbstraction>();
+    keyGenerationService = mock<KeyGenerationService>();
     folderService = mock<FolderService>();
     keyService = mock<KeyService>();
     encryptService = mock<EncryptService>();
@@ -220,7 +220,7 @@ describe("VaultExportService", () => {
     exportService = new IndividualVaultExportService(
       folderService,
       cipherService,
-      pinService,
+      keyGenerationService,
       keyService,
       encryptService,
       cryptoFunctionService,
diff --git a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts
index e7a97801e09..ddda96b21e0 100644
--- a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts
@@ -5,9 +5,9 @@ import * as papa from "papaparse";
 import { firstValueFrom } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { CipherWithIdExport, FolderWithIdExport } from "@bitwarden/common/models/export";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherId, UserId } from "@bitwarden/common/types/guid";
@@ -42,7 +42,7 @@ export class IndividualVaultExportService
   constructor(
     private folderService: FolderService,
     private cipherService: CipherService,
-    pinService: PinServiceAbstraction,
+    keyGenerationService: KeyGenerationService,
     private keyService: KeyService,
     encryptService: EncryptService,
     cryptoFunctionService: CryptoFunctionService,
@@ -50,7 +50,7 @@ export class IndividualVaultExportService
     private apiService: ApiService,
     private restrictedItemTypesService: RestrictedItemTypesService,
   ) {
-    super(pinService, encryptService, cryptoFunctionService, kdfConfigService);
+    super(keyGenerationService, encryptService, cryptoFunctionService, kdfConfigService);
   }
 
   /** Creates an export of an individual vault (My Vault). Based on the provided format it will either be unencrypted, encrypted or password protected and in case zip is selected will include attachments
diff --git a/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts b/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
index 678dd600f94..ed3a16516f2 100644
--- a/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
@@ -10,9 +10,9 @@ import {
   CollectionDetailsResponse,
   CollectionView,
 } from "@bitwarden/admin-console/common";
+import { KeyGenerationService } from "@bitwarden/common/key-management/crypto";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import { CipherWithIdExport, CollectionWithIdExport } from "@bitwarden/common/models/export";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
@@ -46,7 +46,7 @@ export class OrganizationVaultExportService
   constructor(
     private cipherService: CipherService,
     private vaultExportApiService: VaultExportApiService,
-    pinService: PinServiceAbstraction,
+    keyGenerationService: KeyGenerationService,
     private keyService: KeyService,
     encryptService: EncryptService,
     cryptoFunctionService: CryptoFunctionService,
@@ -54,7 +54,7 @@ export class OrganizationVaultExportService
     kdfConfigService: KdfConfigService,
     private restrictedItemTypesService: RestrictedItemTypesService,
   ) {
-    super(pinService, encryptService, cryptoFunctionService, kdfConfigService);
+    super(keyGenerationService, encryptService, cryptoFunctionService, kdfConfigService);
   }
 
   /** Creates a password protected export of an organizational vault.
diff --git a/libs/tools/generator/components/src/catchall-settings.component.ts b/libs/tools/generator/components/src/catchall-settings.component.ts
index 0fb953b86dc..a30a1c65b8c 100644
--- a/libs/tools/generator/components/src/catchall-settings.component.ts
+++ b/libs/tools/generator/components/src/catchall-settings.component.ts
@@ -8,15 +8,18 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { map, ReplaySubject, skip, Subject, takeUntil, withLatestFrom } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
+import { FormFieldModule } from "@bitwarden/components";
 import {
   CatchallGenerationOptions,
   CredentialGeneratorService,
   BuiltIn,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 /** Options group for catchall emails */
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
@@ -24,7 +27,7 @@ import {
 @Component({
   selector: "tools-catchall-settings",
   templateUrl: "catchall-settings.component.html",
-  standalone: false,
+  imports: [ReactiveFormsModule, FormFieldModule, JslibModule, I18nPipe],
 })
 export class CatchallSettingsComponent implements OnInit, OnDestroy, OnChanges {
   /** Instantiates the component
diff --git a/libs/tools/generator/components/src/credential-generator-history-dialog.component.html b/libs/tools/generator/components/src/credential-generator-history-dialog.component.html
index e107e33ca50..c392b323a6b 100644
--- a/libs/tools/generator/components/src/credential-generator-history-dialog.component.html
+++ b/libs/tools/generator/components/src/credential-generator-history-dialog.component.html
@@ -1,8 +1,11 @@
 <bit-dialog #dialog background="alt">
   <span bitDialogTitle>{{ "generatorHistory" | i18n }}</span>
   <ng-container bitDialogContent>
-    <bit-empty-credential-history *ngIf="!(hasHistory$ | async)" style="display: contents" />
-    <bit-credential-generator-history [account]="account$ | async" *ngIf="hasHistory$ | async" />
+    @if (hasHistory$ | async) {
+      <bit-credential-generator-history [account]="account$ | async" />
+    } @else {
+      <bit-empty-credential-history style="display: contents" />
+    }
   </ng-container>
   <ng-container bitDialogFooter>
     <button
diff --git a/libs/tools/generator/components/src/credential-generator-history.component.html b/libs/tools/generator/components/src/credential-generator-history.component.html
index 1f2f3d99e00..c00f9760cea 100644
--- a/libs/tools/generator/components/src/credential-generator-history.component.html
+++ b/libs/tools/generator/components/src/credential-generator-history.component.html
@@ -1,22 +1,24 @@
-<bit-item *ngFor="let credential of credentials$ | async">
-  <bit-item-content>
-    <bit-color-password class="tw-font-mono" [password]="credential.credential" />
-    <div slot="secondary">
-      {{ credential.generationDate | date: "medium" }}
-    </div>
-  </bit-item-content>
-  <ng-container slot="end">
-    <bit-item-action>
-      <button
-        type="button"
-        bitIconButton="bwi-clone"
-        [appCopyClick]="credential.credential"
-        [valueLabel]="getGeneratedValueText(credential)"
-        [label]="getCopyText(credential)"
-        showToast
-      >
-        {{ getCopyText(credential) }}
-      </button>
-    </bit-item-action>
-  </ng-container>
-</bit-item>
+@for (credential of credentials$ | async; track credential) {
+  <bit-item>
+    <bit-item-content>
+      <bit-color-password class="tw-font-mono" [password]="credential.credential" />
+      <div slot="secondary">
+        {{ credential.generationDate | date: "medium" }}
+      </div>
+    </bit-item-content>
+    <ng-container slot="end">
+      <bit-item-action>
+        <button
+          type="button"
+          bitIconButton="bwi-clone"
+          [appCopyClick]="credential.credential"
+          [valueLabel]="getGeneratedValueText(credential)"
+          [label]="getCopyText(credential)"
+          showToast
+        >
+          {{ getCopyText(credential) }}
+        </button>
+      </bit-item-action>
+    </ng-container>
+  </bit-item>
+}
diff --git a/libs/tools/generator/components/src/credential-generator-history.component.ts b/libs/tools/generator/components/src/credential-generator-history.component.ts
index a09a82c74b8..e732aa0198e 100644
--- a/libs/tools/generator/components/src/credential-generator-history.component.ts
+++ b/libs/tools/generator/components/src/credential-generator-history.component.ts
@@ -23,7 +23,6 @@ import {
 import { AlgorithmsByType, CredentialGeneratorService } from "@bitwarden/generator-core";
 import { GeneratedCredential, GeneratorHistoryService } from "@bitwarden/generator-history";
 
-import { GeneratorModule } from "./generator.module";
 import { translate } from "./util";
 
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
@@ -32,13 +31,12 @@ import { translate } from "./util";
   selector: "bit-credential-generator-history",
   templateUrl: "credential-generator-history.component.html",
   imports: [
-    ColorPasswordModule,
     CommonModule,
+    ColorPasswordModule,
     IconButtonModule,
     NoItemsModule,
     JslibModule,
     ItemModule,
-    GeneratorModule,
   ],
 })
 export class CredentialGeneratorHistoryComponent implements OnChanges, OnInit, OnDestroy {
diff --git a/libs/tools/generator/components/src/credential-generator.component.html b/libs/tools/generator/components/src/credential-generator.component.html
index 124de1e3c45..f97e1500b33 100644
--- a/libs/tools/generator/components/src/credential-generator.component.html
+++ b/libs/tools/generator/components/src/credential-generator.component.html
@@ -6,9 +6,11 @@
   (selectedChange)="onRootChanged({ nav: $event })"
   attr.aria-label="{{ 'type' | i18n }}"
 >
-  <bit-toggle *ngFor="let option of rootOptions$ | async" [value]="option.value">
-    {{ option.label }}
-  </bit-toggle>
+  @for (option of rootOptions$ | async; track option) {
+    <bit-toggle [value]="option.value">
+      {{ option.label }}
+    </bit-toggle>
+  }
 </bit-toggle-group>
 
 <nudge-generator-spotlight></nudge-generator-spotlight>
@@ -40,69 +42,80 @@
     ></button>
   </div>
 </bit-card>
-<tools-password-settings
-  class="tw-mt-6"
-  *ngIf="(showAlgorithm$ | async)?.id === Algorithm.password"
-  [account]="account$ | async"
-  (onUpdated)="generate('password settings')"
-/>
-<tools-passphrase-settings
-  class="tw-mt-6"
-  *ngIf="(showAlgorithm$ | async)?.id === Algorithm.passphrase"
-  [account]="account$ | async"
-  (onUpdated)="generate('passphrase settings')"
-/>
-<bit-section *ngIf="(category$ | async) !== 'password'">
-  <bit-section-header>
-    <h2 bitTypography="h6">{{ "options" | i18n }}</h2>
-  </bit-section-header>
-  <div class="tw-mb-4">
-    <bit-card>
-      <form [formGroup]="username" class="tw-container">
-        <bit-form-field>
-          <bit-label>{{ "type" | i18n }}</bit-label>
-          <bit-select
-            [items]="usernameOptions$ | async"
-            formControlName="nav"
-            data-testid="username-type"
-          >
-          </bit-select>
-          <bit-hint *ngIf="!!(credentialTypeHint$ | async)">{{
-            credentialTypeHint$ | async
-          }}</bit-hint>
-        </bit-form-field>
-      </form>
-      <form *ngIf="showForwarder$ | async" [formGroup]="forwarder" class="tw-container">
-        <bit-form-field>
-          <bit-label>{{ "service" | i18n }}</bit-label>
-          <bit-select
-            [items]="forwarderOptions$ | async"
-            formControlName="nav"
-            data-testid="email-forwarding-service"
-          >
-          </bit-select>
-        </bit-form-field>
-      </form>
-      <tools-catchall-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.catchall"
-        [account]="account$ | async"
-        (onUpdated)="generate('catchall settings')"
-      />
-      <tools-forwarder-settings
-        *ngIf="!!(forwarderId$ | async)"
-        [account]="account$ | async"
-        [forwarder]="forwarderId$ | async"
-      />
-      <tools-subaddress-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.plusAddress"
-        [account]="account$ | async"
-        (onUpdated)="generate('subaddress settings')"
-      />
-      <tools-username-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.username"
-        [account]="account$ | async"
-        (onUpdated)="generate('username settings')"
-      />
-    </bit-card>
-  </div>
-</bit-section>
+@let showAlgorithm = showAlgorithm$ | async;
+@let account = account$ | async;
+@switch (showAlgorithm?.id) {
+  @case (Algorithm.password) {
+    <tools-password-settings
+      class="tw-mt-6"
+      [account]="account"
+      (onUpdated)="generate('password settings')"
+    />
+  }
+  @case (Algorithm.passphrase) {
+    <tools-passphrase-settings
+      class="tw-mt-6"
+      [account]="account"
+      (onUpdated)="generate('passphrase settings')"
+    />
+  }
+}
+@if ((category$ | async) !== "password") {
+  <bit-section>
+    <bit-section-header>
+      <h2 bitTypography="h6">{{ "options" | i18n }}</h2>
+    </bit-section-header>
+    <div class="tw-mb-4">
+      <bit-card>
+        <form [formGroup]="username" class="tw-container">
+          <bit-form-field>
+            <bit-label>{{ "type" | i18n }}</bit-label>
+            <bit-select
+              [items]="usernameOptions$ | async"
+              formControlName="nav"
+              data-testid="username-type"
+            >
+            </bit-select>
+            @if (credentialTypeHint$ | async) {
+              <bit-hint>{{ credentialTypeHint$ | async }}</bit-hint>
+            }
+          </bit-form-field>
+        </form>
+        @if (showForwarder$ | async) {
+          <form [formGroup]="forwarder" class="tw-container">
+            <bit-form-field>
+              <bit-label>{{ "service" | i18n }}</bit-label>
+              <bit-select
+                [items]="forwarderOptions$ | async"
+                formControlName="nav"
+                data-testid="email-forwarding-service"
+              >
+              </bit-select>
+            </bit-form-field>
+          </form>
+        }
+        @if (showAlgorithm?.id === Algorithm.catchall) {
+          <tools-catchall-settings
+            [account]="account"
+            (onUpdated)="generate('catchall settings')"
+          />
+        }
+        @if (forwarderId$ | async; as forwarderId) {
+          <tools-forwarder-settings [account]="account" [forwarder]="forwarderId" />
+        }
+        @if (showAlgorithm?.id === Algorithm.plusAddress) {
+          <tools-subaddress-settings
+            [account]="account"
+            (onUpdated)="generate('subaddress settings')"
+          />
+        }
+        @if (showAlgorithm?.id === Algorithm.username) {
+          <tools-username-settings
+            [account]="account"
+            (onUpdated)="generate('username settings')"
+          />
+        }
+      </bit-card>
+    </div>
+  </bit-section>
+}
diff --git a/libs/tools/generator/components/src/credential-generator.component.ts b/libs/tools/generator/components/src/credential-generator.component.ts
index f48180d93bd..af6791f673b 100644
--- a/libs/tools/generator/components/src/credential-generator.component.ts
+++ b/libs/tools/generator/components/src/credential-generator.component.ts
@@ -1,4 +1,5 @@
 import { LiveAnnouncer } from "@angular/cdk/a11y";
+import { AsyncPipe } from "@angular/common";
 import {
   Component,
   EventEmitter,
@@ -10,7 +11,7 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import {
   BehaviorSubject,
   catchError,
@@ -27,6 +28,7 @@ import {
   withLatestFrom,
 } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account, AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -37,7 +39,23 @@ import {
   ifEnabledSemanticLoggerProvider,
 } from "@bitwarden/common/tools/log";
 import { UserId } from "@bitwarden/common/types/guid";
-import { ToastService, Option } from "@bitwarden/components";
+import {
+  ToastService,
+  Option,
+  BaseCardDirective,
+  CardComponent,
+  ColorPasswordComponent,
+  AriaDisableDirective,
+  TooltipDirective,
+  BitIconButtonComponent,
+  CopyClickDirective,
+  SectionComponent,
+  SectionHeaderComponent,
+  ToggleGroupModule,
+  TypographyModule,
+  FormFieldModule,
+  SelectModule,
+} from "@bitwarden/components";
 import {
   CredentialType,
   CredentialGeneratorService,
@@ -55,7 +73,15 @@ import {
   Type,
 } from "@bitwarden/generator-core";
 import { GeneratorHistoryService } from "@bitwarden/generator-history";
+import { I18nPipe } from "@bitwarden/ui-common";
 
+import { CatchallSettingsComponent } from "./catchall-settings.component";
+import { ForwarderSettingsComponent } from "./forwarder-settings.component";
+import { NudgeGeneratorSpotlightComponent } from "./nudge-generator-spotlight.component";
+import { PassphraseSettingsComponent } from "./passphrase-settings.component";
+import { PasswordSettingsComponent } from "./password-settings.component";
+import { SubaddressSettingsComponent } from "./subaddress-settings.component";
+import { UsernameSettingsComponent } from "./username-settings.component";
 import { translate } from "./util";
 
 // constants used to identify navigation selections that are not
@@ -69,7 +95,32 @@ const NONE_SELECTED = "none";
 @Component({
   selector: "tools-credential-generator",
   templateUrl: "credential-generator.component.html",
-  standalone: false,
+  imports: [
+    ToggleGroupModule,
+    NudgeGeneratorSpotlightComponent,
+    BaseCardDirective,
+    CardComponent,
+    ColorPasswordComponent,
+    AriaDisableDirective,
+    TooltipDirective,
+    BitIconButtonComponent,
+    CopyClickDirective,
+    PasswordSettingsComponent,
+    PassphraseSettingsComponent,
+    SectionComponent,
+    SectionHeaderComponent,
+    TypographyModule,
+    ReactiveFormsModule,
+    FormFieldModule,
+    SelectModule,
+    CatchallSettingsComponent,
+    ForwarderSettingsComponent,
+    SubaddressSettingsComponent,
+    UsernameSettingsComponent,
+    AsyncPipe,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class CredentialGeneratorComponent implements OnInit, OnChanges, OnDestroy {
   private readonly destroyed = new Subject<void>();
diff --git a/libs/tools/generator/components/src/forwarder-settings.component.html b/libs/tools/generator/components/src/forwarder-settings.component.html
index 8ad6eab1acf..0d213179c2b 100644
--- a/libs/tools/generator/components/src/forwarder-settings.component.html
+++ b/libs/tools/generator/components/src/forwarder-settings.component.html
@@ -1,28 +1,34 @@
 <form [formGroup]="settings" class="tw-container">
-  <bit-form-field *ngIf="displayDomain">
-    <bit-label>{{ "forwarderDomainName" | i18n }}</bit-label>
-    <input
-      bitInput
-      formControlName="domain"
-      type="text"
-      placeholder="example.com"
-      (change)="save('domain')"
-    />
-    <bit-hint>{{ "forwarderDomainNameHint" | i18n }}</bit-hint>
-  </bit-form-field>
-  <bit-form-field *ngIf="displayToken">
-    <bit-label>{{ "apiKey" | i18n }}</bit-label>
-    <input bitInput formControlName="token" type="password" (change)="save('password')" />
-    <button
-      type="button"
-      bitIconButton
-      bitSuffix
-      bitPasswordInputToggle
-      (change)="save('token')"
-    ></button>
-  </bit-form-field>
-  <bit-form-field *ngIf="displayBaseUrl" disableMargin>
-    <bit-label>{{ "selfHostBaseUrl" | i18n }}</bit-label>
-    <input bitInput formControlName="baseUrl" type="text" (change)="save('baseUrl')" />
-  </bit-form-field>
+  @if (displayDomain) {
+    <bit-form-field>
+      <bit-label>{{ "forwarderDomainName" | i18n }}</bit-label>
+      <input
+        bitInput
+        formControlName="domain"
+        type="text"
+        placeholder="example.com"
+        (change)="save('domain')"
+      />
+      <bit-hint>{{ "forwarderDomainNameHint" | i18n }}</bit-hint>
+    </bit-form-field>
+  }
+  @if (displayToken) {
+    <bit-form-field>
+      <bit-label>{{ "apiKey" | i18n }}</bit-label>
+      <input bitInput formControlName="token" type="password" (change)="save('password')" />
+      <button
+        type="button"
+        bitIconButton
+        bitSuffix
+        bitPasswordInputToggle
+        (change)="save('token')"
+      ></button>
+    </bit-form-field>
+  }
+  @if (displayBaseUrl) {
+    <bit-form-field disableMargin>
+      <bit-label>{{ "selfHostBaseUrl" | i18n }}</bit-label>
+      <input bitInput formControlName="baseUrl" type="text" (change)="save('baseUrl')" />
+    </bit-form-field>
+  }
 </form>
diff --git a/libs/tools/generator/components/src/forwarder-settings.component.ts b/libs/tools/generator/components/src/forwarder-settings.component.ts
index 32fa3effdf6..0f1c863b2f6 100644
--- a/libs/tools/generator/components/src/forwarder-settings.component.ts
+++ b/libs/tools/generator/components/src/forwarder-settings.component.ts
@@ -8,16 +8,24 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { map, ReplaySubject, skip, Subject, switchAll, takeUntil, withLatestFrom } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
 import { VendorId } from "@bitwarden/common/tools/extension";
+import {
+  FormFieldModule,
+  AriaDisableDirective,
+  TooltipDirective,
+  BitIconButtonComponent,
+} from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   ForwarderOptions,
   GeneratorMetadata,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 const Controls = Object.freeze({
   domain: "domain",
@@ -31,7 +39,15 @@ const Controls = Object.freeze({
 @Component({
   selector: "tools-forwarder-settings",
   templateUrl: "forwarder-settings.component.html",
-  standalone: false,
+  imports: [
+    ReactiveFormsModule,
+    FormFieldModule,
+    AriaDisableDirective,
+    TooltipDirective,
+    BitIconButtonComponent,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class ForwarderSettingsComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the component
diff --git a/libs/tools/generator/components/src/generator.module.ts b/libs/tools/generator/components/src/generator.module.ts
index d710f368106..795a5ffe972 100644
--- a/libs/tools/generator/components/src/generator.module.ts
+++ b/libs/tools/generator/components/src/generator.module.ts
@@ -1,67 +1,13 @@
-import { CommonModule } from "@angular/common";
 import { NgModule } from "@angular/core";
-import { ReactiveFormsModule } from "@angular/forms";
 
-import { JslibModule } from "@bitwarden/angular/jslib.module";
-import {
-  CardComponent,
-  ColorPasswordModule,
-  CheckboxModule,
-  FormFieldModule,
-  IconButtonModule,
-  InputModule,
-  ItemModule,
-  SectionComponent,
-  SectionHeaderComponent,
-  SelectModule,
-  ToggleGroupModule,
-  TypographyModule,
-} from "@bitwarden/components";
-
-import { CatchallSettingsComponent } from "./catchall-settings.component";
 import { CredentialGeneratorComponent } from "./credential-generator.component";
-import { ForwarderSettingsComponent } from "./forwarder-settings.component";
-import { GeneratorServicesModule } from "./generator-services.module";
-import { NudgeGeneratorSpotlightComponent } from "./nudge-generator-spotlight.component";
-import { PassphraseSettingsComponent } from "./passphrase-settings.component";
 import { PasswordGeneratorComponent } from "./password-generator.component";
-import { PasswordSettingsComponent } from "./password-settings.component";
-import { SubaddressSettingsComponent } from "./subaddress-settings.component";
 import { UsernameGeneratorComponent } from "./username-generator.component";
-import { UsernameSettingsComponent } from "./username-settings.component";
 
 /** Shared module containing generator component dependencies */
+/** @deprecated Use individual components instead. */
 @NgModule({
-  imports: [
-    CardComponent,
-    ColorPasswordModule,
-    CheckboxModule,
-    CommonModule,
-    FormFieldModule,
-    GeneratorServicesModule,
-    IconButtonModule,
-    InputModule,
-    ItemModule,
-    JslibModule,
-    ReactiveFormsModule,
-    SectionComponent,
-    SectionHeaderComponent,
-    SelectModule,
-    ToggleGroupModule,
-    TypographyModule,
-    NudgeGeneratorSpotlightComponent,
-  ],
-  declarations: [
-    CatchallSettingsComponent,
-    CredentialGeneratorComponent,
-    ForwarderSettingsComponent,
-    SubaddressSettingsComponent,
-    PasswordGeneratorComponent,
-    PassphraseSettingsComponent,
-    PasswordSettingsComponent,
-    UsernameGeneratorComponent,
-    UsernameSettingsComponent,
-  ],
+  imports: [CredentialGeneratorComponent, PasswordGeneratorComponent, UsernameGeneratorComponent],
   exports: [CredentialGeneratorComponent, PasswordGeneratorComponent, UsernameGeneratorComponent],
 })
 export class GeneratorModule {
diff --git a/libs/tools/generator/components/src/index.ts b/libs/tools/generator/components/src/index.ts
index 4ec32032de0..bfb19b07b05 100644
--- a/libs/tools/generator/components/src/index.ts
+++ b/libs/tools/generator/components/src/index.ts
@@ -1,5 +1,15 @@
+/**
+ * This file contains the public interface for the generator components library.
+ *
+ * Be mindful of what you export here, as those components should be considered stable
+ * and part of the public API contract.
+ */
+
+export { CredentialGeneratorComponent } from "./credential-generator.component";
 export { CredentialGeneratorHistoryComponent } from "./credential-generator-history.component";
 export { CredentialGeneratorHistoryDialogComponent } from "./credential-generator-history-dialog.component";
 export { EmptyCredentialHistoryComponent } from "./empty-credential-history.component";
 export { GeneratorModule } from "./generator.module";
 export { GeneratorServicesModule, SYSTEM_SERVICE_PROVIDER } from "./generator-services.module";
+export { PasswordGeneratorComponent } from "./password-generator.component";
+export { UsernameGeneratorComponent } from "./username-generator.component";
diff --git a/libs/tools/generator/components/src/nudge-generator-spotlight.component.html b/libs/tools/generator/components/src/nudge-generator-spotlight.component.html
index 581825936be..74fa5eb484c 100644
--- a/libs/tools/generator/components/src/nudge-generator-spotlight.component.html
+++ b/libs/tools/generator/components/src/nudge-generator-spotlight.component.html
@@ -1,16 +1,18 @@
-<div class="tw-mb-4" *ngIf="showGeneratorSpotlight$ | async">
-  <bit-spotlight
-    [title]="'generatorNudgeTitle' | i18n"
-    (onDismiss)="dismissGeneratorSpotlight(NudgeType.GeneratorNudgeStatus)"
-  >
-    <p class="tw-text-main tw-mb-0" bitTypography="body2">
-      <span class="tw-sr-only">
-        {{ "generatorNudgeBodyAria" | i18n }}
-      </span>
-      <span aria-hidden="true">
-        {{ "generatorNudgeBodyOne" | i18n }} <i class="bwi bwi-generate"></i>
-        {{ "generatorNudgeBodyTwo" | i18n }}
-      </span>
-    </p>
-  </bit-spotlight>
-</div>
+@if (showGeneratorSpotlight$ | async) {
+  <div class="tw-mb-4">
+    <bit-spotlight
+      [title]="'generatorNudgeTitle' | i18n"
+      (onDismiss)="dismissGeneratorSpotlight(NudgeType.GeneratorNudgeStatus)"
+    >
+      <p class="tw-text-main tw-mb-0" bitTypography="body2">
+        <span class="tw-sr-only">
+          {{ "generatorNudgeBodyAria" | i18n }}
+        </span>
+        <span aria-hidden="true">
+          {{ "generatorNudgeBodyOne" | i18n }} <i class="bwi bwi-generate"></i>
+          {{ "generatorNudgeBodyTwo" | i18n }}
+        </span>
+      </p>
+    </bit-spotlight>
+  </div>
+}
diff --git a/libs/tools/generator/components/src/passphrase-settings.component.html b/libs/tools/generator/components/src/passphrase-settings.component.html
index 0af27f7fdcb..d40e91f7013 100644
--- a/libs/tools/generator/components/src/passphrase-settings.component.html
+++ b/libs/tools/generator/components/src/passphrase-settings.component.html
@@ -1,7 +1,9 @@
 <bit-section [disableMargin]="disableMargin">
-  <bit-section-header *ngIf="showHeader">
-    <h6 bitTypography="h6">{{ "options" | i18n }}</h6>
-  </bit-section-header>
+  @if (showHeader) {
+    <bit-section-header>
+      <h6 bitTypography="h6">{{ "options" | i18n }}</h6>
+    </bit-section-header>
+  }
   <form [formGroup]="settings" class="tw-container">
     <div class="tw-mb-4">
       <bit-card>
@@ -51,7 +53,9 @@
           />
           <bit-label>{{ "includeNumber" | i18n }}</bit-label>
         </bit-form-control>
-        <p *ngIf="policyInEffect" bitTypography="helper">{{ "generatorPolicyInEffect" | i18n }}</p>
+        @if (policyInEffect) {
+          <p bitTypography="helper">{{ "generatorPolicyInEffect" | i18n }}</p>
+        }
       </bit-card>
     </div>
   </form>
diff --git a/libs/tools/generator/components/src/passphrase-settings.component.ts b/libs/tools/generator/components/src/passphrase-settings.component.ts
index 7e4ae8b5af9..6ab3020c688 100644
--- a/libs/tools/generator/components/src/passphrase-settings.component.ts
+++ b/libs/tools/generator/components/src/passphrase-settings.component.ts
@@ -1,4 +1,5 @@
 import { coerceBooleanProperty } from "@angular/cdk/coercion";
+import { AsyncPipe } from "@angular/common";
 import {
   OnInit,
   Input,
@@ -9,9 +10,10 @@ import {
   SimpleChanges,
   OnChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { skip, takeUntil, Subject, map, withLatestFrom, ReplaySubject, tap } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -20,11 +22,21 @@ import {
   disabledSemanticLoggerProvider,
   ifEnabledSemanticLoggerProvider,
 } from "@bitwarden/common/tools/log";
+import {
+  SectionComponent,
+  SectionHeaderComponent,
+  BaseCardDirective,
+  CardComponent,
+  TypographyModule,
+  FormFieldModule,
+  CheckboxModule,
+} from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   PassphraseGenerationOptions,
   BuiltIn,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 const Controls = Object.freeze({
   numWords: "numWords",
@@ -39,7 +51,19 @@ const Controls = Object.freeze({
 @Component({
   selector: "tools-passphrase-settings",
   templateUrl: "passphrase-settings.component.html",
-  standalone: false,
+  imports: [
+    SectionComponent,
+    SectionHeaderComponent,
+    TypographyModule,
+    ReactiveFormsModule,
+    BaseCardDirective,
+    CardComponent,
+    FormFieldModule,
+    CheckboxModule,
+    AsyncPipe,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class PassphraseSettingsComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the component
diff --git a/libs/tools/generator/components/src/password-generator.component.html b/libs/tools/generator/components/src/password-generator.component.html
index 9995613685b..0088628dff0 100644
--- a/libs/tools/generator/components/src/password-generator.component.html
+++ b/libs/tools/generator/components/src/password-generator.component.html
@@ -1,15 +1,18 @@
-<bit-toggle-group
-  fullWidth
-  class="tw-mb-4"
-  [selected]="credentialType$ | async"
-  (selectedChange)="onCredentialTypeChanged($event)"
-  *ngIf="showCredentialTypes$ | async"
-  attr.aria-label="{{ 'type' | i18n }}"
->
-  <bit-toggle *ngFor="let option of passwordOptions$ | async" [value]="option.value">
-    {{ option.label }}
-  </bit-toggle>
-</bit-toggle-group>
+@if (showCredentialTypes$ | async) {
+  <bit-toggle-group
+    fullWidth
+    class="tw-mb-4"
+    [selected]="credentialType$ | async"
+    (selectedChange)="onCredentialTypeChanged($event)"
+    attr.aria-label="{{ 'type' | i18n }}"
+  >
+    @for (option of passwordOptions$ | async; track option) {
+      <bit-toggle [value]="option.value">
+        {{ option.label }}
+      </bit-toggle>
+    }
+  </bit-toggle-group>
+}
 <bit-card class="tw-flex tw-justify-between tw-mb-4">
   <div class="tw-grow tw-flex tw-items-center tw-min-w-0">
     <bit-color-password class="tw-font-mono" [password]="value$ | async"></bit-color-password>
@@ -37,17 +40,19 @@
     ></button>
   </div>
 </bit-card>
-<tools-password-settings
-  class="tw-mt-6"
-  *ngIf="(algorithm$ | async)?.id === Algorithm.password"
-  [account]="account$ | async"
-  [disableMargin]="disableMargin"
-  (onUpdated)="generate('password settings')"
-/>
-<tools-passphrase-settings
-  class="tw-mt-6"
-  *ngIf="(algorithm$ | async)?.id === Algorithm.passphrase"
-  [account]="account$ | async"
-  (onUpdated)="generate('passphrase settings')"
-  [disableMargin]="disableMargin"
-/>
+@if ((algorithm$ | async)?.id === Algorithm.password) {
+  <tools-password-settings
+    class="tw-mt-6"
+    [account]="account$ | async"
+    [disableMargin]="disableMargin"
+    (onUpdated)="generate('password settings')"
+  />
+}
+@if ((algorithm$ | async)?.id === Algorithm.passphrase) {
+  <tools-passphrase-settings
+    class="tw-mt-6"
+    [account]="account$ | async"
+    (onUpdated)="generate('passphrase settings')"
+    [disableMargin]="disableMargin"
+  />
+}
diff --git a/libs/tools/generator/components/src/password-generator.component.ts b/libs/tools/generator/components/src/password-generator.component.ts
index 2b1d5044651..52cf902293d 100644
--- a/libs/tools/generator/components/src/password-generator.component.ts
+++ b/libs/tools/generator/components/src/password-generator.component.ts
@@ -1,5 +1,6 @@
 import { LiveAnnouncer } from "@angular/cdk/a11y";
 import { coerceBooleanProperty } from "@angular/cdk/coercion";
+import { AsyncPipe } from "@angular/common";
 import {
   Component,
   EventEmitter,
@@ -24,6 +25,7 @@ import {
   withLatestFrom,
 } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account, AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -33,7 +35,18 @@ import {
   ifEnabledSemanticLoggerProvider,
 } from "@bitwarden/common/tools/log";
 import { UserId } from "@bitwarden/common/types/guid";
-import { ToastService, Option } from "@bitwarden/components";
+import {
+  ToastService,
+  Option,
+  BaseCardDirective,
+  CardComponent,
+  ColorPasswordComponent,
+  AriaDisableDirective,
+  TooltipDirective,
+  BitIconButtonComponent,
+  CopyClickDirective,
+  ToggleGroupModule,
+} from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   GeneratedCredential,
@@ -49,7 +62,10 @@ import {
   Profile,
 } from "@bitwarden/generator-core";
 import { GeneratorHistoryService } from "@bitwarden/generator-history";
+import { I18nPipe } from "@bitwarden/ui-common";
 
+import { PassphraseSettingsComponent } from "./passphrase-settings.component";
+import { PasswordSettingsComponent } from "./password-settings.component";
 import { toAlgorithmInfo, translate } from "./util";
 
 /** Options group for passwords */
@@ -58,7 +74,21 @@ import { toAlgorithmInfo, translate } from "./util";
 @Component({
   selector: "tools-password-generator",
   templateUrl: "password-generator.component.html",
-  standalone: false,
+  imports: [
+    ToggleGroupModule,
+    BaseCardDirective,
+    CardComponent,
+    ColorPasswordComponent,
+    AriaDisableDirective,
+    TooltipDirective,
+    BitIconButtonComponent,
+    CopyClickDirective,
+    PasswordSettingsComponent,
+    PassphraseSettingsComponent,
+    AsyncPipe,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class PasswordGeneratorComponent implements OnInit, OnChanges, OnDestroy {
   constructor(
diff --git a/libs/tools/generator/components/src/password-settings.component.html b/libs/tools/generator/components/src/password-settings.component.html
index 13bf6822462..b435a13fe4c 100644
--- a/libs/tools/generator/components/src/password-settings.component.html
+++ b/libs/tools/generator/components/src/password-settings.component.html
@@ -1,7 +1,9 @@
 <bit-section [disableMargin]="disableMargin">
-  <bit-section-header *ngIf="showHeader">
-    <h2 bitTypography="h6">{{ "options" | i18n }}</h2>
-  </bit-section-header>
+  @if (showHeader) {
+    <bit-section-header>
+      <h2 bitTypography="h6">{{ "options" | i18n }}</h2>
+    </bit-section-header>
+  }
   <form [formGroup]="settings" class="tw-container">
     <div class="tw-mb-4">
       <bit-card>
@@ -62,9 +64,9 @@
               (change)="save('special')"
             />
             <!-- hard-coded the special characters string because `$` indicates an i18n interpolation,
-                and is handled inconsistently across browsers. Angular template syntax is used to
-                ensure special characters are entity-encoded.
-              -->
+            and is handled inconsistently across browsers. Angular template syntax is used to
+            ensure special characters are entity-encoded.
+            -->
             <bit-label>{{ "!@#$%^&*" }}</bit-label>
           </bit-form-control>
         </div>
@@ -97,7 +99,9 @@
           />
           <bit-label>{{ "avoidAmbiguous" | i18n }}</bit-label>
         </bit-form-control>
-        <p *ngIf="policyInEffect" bitTypography="helper">{{ "generatorPolicyInEffect" | i18n }}</p>
+        @if (policyInEffect) {
+          <p bitTypography="helper">{{ "generatorPolicyInEffect" | i18n }}</p>
+        }
       </bit-card>
     </div>
   </form>
diff --git a/libs/tools/generator/components/src/password-settings.component.ts b/libs/tools/generator/components/src/password-settings.component.ts
index 5d5980edf1b..9445e655310 100644
--- a/libs/tools/generator/components/src/password-settings.component.ts
+++ b/libs/tools/generator/components/src/password-settings.component.ts
@@ -1,4 +1,5 @@
 import { coerceBooleanProperty } from "@angular/cdk/coercion";
+import { AsyncPipe } from "@angular/common";
 import {
   OnInit,
   Input,
@@ -9,16 +10,27 @@ import {
   SimpleChanges,
   OnChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { takeUntil, Subject, map, filter, tap, skip, ReplaySubject, withLatestFrom } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import {
+  SectionComponent,
+  SectionHeaderComponent,
+  BaseCardDirective,
+  CardComponent,
+  FormFieldModule,
+  TypographyModule,
+  CheckboxModule,
+} from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   PasswordGenerationOptions,
   BuiltIn,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 import { hasRangeOfValues } from "./util";
 
@@ -39,7 +51,19 @@ const Controls = Object.freeze({
 @Component({
   selector: "tools-password-settings",
   templateUrl: "password-settings.component.html",
-  standalone: false,
+  imports: [
+    SectionComponent,
+    SectionHeaderComponent,
+    TypographyModule,
+    ReactiveFormsModule,
+    BaseCardDirective,
+    CardComponent,
+    FormFieldModule,
+    CheckboxModule,
+    AsyncPipe,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class PasswordSettingsComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the component
diff --git a/libs/tools/generator/components/src/subaddress-settings.component.ts b/libs/tools/generator/components/src/subaddress-settings.component.ts
index f9cef2341ba..068511e29e5 100644
--- a/libs/tools/generator/components/src/subaddress-settings.component.ts
+++ b/libs/tools/generator/components/src/subaddress-settings.component.ts
@@ -8,15 +8,18 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { map, ReplaySubject, skip, Subject, takeUntil, withLatestFrom } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
+import { FormFieldModule } from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   BuiltIn,
   SubaddressGenerationOptions,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 /** Options group for plus-addressed emails */
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
@@ -24,7 +27,7 @@ import {
 @Component({
   selector: "tools-subaddress-settings",
   templateUrl: "subaddress-settings.component.html",
-  standalone: false,
+  imports: [ReactiveFormsModule, FormFieldModule, JslibModule, I18nPipe],
 })
 export class SubaddressSettingsComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the component
diff --git a/libs/tools/generator/components/src/username-generator.component.html b/libs/tools/generator/components/src/username-generator.component.html
index 0f3182118a1..9f74f5d1fea 100644
--- a/libs/tools/generator/components/src/username-generator.component.html
+++ b/libs/tools/generator/components/src/username-generator.component.html
@@ -42,42 +42,41 @@
             data-testid="username-type"
           >
           </bit-select>
-          <bit-hint *ngIf="!!(credentialTypeHint$ | async)">{{
-            credentialTypeHint$ | async
-          }}</bit-hint>
+          @if (credentialTypeHint$ | async) {
+            <bit-hint>{{ credentialTypeHint$ | async }}</bit-hint>
+          }
         </bit-form-field>
       </form>
-      <form *ngIf="showForwarder$ | async" [formGroup]="forwarder" class="tw-container">
-        <bit-form-field>
-          <bit-label>{{ "service" | i18n }}</bit-label>
-          <bit-select
-            [items]="forwarderOptions$ | async"
-            formControlName="nav"
-            data-testid="email-forwarding-service"
-          >
-          </bit-select>
-        </bit-form-field>
-      </form>
-      <tools-catchall-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.catchall"
-        [account]="account$ | async"
-        (onUpdated)="generate('catchall settings')"
-      />
-      <tools-forwarder-settings
-        *ngIf="!!(forwarderId$ | async)"
-        [forwarder]="forwarderId$ | async"
-        [account]="account$ | async"
-      />
-      <tools-subaddress-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.plusAddress"
-        [account]="account$ | async"
-        (onUpdated)="generate('subaddress settings')"
-      />
-      <tools-username-settings
-        *ngIf="(showAlgorithm$ | async)?.id === Algorithm.username"
-        [account]="account$ | async"
-        (onUpdated)="generate('username settings')"
-      />
+      @if (showForwarder$ | async) {
+        <form [formGroup]="forwarder" class="tw-container">
+          <bit-form-field>
+            <bit-label>{{ "service" | i18n }}</bit-label>
+            <bit-select
+              [items]="forwarderOptions$ | async"
+              formControlName="nav"
+              data-testid="email-forwarding-service"
+            >
+            </bit-select>
+          </bit-form-field>
+        </form>
+      }
+      @let showAlgorithm = showAlgorithm$ | async;
+      @let account = account$ | async;
+      @if (showAlgorithm?.id === Algorithm.catchall) {
+        <tools-catchall-settings [account]="account" (onUpdated)="generate('catchall settings')" />
+      }
+      @if (forwarderId$ | async; as forwarderId) {
+        <tools-forwarder-settings [forwarder]="forwarderId" [account]="account" />
+      }
+      @if (showAlgorithm?.id === Algorithm.plusAddress) {
+        <tools-subaddress-settings
+          [account]="account"
+          (onUpdated)="generate('subaddress settings')"
+        />
+      }
+      @if (showAlgorithm?.id === Algorithm.username) {
+        <tools-username-settings [account]="account" (onUpdated)="generate('username settings')" />
+      }
     </bit-card>
   </div>
 </bit-section>
diff --git a/libs/tools/generator/components/src/username-generator.component.ts b/libs/tools/generator/components/src/username-generator.component.ts
index dc4b8d26e7e..faf9c4dde2c 100644
--- a/libs/tools/generator/components/src/username-generator.component.ts
+++ b/libs/tools/generator/components/src/username-generator.component.ts
@@ -1,5 +1,6 @@
 import { LiveAnnouncer } from "@angular/cdk/a11y";
 import { coerceBooleanProperty } from "@angular/cdk/coercion";
+import { NgClass, AsyncPipe } from "@angular/common";
 import {
   Component,
   EventEmitter,
@@ -11,7 +12,7 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import {
   BehaviorSubject,
   catchError,
@@ -28,6 +29,7 @@ import {
   withLatestFrom,
 } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account, AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -38,7 +40,22 @@ import {
   ifEnabledSemanticLoggerProvider,
 } from "@bitwarden/common/tools/log";
 import { UserId } from "@bitwarden/common/types/guid";
-import { ToastService, Option } from "@bitwarden/components";
+import {
+  ToastService,
+  Option,
+  AriaDisableDirective,
+  BaseCardDirective,
+  CardComponent,
+  ColorPasswordComponent,
+  CopyClickDirective,
+  BitIconButtonComponent,
+  TooltipDirective,
+  SectionComponent,
+  SectionHeaderComponent,
+  SelectComponent,
+  TypographyModule,
+  FormFieldModule,
+} from "@bitwarden/components";
 import {
   AlgorithmInfo,
   CredentialGeneratorService,
@@ -55,7 +72,12 @@ import {
   Algorithm,
 } from "@bitwarden/generator-core";
 import { GeneratorHistoryService } from "@bitwarden/generator-history";
+import { I18nPipe } from "@bitwarden/ui-common";
 
+import { CatchallSettingsComponent } from "./catchall-settings.component";
+import { ForwarderSettingsComponent } from "./forwarder-settings.component";
+import { SubaddressSettingsComponent } from "./subaddress-settings.component";
+import { UsernameSettingsComponent } from "./username-settings.component";
 import { toAlgorithmInfo, translate } from "./util";
 
 // constants used to identify navigation selections that are not
@@ -69,7 +91,29 @@ const NONE_SELECTED = "none";
 @Component({
   selector: "tools-username-generator",
   templateUrl: "username-generator.component.html",
-  standalone: false,
+  imports: [
+    BaseCardDirective,
+    CardComponent,
+    ColorPasswordComponent,
+    AriaDisableDirective,
+    TooltipDirective,
+    BitIconButtonComponent,
+    CopyClickDirective,
+    SectionComponent,
+    SectionHeaderComponent,
+    TypographyModule,
+    NgClass,
+    ReactiveFormsModule,
+    SelectComponent,
+    FormFieldModule,
+    CatchallSettingsComponent,
+    ForwarderSettingsComponent,
+    SubaddressSettingsComponent,
+    UsernameSettingsComponent,
+    AsyncPipe,
+    JslibModule,
+    I18nPipe,
+  ],
 })
 export class UsernameGeneratorComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the username generator
diff --git a/libs/tools/generator/components/src/username-settings.component.ts b/libs/tools/generator/components/src/username-settings.component.ts
index fae1a3aca04..f4ccf362b69 100644
--- a/libs/tools/generator/components/src/username-settings.component.ts
+++ b/libs/tools/generator/components/src/username-settings.component.ts
@@ -8,15 +8,18 @@ import {
   Output,
   SimpleChanges,
 } from "@angular/core";
-import { FormBuilder } from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
 import { map, ReplaySubject, skip, Subject, takeUntil, withLatestFrom } from "rxjs";
 
+import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { Account } from "@bitwarden/common/auth/abstractions/account.service";
+import { FormFieldModule, CheckboxModule } from "@bitwarden/components";
 import {
   CredentialGeneratorService,
   EffUsernameGenerationOptions,
   BuiltIn,
 } from "@bitwarden/generator-core";
+import { I18nPipe } from "@bitwarden/ui-common";
 
 /** Options group for usernames */
 // FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
@@ -24,7 +27,7 @@ import {
 @Component({
   selector: "tools-username-settings",
   templateUrl: "username-settings.component.html",
-  standalone: false,
+  imports: [ReactiveFormsModule, FormFieldModule, CheckboxModule, JslibModule, I18nPipe],
 })
 export class UsernameSettingsComponent implements OnInit, OnChanges, OnDestroy {
   /** Instantiates the component
diff --git a/libs/tools/generator/core/src/policies/available-algorithms-policy.spec.ts b/libs/tools/generator/core/src/policies/available-algorithms-policy.spec.ts
index 5f699974fba..7de8c708dcf 100644
--- a/libs/tools/generator/core/src/policies/available-algorithms-policy.spec.ts
+++ b/libs/tools/generator/core/src/policies/available-algorithms-policy.spec.ts
@@ -24,6 +24,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         overridePasswordType: override,
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([policy]);
@@ -44,6 +45,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         overridePasswordType: override,
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([policy, policy]);
@@ -64,6 +66,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         overridePasswordType: "password",
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
     const passphrase = new Policy({
       id: "" as PolicyId,
@@ -73,6 +76,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         overridePasswordType: "passphrase",
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([password, passphrase]);
@@ -93,6 +97,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         some: "policy",
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([policy]);
@@ -111,6 +116,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         some: "policy",
       },
       enabled: false,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([policy]);
@@ -129,6 +135,7 @@ describe("availableAlgorithms_vNextPolicy", () => {
         some: "policy",
       },
       enabled: true,
+      revisionDate: new Date().toISOString(),
     });
 
     const result = availableAlgorithms([policy]);
diff --git a/libs/tools/generator/core/src/policies/passphrase-least-privilege.spec.ts b/libs/tools/generator/core/src/policies/passphrase-least-privilege.spec.ts
index 0fbc1796e9e..c6ce189f620 100644
--- a/libs/tools/generator/core/src/policies/passphrase-least-privilege.spec.ts
+++ b/libs/tools/generator/core/src/policies/passphrase-least-privilege.spec.ts
@@ -17,6 +17,7 @@ function createPolicy(
     data,
     enabled,
     type,
+    revisionDate: new Date().toISOString(),
   });
 }
 
diff --git a/libs/tools/generator/core/src/policies/password-least-privilege.spec.ts b/libs/tools/generator/core/src/policies/password-least-privilege.spec.ts
index 7f8dce19b15..7885641c8e5 100644
--- a/libs/tools/generator/core/src/policies/password-least-privilege.spec.ts
+++ b/libs/tools/generator/core/src/policies/password-least-privilege.spec.ts
@@ -17,6 +17,7 @@ function createPolicy(
     data,
     enabled,
     type,
+    revisionDate: new Date().toISOString(),
   });
 }
 
diff --git a/libs/tools/generator/core/src/providers/generator-profile-provider.spec.ts b/libs/tools/generator/core/src/providers/generator-profile-provider.spec.ts
index 32d99aa8a1f..924849b1c22 100644
--- a/libs/tools/generator/core/src/providers/generator-profile-provider.spec.ts
+++ b/libs/tools/generator/core/src/providers/generator-profile-provider.spec.ts
@@ -57,6 +57,7 @@ const somePolicy = new Policy({
   id: "" as PolicyId,
   organizationId: "" as OrganizationId,
   enabled: true,
+  revisionDate: new Date().toISOString(),
 });
 
 const stateProvider = new FakeStateProvider(accountService);
diff --git a/libs/tools/generator/extensions/navigation/src/default-generator-navigation.service.spec.ts b/libs/tools/generator/extensions/navigation/src/default-generator-navigation.service.spec.ts
index 65f1669ebd1..37e8ec6e379 100644
--- a/libs/tools/generator/extensions/navigation/src/default-generator-navigation.service.spec.ts
+++ b/libs/tools/generator/extensions/navigation/src/default-generator-navigation.service.spec.ts
@@ -70,6 +70,7 @@ describe("DefaultGeneratorNavigationService", () => {
               enabled: true,
               type: PolicyType.PasswordGenerator,
               data: { overridePasswordType: "password" },
+              revisionDate: new Date().toISOString(),
             }),
           ]);
         },
diff --git a/libs/tools/generator/extensions/navigation/src/generator-navigation-policy.spec.ts b/libs/tools/generator/extensions/navigation/src/generator-navigation-policy.spec.ts
index e4f0b08a3d5..69a4e75d47d 100644
--- a/libs/tools/generator/extensions/navigation/src/generator-navigation-policy.spec.ts
+++ b/libs/tools/generator/extensions/navigation/src/generator-navigation-policy.spec.ts
@@ -17,6 +17,7 @@ function createPolicy(
     data,
     enabled,
     type,
+    revisionDate: new Date().toISOString(),
   });
 }
 
diff --git a/libs/tools/send/send-ui/src/index.ts b/libs/tools/send/send-ui/src/index.ts
index 2803e91c418..ac8b9383681 100644
--- a/libs/tools/send/send-ui/src/index.ts
+++ b/libs/tools/send/send-ui/src/index.ts
@@ -6,3 +6,4 @@ export { SendItemsService } from "./services/send-items.service";
 export { SendSearchComponent } from "./send-search/send-search.component";
 export { SendListFiltersComponent } from "./send-list-filters/send-list-filters.component";
 export { SendListFiltersService } from "./services/send-list-filters.service";
+export { SendTableComponent } from "./send-table/send-table.component";
diff --git a/libs/tools/send/send-ui/src/new-send-dropdown/new-send-dropdown.component.html b/libs/tools/send/send-ui/src/new-send-dropdown/new-send-dropdown.component.html
index bcced7e012b..fb9b82c44e5 100644
--- a/libs/tools/send/send-ui/src/new-send-dropdown/new-send-dropdown.component.html
+++ b/libs/tools/send/send-ui/src/new-send-dropdown/new-send-dropdown.component.html
@@ -1,5 +1,5 @@
 <button bitButton [bitMenuTriggerFor]="itemOptions" [buttonType]="buttonType" type="button">
-  <i *ngIf="!hideIcon" class="bwi bwi-plus" aria-hidden="true"></i>
+  <i *ngIf="!hideIcon" class="bwi bwi-plus tw-me-2" aria-hidden="true"></i>
   {{ (hideIcon ? "createSend" : "new") | i18n }}
 </button>
 <bit-menu #itemOptions>
diff --git a/libs/tools/send/send-ui/src/send-form/components/send-details/send-file-details.component.html b/libs/tools/send/send-ui/src/send-form/components/send-details/send-file-details.component.html
index 60c78c7dece..1aee2bf91be 100644
--- a/libs/tools/send/send-ui/src/send-form/components/send-details/send-file-details.component.html
+++ b/libs/tools/send/send-ui/src/send-form/components/send-details/send-file-details.component.html
@@ -1,7 +1,9 @@
 <bit-section [formGroup]="sendFileDetailsForm">
   <div *ngIf="config().mode === 'edit'">
     <div bitTypography="body2" class="tw-text-muted">{{ "file" | i18n }}</div>
-    <div data-testid="file-name">{{ originalSendView().file.fileName }}</div>
+    <div class="tw-text-wrap tw-break-all" data-testid="file-name">
+      {{ originalSendView().file.fileName }}
+    </div>
     <div data-testid="file-size" class="tw-text-muted">{{ originalSendView().file.sizeName }}</div>
   </div>
   <bit-form-field *ngIf="config().mode !== 'edit'">
diff --git a/libs/tools/send/send-ui/src/send-table/send-table.component.html b/libs/tools/send/send-ui/src/send-table/send-table.component.html
new file mode 100644
index 00000000000..6b93b9d879e
--- /dev/null
+++ b/libs/tools/send/send-ui/src/send-table/send-table.component.html
@@ -0,0 +1,102 @@
+<bit-table [dataSource]="dataSource()">
+  <ng-container header>
+    <tr>
+      <th bitCell bitSortable="name" default>{{ "name" | i18n }}</th>
+      <th bitCell bitSortable="deletionDate">{{ "deletionDate" | i18n }}</th>
+      <th bitCell>{{ "options" | i18n }}</th>
+    </tr>
+  </ng-container>
+  <ng-template body let-rows$>
+    <tr bitRow *ngFor="let s of rows$ | async">
+      <td bitCell (click)="onEditSend(s)" class="tw-cursor-pointer">
+        <div class="tw-flex tw-gap-2 tw-items-center">
+          <span aria-hidden="true">
+            @if (s.type == sendType.File) {
+              <i class="bwi bwi-fw bwi-lg bwi-file"></i>
+            }
+            @if (s.type == sendType.Text) {
+              <i class="bwi bwi-fw bwi-lg bwi-file-text"></i>
+            }
+          </span>
+          <button type="button" bitLink>
+            {{ s.name }}
+          </button>
+          @if (s.disabled) {
+            <i
+              class="bwi bwi-exclamation-triangle"
+              appStopProp
+              title="{{ 'disabled' | i18n }}"
+              aria-hidden="true"
+            ></i>
+            <span class="tw-sr-only">{{ "disabled" | i18n }}</span>
+          }
+          @if (s.password) {
+            <i
+              class="bwi bwi-key"
+              appStopProp
+              title="{{ 'password' | i18n }}"
+              aria-hidden="true"
+            ></i>
+            <span class="tw-sr-only">{{ "password" | i18n }}</span>
+          }
+          @if (s.maxAccessCountReached) {
+            <i
+              class="bwi bwi-exclamation-triangle"
+              appStopProp
+              title="{{ 'maxAccessCountReached' | i18n }}"
+              aria-hidden="true"
+            ></i>
+            <span class="tw-sr-only">{{ "maxAccessCountReached" | i18n }}</span>
+          }
+          @if (s.expired) {
+            <i
+              class="bwi bwi-clock"
+              appStopProp
+              title="{{ 'expired' | i18n }}"
+              aria-hidden="true"
+            ></i>
+            <span class="tw-sr-only">{{ "expired" | i18n }}</span>
+          }
+          @if (s.pendingDelete) {
+            <i
+              class="bwi bwi-trash"
+              appStopProp
+              title="{{ 'pendingDeletion' | i18n }}"
+              aria-hidden="true"
+            ></i>
+            <span class="tw-sr-only">{{ "pendingDeletion" | i18n }}</span>
+          }
+        </div>
+      </td>
+      <td bitCell (click)="onEditSend(s)" class="tw-text-muted tw-cursor-pointer">
+        <small bitTypography="body2" appStopProp>{{ s.deletionDate | date: "medium" }}</small>
+      </td>
+      <td bitCell class="tw-w-0 tw-text-right">
+        <button
+          type="button"
+          [bitMenuTriggerFor]="sendOptions"
+          bitIconButton="bwi-ellipsis-v"
+          label="{{ 'options' | i18n }}"
+        ></button>
+        <bit-menu #sendOptions>
+          <button type="button" bitMenuItem (click)="onCopy(s)">
+            <i class="bwi bwi-fw bwi-clone" aria-hidden="true"></i>
+            {{ "copySendLink" | i18n }}
+          </button>
+          @if (s.password && !disableSend()) {
+            <button type="button" bitMenuItem (click)="onRemovePassword(s)">
+              <i class="bwi bwi-fw bwi-close" aria-hidden="true"></i>
+              {{ "removePassword" | i18n }}
+            </button>
+          }
+          <button type="button" bitMenuItem (click)="onDelete(s)">
+            <span class="tw-text-danger">
+              <i class="bwi bwi-fw bwi-trash" aria-hidden="true"></i>
+              {{ "delete" | i18n }}
+            </span>
+          </button>
+        </bit-menu>
+      </td>
+    </tr>
+  </ng-template>
+</bit-table>
diff --git a/libs/tools/send/send-ui/src/send-table/send-table.component.stories.ts b/libs/tools/send/send-ui/src/send-table/send-table.component.stories.ts
new file mode 100644
index 00000000000..d2d630b69a2
--- /dev/null
+++ b/libs/tools/send/send-ui/src/send-table/send-table.component.stories.ts
@@ -0,0 +1,100 @@
+import { Meta, StoryObj, moduleMetadata } from "@storybook/angular";
+
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { SendView } from "@bitwarden/common/tools/send/models/view/send.view";
+import { TableDataSource, I18nMockService } from "@bitwarden/components";
+
+import { SendTableComponent } from "./send-table.component";
+
+function createMockSend(id: number, overrides: Partial<SendView> = {}): SendView {
+  const send = new SendView();
+
+  send.id = `send-${id}`;
+  send.name = "My Send";
+  send.type = SendType.Text;
+  send.deletionDate = new Date("2030-01-01T12:00:00Z");
+  send.password = null as any;
+
+  Object.assign(send, overrides);
+
+  return send;
+}
+
+const dataSource = new TableDataSource<SendView>();
+dataSource.data = [
+  createMockSend(0, {
+    name: "Project Documentation",
+    type: SendType.Text,
+  }),
+  createMockSend(1, {
+    name: "Meeting Notes",
+    type: SendType.File,
+  }),
+  createMockSend(2, {
+    name: "Password Protected Send",
+    type: SendType.Text,
+    password: "123",
+  }),
+  createMockSend(3, {
+    name: "Disabled Send",
+    type: SendType.Text,
+    disabled: true,
+  }),
+  createMockSend(4, {
+    name: "Expired Send",
+    type: SendType.File,
+    expirationDate: new Date("2025-12-01T00:00:00Z"),
+  }),
+  createMockSend(5, {
+    name: "Max Access Reached",
+    type: SendType.Text,
+    maxAccessCount: 5,
+    accessCount: 5,
+    password: "123",
+  }),
+];
+
+export default {
+  title: "Tools/Sends/Send Table",
+  component: SendTableComponent,
+  decorators: [
+    moduleMetadata({
+      providers: [
+        {
+          provide: I18nService,
+          useFactory: () => {
+            return new I18nMockService({
+              name: "Name",
+              deletionDate: "Deletion Date",
+              options: "Options",
+              disabled: "Disabled",
+              password: "Password",
+              maxAccessCountReached: "Max access count reached",
+              expired: "Expired",
+              pendingDeletion: "Pending deletion",
+              copySendLink: "Copy Send link",
+              removePassword: "Remove password",
+              delete: "Delete",
+              loading: "Loading",
+            });
+          },
+        },
+      ],
+    }),
+  ],
+  args: {
+    dataSource,
+    disableSend: false,
+  },
+  argTypes: {
+    editSend: { action: "editSend" },
+    copySend: { action: "copySend" },
+    removePassword: { action: "removePassword" },
+    deleteSend: { action: "deleteSend" },
+  },
+} as Meta<SendTableComponent>;
+
+type Story = StoryObj<SendTableComponent>;
+
+export const Default: Story = {};
diff --git a/libs/tools/send/send-ui/src/send-table/send-table.component.ts b/libs/tools/send/send-ui/src/send-table/send-table.component.ts
new file mode 100644
index 00000000000..c912a01f98a
--- /dev/null
+++ b/libs/tools/send/send-ui/src/send-table/send-table.component.ts
@@ -0,0 +1,92 @@
+import { CommonModule } from "@angular/common";
+import { ChangeDetectionStrategy, Component, input, output } from "@angular/core";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { SendType } from "@bitwarden/common/tools/send/enums/send-type";
+import { SendView } from "@bitwarden/common/tools/send/models/view/send.view";
+import {
+  BadgeModule,
+  ButtonModule,
+  IconButtonModule,
+  LinkModule,
+  MenuModule,
+  TableDataSource,
+  TableModule,
+  TypographyModule,
+} from "@bitwarden/components";
+
+/**
+ * A table component for displaying Send items with sorting, status indicators, and action menus. Handles the presentation of sends in a tabular format with options
+ * for editing, copying links, removing passwords, and deleting.
+ */
+@Component({
+  selector: "tools-send-table",
+  templateUrl: "./send-table.component.html",
+  imports: [
+    CommonModule,
+    JslibModule,
+    TableModule,
+    ButtonModule,
+    LinkModule,
+    IconButtonModule,
+    MenuModule,
+    BadgeModule,
+    TypographyModule,
+  ],
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class SendTableComponent {
+  protected readonly sendType = SendType;
+
+  /**
+   * The data source containing the Send items to display in the table.
+   */
+  readonly dataSource = input<TableDataSource<SendView>>();
+
+  /**
+   * Whether Send functionality is disabled by policy.
+   * When true, the "Remove Password" option is hidden from the action menu.
+   */
+  readonly disableSend = input(false);
+
+  /**
+   * Emitted when a user clicks on a Send item to edit it.
+   * The clicked SendView is passed as the event payload.
+   */
+  readonly editSend = output<SendView>();
+
+  /**
+   * Emitted when a user clicks the "Copy Send Link" action.
+   * The SendView is passed as the event payload for generating and copying the link.
+   */
+  readonly copySend = output<SendView>();
+
+  /**
+   * Emitted when a user clicks the "Remove Password" action.
+   * The SendView is passed as the event payload for password removal.
+   * This action is only available if the Send has a password and Send is not disabled.
+   */
+  readonly removePassword = output<SendView>();
+
+  /**
+   * Emitted when a user clicks the "Delete" action.
+   * The SendView is passed as the event payload for deletion.
+   */
+  readonly deleteSend = output<SendView>();
+
+  protected onEditSend(send: SendView): void {
+    this.editSend.emit(send);
+  }
+
+  protected onCopy(send: SendView): void {
+    this.copySend.emit(send);
+  }
+
+  protected onRemovePassword(send: SendView): void {
+    this.removePassword.emit(send);
+  }
+
+  protected onDelete(send: SendView): void {
+    this.deleteSend.emit(send);
+  }
+}
diff --git a/libs/vault/src/abstractions/vault-items-transfer.service.ts b/libs/vault/src/abstractions/vault-items-transfer.service.ts
new file mode 100644
index 00000000000..ced9f71eb83
--- /dev/null
+++ b/libs/vault/src/abstractions/vault-items-transfer.service.ts
@@ -0,0 +1,59 @@
+import { Observable } from "rxjs";
+
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { OrganizationId, CollectionId } from "@bitwarden/common/types/guid";
+import { UserId } from "@bitwarden/user-core";
+
+export type UserMigrationInfo =
+  | {
+      /**
+       * Whether the user requires migration of their vault items from My Vault to a My Items collection due to an
+       * organizational policy change. (Enforce organization data ownership policy enabled)
+       */
+      requiresMigration: false;
+    }
+  | {
+      /**
+       * Whether the user requires migration of their vault items from My Vault to a My Items collection due to an
+       * organizational policy change. (Enforce organization data ownership policy enabled)
+       */
+      requiresMigration: true;
+
+      /**
+       * The organization that is enforcing data ownership policies for the given user.
+       */
+      enforcingOrganization: Organization;
+
+      /**
+       * The default collection ID for the user in the enforcing organization, if available.
+       */
+      defaultCollectionId?: CollectionId;
+    };
+
+export abstract class VaultItemsTransferService {
+  /**
+   * Gets information about whether the given user requires migration of their vault items
+   * from My Vault to a My Items collection, and whether they are capable of performing that migration.
+   * @param userId
+   */
+  abstract userMigrationInfo$(userId: UserId): Observable<UserMigrationInfo>;
+
+  /**
+   * Enforces organization data ownership for the given user by transferring vault items.
+   * Checks if any organization policies require the transfer, and if so, prompts the user to confirm before proceeding.
+   *
+   * Rejecting the transfer will result in the user being revoked from the organization.
+   *
+   * @param userId
+   */
+  abstract enforceOrganizationDataOwnership(userId: UserId): Promise<void>;
+
+  /**
+   * Begins transfer of vault items from My Vault to the specified default collection for the given user.
+   */
+  abstract transferPersonalItems(
+    userId: UserId,
+    organizationId: OrganizationId,
+    defaultCollectionId: CollectionId,
+  ): Promise<void>;
+}
diff --git a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.html b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.html
index 83e5956a067..855c37ecab5 100644
--- a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.html
+++ b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.html
@@ -1,32 +1,57 @@
 <h2 class="tw-sr-only" id="attachments">{{ "attachments" | i18n }}</h2>
 
-<ul *ngIf="cipher?.attachments" aria-labelledby="attachments" class="tw-list-none tw-pl-0">
-  <li *ngFor="let attachment of cipher.attachments">
-    <bit-item>
-      <bit-item-content>
-        <span data-testid="file-name" [title]="attachment.fileName">{{ attachment.fileName }}</span>
-        <span slot="secondary" data-testid="file-size">{{ attachment.sizeName }}</span>
-      </bit-item-content>
-      <ng-container slot="end">
-        <bit-item-action>
-          <app-download-attachment
-            [admin]="admin && organization?.canEditAllCiphers"
-            [cipher]="cipher"
-            [attachment]="attachment"
-          ></app-download-attachment>
-        </bit-item-action>
-        <bit-item-action>
-          <app-delete-attachment
-            [admin]="admin && organization?.canEditAllCiphers"
-            [cipherId]="cipher.id"
-            [attachment]="attachment"
-            (onDeletionSuccess)="removeAttachment(attachment)"
-          ></app-delete-attachment>
-        </bit-item-action>
-      </ng-container>
-    </bit-item>
-  </li>
-</ul>
+@if (cipher()?.attachments; as attachments) {
+  <ul aria-labelledby="attachments" class="tw-list-none tw-pl-0">
+    @for (attachment of attachments; track attachment.id) {
+      <li>
+        <bit-item>
+          <bit-item-content>
+            <span data-testid="file-name" [title]="attachment.fileName">{{
+              attachment.fileName
+            }}</span>
+            <span slot="secondary" data-testid="file-size">{{ attachment.sizeName }}</span>
+            <i
+              *ngIf="attachment.key == null"
+              slot="default-trailing"
+              class="bwi bwi-exclamation-triangle bwi-sm tw-text-muted"
+              [appA11yTitle]="'fixEncryptionTooltip' | i18n"
+            ></i>
+          </bit-item-content>
+
+          <ng-container slot="end">
+            <bit-item-action>
+              @if (attachment.key != null) {
+                <app-download-attachment
+                  [admin]="admin() && organization()?.canEditAllCiphers"
+                  [cipher]="cipher()"
+                  [attachment]="attachment"
+                ></app-download-attachment>
+              } @else {
+                <button
+                  [bitAction]="fixOldAttachment(attachment)"
+                  bitButton
+                  buttonType="primary"
+                  size="small"
+                  type="button"
+                >
+                  {{ "fixEncryption" | i18n }}
+                </button>
+              }
+            </bit-item-action>
+            <bit-item-action>
+              <app-delete-attachment
+                [admin]="admin() && organization()?.canEditAllCiphers"
+                [cipherId]="cipher().id"
+                [attachment]="attachment"
+                (onDeletionSuccess)="removeAttachment(attachment)"
+              ></app-delete-attachment>
+            </bit-item-action>
+          </ng-container>
+        </bit-item>
+      </li>
+    }
+  </ul>
+}
 
 <form [id]="attachmentFormId" [formGroup]="attachmentForm" [bitSubmit]="submit">
   <bit-card>
diff --git a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts
index 06f62976548..2e54d3b539a 100644
--- a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts
+++ b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts
@@ -1,7 +1,8 @@
-import { Component, Input } from "@angular/core";
+import { ChangeDetectionStrategy, Component, input } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { By } from "@angular/platform-browser";
 import { mock } from "jest-mock-extended";
+import { BehaviorSubject } from "rxjs";
 
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
@@ -13,7 +14,7 @@ import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.servic
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { CipherId, UserId } from "@bitwarden/common/types/guid";
+import { CipherId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherType } from "@bitwarden/common/vault/enums";
 import { AttachmentView } from "@bitwarden/common/vault/models/view/attachment.view";
@@ -26,27 +27,21 @@ import { FakeAccountService, mockAccountServiceWith } from "../../../../../commo
 import { CipherAttachmentsComponent } from "./cipher-attachments.component";
 import { DeleteAttachmentComponent } from "./delete-attachment/delete-attachment.component";
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-download-attachment",
   template: "",
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 class MockDownloadAttachmentComponent {
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() attachment: AttachmentView;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() cipher: CipherView;
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() admin: boolean = false;
+  readonly attachment = input<AttachmentView>();
+  readonly cipher = input<CipherView>();
+  readonly admin = input<boolean>(false);
 }
 
 describe("CipherAttachmentsComponent", () => {
   let component: CipherAttachmentsComponent;
   let fixture: ComponentFixture<CipherAttachmentsComponent>;
+  let submitBtnFixture: ComponentFixture<ButtonComponent>;
   const showToast = jest.fn();
   const cipherView = {
     id: "5555-444-3333",
@@ -63,17 +58,21 @@ describe("CipherAttachmentsComponent", () => {
   };
 
   const organization = new Organization();
+  organization.id = "org-123" as OrganizationId;
   organization.type = OrganizationUserType.Admin;
   organization.allowAdminAccessToAllCollectionItems = true;
 
   const cipherServiceGet = jest.fn().mockResolvedValue(cipherDomain);
+  const cipherServiceDecrypt = jest.fn().mockResolvedValue(cipherView);
   const saveAttachmentWithServer = jest.fn().mockResolvedValue(cipherDomain);
 
   const mockUserId = Utils.newGuid() as UserId;
   const accountService: FakeAccountService = mockAccountServiceWith(mockUserId);
+  const organizations$ = new BehaviorSubject<Organization[]>([organization]);
 
   beforeEach(async () => {
     cipherServiceGet.mockClear();
+    cipherServiceDecrypt.mockClear().mockResolvedValue(cipherView);
     showToast.mockClear();
     saveAttachmentWithServer.mockClear().mockResolvedValue(cipherDomain);
 
@@ -87,7 +86,7 @@ describe("CipherAttachmentsComponent", () => {
             get: cipherServiceGet,
             saveAttachmentWithServer,
             getKeyForCipherKeyDecryption: () => Promise.resolve(null),
-            decrypt: jest.fn().mockResolvedValue(cipherView),
+            decrypt: cipherServiceDecrypt,
           },
         },
         {
@@ -110,7 +109,9 @@ describe("CipherAttachmentsComponent", () => {
         },
         {
           provide: OrganizationService,
-          useValue: mock<OrganizationService>(),
+          useValue: {
+            organizations$: () => organizations$.asObservable(),
+          },
         },
       ],
     })
@@ -128,70 +129,67 @@ describe("CipherAttachmentsComponent", () => {
   beforeEach(() => {
     fixture = TestBed.createComponent(CipherAttachmentsComponent);
     component = fixture.componentInstance;
-    component.cipherId = "5555-444-3333" as CipherId;
-    component.submitBtn = TestBed.createComponent(ButtonComponent).componentInstance;
+    submitBtnFixture = TestBed.createComponent(ButtonComponent);
+
+    fixture.componentRef.setInput("cipherId", "5555-444-3333" as CipherId);
+    fixture.componentRef.setInput("submitBtn", submitBtnFixture.componentInstance);
     fixture.detectChanges();
   });
 
+  /**
+   * Helper to wait for the async initialization effect to complete
+   */
+  async function waitForInitialization(): Promise<void> {
+    await fixture.whenStable();
+    fixture.detectChanges();
+  }
+
   it("fetches cipherView using `cipherId`", async () => {
-    await component.ngOnInit();
+    await waitForInitialization();
 
     expect(cipherServiceGet).toHaveBeenCalledWith("5555-444-3333", mockUserId);
-    expect(component.cipher).toEqual(cipherView);
   });
 
-  it("sets testids for automation testing", () => {
+  it("sets testids for automation testing", async () => {
     const attachment = {
       id: "1234-5678",
       fileName: "test file.txt",
       sizeName: "244.2 KB",
     } as AttachmentView;
 
-    component.cipher.attachments = [attachment];
+    const cipherWithAttachments = { ...cipherView, attachments: [attachment] };
+    cipherServiceDecrypt.mockResolvedValue(cipherWithAttachments);
 
+    // Create fresh fixture to pick up the mock
+    fixture = TestBed.createComponent(CipherAttachmentsComponent);
+    component = fixture.componentInstance;
+    fixture.componentRef.setInput("cipherId", "5555-444-3333" as CipherId);
     fixture.detectChanges();
 
+    await waitForInitialization();
+
     const fileName = fixture.debugElement.query(By.css('[data-testid="file-name"]'));
     const fileSize = fixture.debugElement.query(By.css('[data-testid="file-size"]'));
 
-    expect(fileName.nativeElement.textContent).toEqual(attachment.fileName);
+    expect(fileName.nativeElement.textContent.trim()).toEqual(attachment.fileName);
     expect(fileSize.nativeElement.textContent).toEqual(attachment.sizeName);
   });
 
   describe("bitSubmit", () => {
-    beforeEach(() => {
-      component.submitBtn.disabled.set(undefined);
-      component.submitBtn.loading.set(undefined);
-    });
-
     it("updates sets initial state of the submit button", async () => {
-      await component.ngOnInit();
+      // Create fresh fixture to properly test initial state
+      submitBtnFixture = TestBed.createComponent(ButtonComponent);
+      submitBtnFixture.componentInstance.disabled.set(undefined as unknown as boolean);
 
-      expect(component.submitBtn.disabled()).toBe(true);
-    });
+      fixture = TestBed.createComponent(CipherAttachmentsComponent);
+      component = fixture.componentInstance;
+      fixture.componentRef.setInput("submitBtn", submitBtnFixture.componentInstance);
+      fixture.componentRef.setInput("cipherId", "5555-444-3333" as CipherId);
+      fixture.detectChanges();
 
-    it("sets submitBtn loading state", () => {
-      jest.useFakeTimers();
+      await waitForInitialization();
 
-      component.bitSubmit.loading = true;
-
-      jest.runAllTimers();
-
-      expect(component.submitBtn.loading()).toBe(true);
-
-      component.bitSubmit.loading = false;
-
-      expect(component.submitBtn.loading()).toBe(false);
-    });
-
-    it("sets submitBtn disabled state", () => {
-      component.bitSubmit.disabled = true;
-
-      expect(component.submitBtn.disabled()).toBe(true);
-
-      component.bitSubmit.disabled = false;
-
-      expect(component.submitBtn.disabled()).toBe(false);
+      expect(submitBtnFixture.componentInstance.disabled()).toBe(true);
     });
   });
 
@@ -199,7 +197,7 @@ describe("CipherAttachmentsComponent", () => {
     let file: File;
 
     beforeEach(() => {
-      component.submitBtn.disabled.set(undefined);
+      submitBtnFixture.componentInstance.disabled.set(undefined as unknown as boolean);
       file = new File([""], "attachment.txt", { type: "text/plain" });
 
       const inputElement = fixture.debugElement.query(By.css("input[type=file]"));
@@ -215,11 +213,11 @@ describe("CipherAttachmentsComponent", () => {
     });
 
     it("sets value of `file` control when input changes", () => {
-      expect(component.attachmentForm.controls.file.value.name).toEqual(file.name);
+      expect(component.attachmentForm.controls.file.value?.name).toEqual(file.name);
     });
 
     it("updates disabled state of submit button", () => {
-      expect(component.submitBtn.disabled()).toBe(false);
+      expect(submitBtnFixture.componentInstance.disabled()).toBe(false);
     });
   });
 
@@ -250,6 +248,8 @@ describe("CipherAttachmentsComponent", () => {
       });
 
       it("shows error toast with server message when saveAttachmentWithServer fails", async () => {
+        await waitForInitialization();
+
         const file = { size: 100 } as File;
         component.attachmentForm.controls.file.setValue(file);
 
@@ -265,6 +265,8 @@ describe("CipherAttachmentsComponent", () => {
       });
 
       it("shows error toast with fallback message when error has no message property", async () => {
+        await waitForInitialization();
+
         const file = { size: 100 } as File;
         component.attachmentForm.controls.file.setValue(file);
 
@@ -279,6 +281,8 @@ describe("CipherAttachmentsComponent", () => {
       });
 
       it("shows error toast with string error message", async () => {
+        await waitForInitialization();
+
         const file = { size: 100 } as File;
         component.attachmentForm.controls.file.setValue(file);
 
@@ -296,13 +300,27 @@ describe("CipherAttachmentsComponent", () => {
     describe("success", () => {
       const file = { size: 524287999 } as File;
 
-      beforeEach(() => {
+      async function setupWithOrganization(adminAccess: boolean): Promise<void> {
+        // Create fresh fixture with organization set before cipherId
+        organization.allowAdminAccessToAllCollectionItems = adminAccess;
+
+        fixture = TestBed.createComponent(CipherAttachmentsComponent);
+        component = fixture.componentInstance;
+        submitBtnFixture = TestBed.createComponent(ButtonComponent);
+
+        // Set organizationId BEFORE cipherId so the effect picks it up
+        fixture.componentRef.setInput("organizationId", organization.id);
+        fixture.componentRef.setInput("submitBtn", submitBtnFixture.componentInstance);
+        fixture.componentRef.setInput("cipherId", "5555-444-3333" as CipherId);
+        fixture.detectChanges();
+
+        await waitForInitialization();
         component.attachmentForm.controls.file.setValue(file);
-        component.organization = organization;
-      });
+      }
 
       it("calls `saveAttachmentWithServer` with admin=false when admin permission is false for organization", async () => {
-        component.organization.allowAdminAccessToAllCollectionItems = false;
+        await setupWithOrganization(false);
+
         await component.submit();
 
         expect(saveAttachmentWithServer).toHaveBeenCalledWith(
@@ -314,13 +332,16 @@ describe("CipherAttachmentsComponent", () => {
       });
 
       it("calls `saveAttachmentWithServer` with admin=true when using admin API", async () => {
-        component.organization.allowAdminAccessToAllCollectionItems = true;
+        await setupWithOrganization(true);
+
         await component.submit();
 
         expect(saveAttachmentWithServer).toHaveBeenCalledWith(cipherDomain, file, mockUserId, true);
       });
 
       it("resets form and input values", async () => {
+        await setupWithOrganization(true);
+
         await component.submit();
 
         const fileInput = fixture.debugElement.query(By.css("input[type=file]"));
@@ -330,16 +351,19 @@ describe("CipherAttachmentsComponent", () => {
       });
 
       it("shows success toast", async () => {
+        await setupWithOrganization(true);
+
         await component.submit();
 
         expect(showToast).toHaveBeenCalledWith({
           variant: "success",
-          title: null,
           message: "attachmentSaved",
         });
       });
 
       it('emits "onUploadSuccess"', async () => {
+        await setupWithOrganization(true);
+
         const emitSpy = jest.spyOn(component.onUploadSuccess, "emit");
 
         await component.submit();
@@ -350,22 +374,36 @@ describe("CipherAttachmentsComponent", () => {
   });
 
   describe("removeAttachment", () => {
-    const attachment = { id: "1234-5678" } as AttachmentView;
+    const attachment = { id: "1234-5678", fileName: "test.txt" } as AttachmentView;
 
-    beforeEach(() => {
-      component.cipher.attachments = [attachment];
+    it("removes attachment from cipher", async () => {
+      // Create a new fixture with cipher that has attachments
+      const cipherWithAttachments = { ...cipherView, attachments: [attachment] };
+      cipherServiceDecrypt.mockResolvedValue(cipherWithAttachments);
 
+      // Create fresh fixture
+      fixture = TestBed.createComponent(CipherAttachmentsComponent);
+      component = fixture.componentInstance;
+      fixture.componentRef.setInput("cipherId", "5555-444-3333" as CipherId);
       fixture.detectChanges();
-    });
 
-    it("removes attachment from cipher", () => {
+      await waitForInitialization();
+
+      // Verify attachment is rendered
+      const attachmentsBefore = fixture.debugElement.queryAll(By.css('[data-testid="file-name"]'));
+      expect(attachmentsBefore.length).toEqual(1);
+
       const deleteAttachmentComponent = fixture.debugElement.query(
         By.directive(DeleteAttachmentComponent),
       ).componentInstance as DeleteAttachmentComponent;
 
       deleteAttachmentComponent.onDeletionSuccess.emit();
 
-      expect(component.cipher.attachments).toEqual([]);
+      fixture.detectChanges();
+
+      // After removal, there should be no attachments displayed
+      const attachmentItems = fixture.debugElement.queryAll(By.css('[data-testid="file-name"]'));
+      expect(attachmentItems.length).toEqual(0);
     });
   });
 });
diff --git a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts
index a5306606199..f75611b995e 100644
--- a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts
+++ b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts
@@ -1,17 +1,15 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CommonModule } from "@angular/common";
 import {
-  AfterViewInit,
+  ChangeDetectionStrategy,
   Component,
   DestroyRef,
   ElementRef,
-  EventEmitter,
-  Input,
-  OnInit,
-  Output,
-  ViewChild,
+  effect,
   inject,
+  input,
+  output,
+  signal,
+  viewChild,
 } from "@angular/core";
 import { takeUntilDestroyed } from "@angular/core/rxjs-interop";
 import {
@@ -56,11 +54,10 @@ type CipherAttachmentForm = FormGroup<{
   file: FormControl<File | null>;
 }>;
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-cipher-attachments",
   templateUrl: "./cipher-attachments.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
   imports: [
     AsyncActionsModule,
     ButtonModule,
@@ -74,70 +71,50 @@ type CipherAttachmentForm = FormGroup<{
     DownloadAttachmentComponent,
   ],
 })
-export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
+export class CipherAttachmentsComponent {
   /** `id` associated with the form element */
   static attachmentFormID = "attachmentForm";
 
   /** Reference to the file HTMLInputElement */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @ViewChild("fileInput", { read: ElementRef }) private fileInput: ElementRef<HTMLInputElement>;
+  private readonly fileInput = viewChild("fileInput", { read: ElementRef<HTMLInputElement> });
 
   /** Reference to the BitSubmitDirective */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @ViewChild(BitSubmitDirective) bitSubmit: BitSubmitDirective;
+  readonly bitSubmit = viewChild(BitSubmitDirective);
 
   /** The `id` of the cipher in context */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input({ required: true }) cipherId: CipherId;
+  readonly cipherId = input.required<CipherId>();
 
   /** The organization ID if this cipher belongs to an organization */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() organizationId?: OrganizationId;
+  readonly organizationId = input<OrganizationId>();
 
   /** Denotes if the action is occurring from within the admin console */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() admin: boolean = false;
+  readonly admin = input<boolean>(false);
 
   /** An optional submit button, whose loading/disabled state will be tied to the form state. */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() submitBtn?: ButtonComponent;
+  readonly submitBtn = input<ButtonComponent>();
 
   /** Emits when a file upload is started */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-output-emitter-ref
-  @Output() onUploadStarted = new EventEmitter<void>();
+  readonly onUploadStarted = output<void>();
 
   /** Emits after a file has been successfully uploaded */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-output-emitter-ref
-  @Output() onUploadSuccess = new EventEmitter<void>();
+  readonly onUploadSuccess = output<void>();
 
   /** Emits when a file upload fails */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-output-emitter-ref
-  @Output() onUploadFailed = new EventEmitter<void>();
+  readonly onUploadFailed = output<void>();
 
   /** Emits after a file has been successfully removed */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-output-emitter-ref
-  @Output() onRemoveSuccess = new EventEmitter<void>();
+  readonly onRemoveSuccess = output<void>();
 
-  organization: Organization;
-  cipher: CipherView;
+  protected readonly organization = signal<Organization | null>(null);
+  protected readonly cipher = signal<CipherView | null>(null);
 
   attachmentForm: CipherAttachmentForm = this.formBuilder.group({
-    file: new FormControl<File>(null, [Validators.required]),
+    file: new FormControl<File | null>(null, [Validators.required]),
   });
 
-  private cipherDomain: Cipher;
-  private activeUserId: UserId;
-  private destroy$ = inject(DestroyRef);
+  private cipherDomain: Cipher | null = null;
+  private activeUserId: UserId | null = null;
+  private readonly destroyRef = inject(DestroyRef);
 
   constructor(
     private cipherService: CipherService,
@@ -150,43 +127,52 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
     private organizationService: OrganizationService,
   ) {
     this.attachmentForm.statusChanges.pipe(takeUntilDestroyed()).subscribe((status) => {
-      if (!this.submitBtn) {
+      const btn = this.submitBtn();
+      if (!btn) {
         return;
       }
 
-      this.submitBtn.disabled.set(status !== "VALID");
-    });
-  }
-
-  async ngOnInit(): Promise<void> {
-    this.activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
-    // Get the organization to check admin permissions
-    this.organization = await this.getOrganization();
-    this.cipherDomain = await this.getCipher(this.cipherId);
-
-    this.cipher = await this.cipherService.decrypt(this.cipherDomain, this.activeUserId);
-
-    // Update the initial state of the submit button
-    if (this.submitBtn) {
-      this.submitBtn.disabled.set(!this.attachmentForm.valid);
-    }
-  }
-
-  ngAfterViewInit(): void {
-    this.bitSubmit.loading$.pipe(takeUntilDestroyed(this.destroy$)).subscribe((loading) => {
-      if (!this.submitBtn) {
-        return;
-      }
-
-      this.submitBtn.loading.set(loading);
+      btn.disabled.set(status !== "VALID");
     });
 
-    this.bitSubmit.disabled$.pipe(takeUntilDestroyed(this.destroy$)).subscribe((disabled) => {
-      if (!this.submitBtn) {
+    // Initialize data when cipherId input is available
+    effect(async () => {
+      const cipherId = this.cipherId();
+      if (!cipherId) {
         return;
       }
 
-      this.submitBtn.disabled.set(disabled);
+      this.activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+      // Get the organization to check admin permissions
+      this.organization.set(await this.getOrganization());
+      this.cipherDomain = await this.getCipher(cipherId);
+
+      if (this.cipherDomain && this.activeUserId) {
+        this.cipher.set(await this.cipherService.decrypt(this.cipherDomain, this.activeUserId));
+      }
+
+      // Update the initial state of the submit button
+      const btn = this.submitBtn();
+      if (btn) {
+        btn.disabled.set(!this.attachmentForm.valid);
+      }
+    });
+
+    // Sync bitSubmit loading/disabled state with submitBtn
+    effect(() => {
+      const bitSubmit = this.bitSubmit();
+      const btn = this.submitBtn();
+      if (!bitSubmit || !btn) {
+        return;
+      }
+
+      bitSubmit.loading$.pipe(takeUntilDestroyed(this.destroyRef)).subscribe((loading) => {
+        btn.loading.set(loading);
+      });
+
+      bitSubmit.disabled$.pipe(takeUntilDestroyed(this.destroyRef)).subscribe((disabled) => {
+        btn.disabled.set(disabled);
+      });
     });
   }
 
@@ -209,7 +195,7 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
     this.onUploadStarted.emit();
 
     const file = this.attachmentForm.value.file;
-    if (file === null) {
+    if (file == null) {
       this.toastService.showToast({
         variant: "error",
         title: this.i18nService.t("errorOccurred"),
@@ -228,24 +214,30 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
       return;
     }
 
+    if (!this.cipherDomain || !this.activeUserId) {
+      return;
+    }
+
     try {
       this.cipherDomain = await this.cipherService.saveAttachmentWithServer(
         this.cipherDomain,
         file,
         this.activeUserId,
-        this.organization?.canEditAllCiphers,
+        this.organization()?.canEditAllCiphers,
       );
 
       // re-decrypt the cipher to update the attachments
-      this.cipher = await this.cipherService.decrypt(this.cipherDomain, this.activeUserId);
+      this.cipher.set(await this.cipherService.decrypt(this.cipherDomain, this.activeUserId));
 
       // Reset reactive form and input element
-      this.fileInput.nativeElement.value = "";
+      const fileInputEl = this.fileInput();
+      if (fileInputEl) {
+        fileInputEl.nativeElement.value = "";
+      }
       this.attachmentForm.controls.file.setValue(null);
 
       this.toastService.showToast({
         variant: "success",
-        title: null,
         message: this.i18nService.t("attachmentSaved"),
       });
 
@@ -257,7 +249,7 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
       let errorMessage = this.i18nService.t("unexpectedError");
       if (typeof e === "string") {
         errorMessage = e;
-      } else if (e?.message) {
+      } else if (e instanceof Error && e?.message) {
         errorMessage = e.message;
       }
 
@@ -271,10 +263,19 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
 
   /** Removes the attachment from the cipher */
   removeAttachment(attachment: AttachmentView) {
-    const index = this.cipher.attachments.indexOf(attachment);
+    const currentCipher = this.cipher();
+    if (!currentCipher?.attachments) {
+      return;
+    }
+
+    const index = currentCipher.attachments.indexOf(attachment);
 
     if (index > -1) {
-      this.cipher.attachments.splice(index, 1);
+      currentCipher.attachments.splice(index, 1);
+      // Trigger signal update by creating a new reference
+      this.cipher.set(
+        Object.assign(Object.create(Object.getPrototypeOf(currentCipher)), currentCipher),
+      );
     }
 
     this.onRemoveSuccess.emit();
@@ -286,7 +287,7 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
    * it will retrieve the cipher using the admin endpoint.
    */
   private async getCipher(id: CipherId): Promise<Cipher | null> {
-    if (id == null) {
+    if (id == null || !this.activeUserId) {
       return null;
     }
 
@@ -294,12 +295,13 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
     const localCipher = await this.cipherService.get(id, this.activeUserId);
 
     // If we got the cipher or there's no organization context, return the result
-    if (localCipher != null || !this.organizationId) {
+    if (localCipher != null || !this.organizationId()) {
       return localCipher;
     }
 
     // Only try the admin API if the user has admin permissions
-    if (this.organization != null && this.organization.canEditAllCiphers) {
+    const org = this.organization();
+    if (org != null && org.canEditAllCiphers) {
       const cipherResponse = await this.apiService.getCipherAdmin(id);
       const cipherData = new CipherData(cipherResponse);
       return new Cipher(cipherData);
@@ -312,7 +314,8 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
    * Gets the organization for the given organization ID
    */
   private async getOrganization(): Promise<Organization | null> {
-    if (!this.organizationId) {
+    const orgId = this.organizationId();
+    if (!orgId || !this.activeUserId) {
       return null;
     }
 
@@ -320,6 +323,41 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
       this.organizationService.organizations$(this.activeUserId),
     );
 
-    return organizations.find((o) => o.id === this.organizationId) || null;
+    return organizations.find((o) => o.id === orgId) || null;
   }
+
+  protected fixOldAttachment = (attachment: AttachmentView) => {
+    return async () => {
+      const cipher = this.cipher();
+      const userId = this.activeUserId;
+
+      if (!attachment.id || !userId || !cipher) {
+        this.toastService.showToast({
+          variant: "error",
+          message: this.i18nService.t("errorOccurred"),
+        });
+        return;
+      }
+
+      try {
+        const updatedCipher = await this.cipherService.upgradeOldCipherAttachments(
+          cipher,
+          userId,
+          attachment.id,
+        );
+
+        this.cipher.set(updatedCipher);
+        this.toastService.showToast({
+          variant: "success",
+          message: this.i18nService.t("attachmentUpdated"),
+        });
+        this.onUploadSuccess.emit();
+      } catch {
+        this.toastService.showToast({
+          variant: "error",
+          message: this.i18nService.t("errorOccurred"),
+        });
+      }
+    };
+  };
 }
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.spec.ts b/libs/vault/src/cipher-form/components/cipher-form.component.spec.ts
index 1e60ad91fb1..9f3102239ae 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.spec.ts
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.spec.ts
@@ -42,9 +42,18 @@ describe("CipherFormComponent", () => {
         { provide: CipherFormService, useValue: mockAddEditFormService },
         {
           provide: CipherFormCacheService,
-          useValue: { init: jest.fn(), getCachedCipherView: jest.fn() },
+          useValue: { init: jest.fn(), getCachedCipherView: jest.fn(), clearCache: jest.fn() },
+        },
+        {
+          provide: ViewCacheService,
+          useValue: {
+            signal: jest.fn(() => {
+              const signalFn = (): any => null;
+              signalFn.set = jest.fn();
+              return signalFn;
+            }),
+          },
         },
-        { provide: ViewCacheService, useValue: { signal: jest.fn(() => (): any => null) } },
         { provide: ConfigService, useValue: mock<ConfigService>() },
         { provide: AccountService, useValue: mockAccountService },
         { provide: CipherArchiveService, useValue: mockCipherArchiveService },
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.ts b/libs/vault/src/cipher-form/components/cipher-form.component.ts
index f94af25e90a..c9e867f8d3a 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.ts
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.ts
@@ -304,13 +304,30 @@ export class CipherFormComponent implements AfterViewInit, OnInit, OnChanges, Ci
    * Updates `updatedCipherView` based on the value from the cache.
    */
   setInitialCipherFromCache() {
+    // If we are coming from the overlay/popup flow clear the cache to avoid old cached data
+    const hasOverlayData =
+      this.config.initialValues &&
+      (this.config.initialValues.username !== undefined ||
+        this.config.initialValues.password !== undefined);
+
+    if (hasOverlayData) {
+      this.cipherFormCacheService.clearCache();
+      return;
+    }
+
     const cachedCipher = this.cipherFormCacheService.getCachedCipherView();
     if (cachedCipher === null) {
       return;
     }
 
-    // Use the cached cipher when it matches the cipher being edited
-    if (this.updatedCipherView.id === cachedCipher.id) {
+    const isEditingExistingCipher =
+      this.updatedCipherView.id && this.updatedCipherView.id === cachedCipher.id;
+    const isCreatingNewCipher =
+      !this.updatedCipherView.id &&
+      !cachedCipher.id &&
+      this.updatedCipherView.type === cachedCipher.type;
+
+    if (isEditingExistingCipher || isCreatingNewCipher) {
       this.updatedCipherView = cachedCipher;
     }
   }
@@ -382,6 +399,9 @@ export class CipherFormComponent implements AfterViewInit, OnInit, OnChanges, Ci
       this.config,
     );
 
+    // Clear the cache after successful save
+    this.cipherFormCacheService.clearCache();
+
     this.toastService.showToast({
       variant: "success",
       title: null,
diff --git a/libs/vault/src/cipher-form/components/item-details/item-details-section.component.ts b/libs/vault/src/cipher-form/components/item-details/item-details-section.component.ts
index 6fd74d86525..58959a957a8 100644
--- a/libs/vault/src/cipher-form/components/item-details/item-details-section.component.ts
+++ b/libs/vault/src/cipher-form/components/item-details/item-details-section.component.ts
@@ -192,11 +192,6 @@ export class ItemDetailsSectionComponent implements OnInit {
   }
 
   get showOwnership() {
-    // Don't show ownership field for archived ciphers
-    if (this.originalCipherView?.isArchived) {
-      return false;
-    }
-
     // Show ownership field when editing with available orgs
     const isEditingWithOrgs = this.organizations.length > 0 && this.config.mode === "edit";
 
diff --git a/libs/vault/src/cipher-form/services/default-cipher-form-cache.service.ts b/libs/vault/src/cipher-form/services/default-cipher-form-cache.service.ts
index 25581ae5ea1..d525dcd9afa 100644
--- a/libs/vault/src/cipher-form/services/default-cipher-form-cache.service.ts
+++ b/libs/vault/src/cipher-form/services/default-cipher-form-cache.service.ts
@@ -22,7 +22,6 @@ export class CipherFormCacheService {
     key: CIPHER_FORM_CACHE_KEY,
     initialValue: null,
     deserializer: CipherView.fromJSON,
-    clearOnTabChange: true,
   });
 
   constructor() {
@@ -45,4 +44,11 @@ export class CipherFormCacheService {
   getCachedCipherView(): CipherView | null {
     return this.cipherCache();
   }
+
+  /**
+   * Clear the cached CipherView.
+   */
+  clearCache(): void {
+    this.cipherCache.set(null);
+  }
 }
diff --git a/libs/vault/src/cipher-view/item-details/item-details-v2.component.html b/libs/vault/src/cipher-view/item-details/item-details-v2.component.html
index 6cc85e161d4..52e850dd09b 100644
--- a/libs/vault/src/cipher-view/item-details/item-details-v2.component.html
+++ b/libs/vault/src/cipher-view/item-details/item-details-v2.component.html
@@ -10,7 +10,7 @@
       <div class="tw-flex tw-items-center tw-justify-center" style="width: 40px; height: 40px">
         <app-vault-icon [cipher]="cipher()" [coloredIcon]="true"></app-vault-icon>
       </div>
-      <h2 bitTypography="h4" class="tw-ml-2 tw-mt-2" data-testid="item-name">
+      <h2 bitTypography="h4" class="tw-ml-2 tw-mt-2 tw-select-auto" data-testid="item-name">
         {{ cipher().name }}
       </h2>
     </div>
diff --git a/libs/vault/src/cipher-view/login-credentials/login-credentials-view.component.html b/libs/vault/src/cipher-view/login-credentials/login-credentials-view.component.html
index be33f7a5562..2566752813c 100644
--- a/libs/vault/src/cipher-view/login-credentials/login-credentials-view.component.html
+++ b/libs/vault/src/cipher-view/login-credentials/login-credentials-view.component.html
@@ -122,7 +122,7 @@
     </bit-form-field>
     <bit-form-field *ngIf="cipher.login.totp">
       <bit-label [appTextDrag]="totpCodeCopyObj?.totpCode">
-        <div class="tw-flex tw-items-center tw-gap-3">
+        <div class="tw-flex tw-items-center tw-gap-2">
           {{ "verificationCodeTotp" | i18n }}
           <app-premium-badge [organizationId]="cipher.organizationId"></app-premium-badge>
         </div>
diff --git a/libs/vault/src/components/download-attachment/download-attachment.component.html b/libs/vault/src/components/download-attachment/download-attachment.component.html
index c2c2f1d4ebd..9d80f36818a 100644
--- a/libs/vault/src/components/download-attachment/download-attachment.component.html
+++ b/libs/vault/src/components/download-attachment/download-attachment.component.html
@@ -1,9 +1,10 @@
-<button
-  *ngIf="!isDecryptionFailure"
-  [bitAction]="download"
-  bitIconButton="bwi-download"
-  buttonType="main"
-  size="small"
-  type="button"
-  [label]="'downloadAttachmentName' | i18n: attachment.fileName"
-></button>
+@if (!isDecryptionFailure()) {
+  <button
+    [bitAction]="download"
+    bitIconButton="bwi-download"
+    buttonType="main"
+    size="small"
+    type="button"
+    [label]="'downloadAttachmentName' | i18n: attachment().fileName"
+  ></button>
+}
diff --git a/libs/vault/src/components/download-attachment/download-attachment.component.spec.ts b/libs/vault/src/components/download-attachment/download-attachment.component.spec.ts
index ec5a9ce96fd..3bbc375fdfc 100644
--- a/libs/vault/src/components/download-attachment/download-attachment.component.spec.ts
+++ b/libs/vault/src/components/download-attachment/download-attachment.component.spec.ts
@@ -100,8 +100,8 @@ describe("DownloadAttachmentComponent", () => {
   beforeEach(() => {
     fixture = TestBed.createComponent(DownloadAttachmentComponent);
     component = fixture.componentInstance;
-    component.attachment = attachment;
-    component.cipher = cipherView;
+    fixture.componentRef.setInput("attachment", attachment);
+    fixture.componentRef.setInput("cipher", cipherView);
     fixture.detectChanges();
   });
 
@@ -123,7 +123,8 @@ describe("DownloadAttachmentComponent", () => {
     });
 
     it("hides download button when the attachment has decryption failure", () => {
-      component.attachment.fileName = DECRYPT_ERROR;
+      const decryptFailureAttachment = { ...attachment, fileName: DECRYPT_ERROR };
+      fixture.componentRef.setInput("attachment", decryptFailureAttachment);
       fixture.detectChanges();
 
       expect(fixture.debugElement.query(By.css("button"))).toBeNull();
@@ -156,7 +157,6 @@ describe("DownloadAttachmentComponent", () => {
 
         expect(showToast).toHaveBeenCalledWith({
           message: "errorOccurred",
-          title: null,
           variant: "error",
         });
       });
@@ -172,7 +172,6 @@ describe("DownloadAttachmentComponent", () => {
 
         expect(showToast).toHaveBeenCalledWith({
           message: "errorOccurred",
-          title: null,
           variant: "error",
         });
       });
diff --git a/libs/vault/src/components/download-attachment/download-attachment.component.ts b/libs/vault/src/components/download-attachment/download-attachment.component.ts
index 2f9cd528990..31ed609637c 100644
--- a/libs/vault/src/components/download-attachment/download-attachment.component.ts
+++ b/libs/vault/src/components/download-attachment/download-attachment.component.ts
@@ -1,7 +1,5 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CommonModule } from "@angular/common";
-import { Component, Input } from "@angular/core";
+import { ChangeDetectionStrategy, Component, computed, input } from "@angular/core";
 import { firstValueFrom } from "rxjs";
 
 import { JslibModule } from "@bitwarden/angular/jslib.module";
@@ -17,38 +15,27 @@ import { AttachmentView } from "@bitwarden/common/vault/models/view/attachment.v
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import { AsyncActionsModule, IconButtonModule, ToastService } from "@bitwarden/components";
 
-// FIXME(https://bitwarden.atlassian.net/browse/CL-764): Migrate to OnPush
-// eslint-disable-next-line @angular-eslint/prefer-on-push-component-change-detection
 @Component({
   selector: "app-download-attachment",
   templateUrl: "./download-attachment.component.html",
   imports: [AsyncActionsModule, CommonModule, JslibModule, IconButtonModule],
+  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 export class DownloadAttachmentComponent {
   /** Attachment to download */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input({ required: true }) attachment: AttachmentView;
+  readonly attachment = input.required<AttachmentView>();
 
   /** The cipher associated with the attachment */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input({ required: true }) cipher: CipherView;
+  readonly cipher = input.required<CipherView>();
 
-  // When in view mode, we will want to check for the master password reprompt
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() checkPwReprompt?: boolean = false;
+  /** When in view mode, we will want to check for the master password reprompt */
+  readonly checkPwReprompt = input<boolean>(false);
 
-  // Required for fetching attachment data when viewed from cipher via emergency access
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() emergencyAccessId?: EmergencyAccessId;
+  /** Required for fetching attachment data when viewed from cipher via emergency access */
+  readonly emergencyAccessId = input<EmergencyAccessId>();
 
-  /** When owners/admins can mange all items and when accessing from the admin console, use the admin endpoint */
-  // FIXME(https://bitwarden.atlassian.net/browse/CL-903): Migrate to Signals
-  // eslint-disable-next-line @angular-eslint/prefer-signals
-  @Input() admin?: boolean = false;
+  /** When owners/admins can manage all items and when accessing from the admin console, use the admin endpoint */
+  readonly admin = input<boolean>(false);
 
   constructor(
     private i18nService: I18nService,
@@ -59,26 +46,36 @@ export class DownloadAttachmentComponent {
     private cipherService: CipherService,
   ) {}
 
-  protected get isDecryptionFailure(): boolean {
-    return this.attachment.fileName === DECRYPT_ERROR;
-  }
+  protected readonly isDecryptionFailure = computed(
+    () => this.attachment().fileName === DECRYPT_ERROR,
+  );
 
   /** Download the attachment */
   download = async () => {
-    let url: string;
+    const attachment = this.attachment();
+    const cipher = this.cipher();
+    let url: string | undefined;
+
+    if (!attachment.id) {
+      this.toastService.showToast({
+        variant: "error",
+        message: this.i18nService.t("errorOccurred"),
+      });
+      return;
+    }
 
     try {
-      const attachmentDownloadResponse = this.admin
-        ? await this.apiService.getAttachmentDataAdmin(this.cipher.id, this.attachment.id)
+      const attachmentDownloadResponse = this.admin()
+        ? await this.apiService.getAttachmentDataAdmin(cipher.id, attachment.id)
         : await this.apiService.getAttachmentData(
-            this.cipher.id,
-            this.attachment.id,
-            this.emergencyAccessId,
+            cipher.id,
+            attachment.id,
+            this.emergencyAccessId(),
           );
       url = attachmentDownloadResponse.url;
     } catch (e) {
       if (e instanceof ErrorResponse && (e as ErrorResponse).statusCode === 404) {
-        url = this.attachment.url;
+        url = attachment.url;
       } else if (e instanceof ErrorResponse) {
         throw new Error((e as ErrorResponse).getSingleMessage());
       } else {
@@ -86,11 +83,18 @@ export class DownloadAttachmentComponent {
       }
     }
 
+    if (!url) {
+      this.toastService.showToast({
+        variant: "error",
+        message: this.i18nService.t("errorOccurred"),
+      });
+      return;
+    }
+
     const response = await fetch(new Request(url, { cache: "no-store" }));
     if (response.status !== 200) {
       this.toastService.showToast({
         variant: "error",
-        title: null,
         message: this.i18nService.t("errorOccurred"),
       });
       return;
@@ -99,26 +103,31 @@ export class DownloadAttachmentComponent {
     try {
       const userId = await firstValueFrom(this.stateProvider.activeUserId$);
 
+      if (!userId || !attachment.fileName) {
+        this.toastService.showToast({
+          variant: "error",
+          message: this.i18nService.t("errorOccurred"),
+        });
+        return;
+      }
+
       const decBuf = await this.cipherService.getDecryptedAttachmentBuffer(
-        this.cipher.id as CipherId,
-        this.attachment,
+        cipher.id as CipherId,
+        attachment,
         response,
         userId,
         // When the emergency access ID is present, the cipher is being viewed via emergency access.
         // Force legacy decryption in these cases.
-        this.emergencyAccessId ? true : false,
+        Boolean(this.emergencyAccessId()),
       );
 
       this.fileDownloadService.download({
-        fileName: this.attachment.fileName,
+        fileName: attachment.fileName,
         blobData: decBuf,
       });
-      // FIXME: Remove when updating file. Eslint update
-      // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    } catch (e) {
+    } catch {
       this.toastService.showToast({
         variant: "error",
-        title: null,
         message: this.i18nService.t("errorOccurred"),
       });
     }
diff --git a/libs/vault/src/components/vault-items-transfer/index.ts b/libs/vault/src/components/vault-items-transfer/index.ts
new file mode 100644
index 00000000000..f2ffb9f9c22
--- /dev/null
+++ b/libs/vault/src/components/vault-items-transfer/index.ts
@@ -0,0 +1,13 @@
+export {
+  TransferItemsDialogComponent,
+  TransferItemsDialogParams,
+  TransferItemsDialogResult,
+  TransferItemsDialogResultType,
+} from "./transfer-items-dialog.component";
+
+export {
+  LeaveConfirmationDialogComponent,
+  LeaveConfirmationDialogParams,
+  LeaveConfirmationDialogResult,
+  LeaveConfirmationDialogResultType,
+} from "./leave-confirmation-dialog.component";
diff --git a/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.html b/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.html
new file mode 100644
index 00000000000..f0d644fecff
--- /dev/null
+++ b/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.html
@@ -0,0 +1,33 @@
+<bit-simple-dialog>
+  <i
+    bitDialogIcon
+    class="bwi bwi-exclamation-triangle tw-text-warning tw-text-3xl"
+    aria-hidden="true"
+  ></i>
+
+  <span bitDialogTitle>{{ "leaveConfirmationDialogTitle" | i18n }}</span>
+
+  <ng-container bitDialogContent>
+    <p bitTypography="body1">
+      {{ "leaveConfirmationDialogContentOne" | i18n }}
+    </p>
+    <p bitTypography="body1">
+      {{ "leaveConfirmationDialogContentTwo" | i18n }}
+    </p>
+  </ng-container>
+
+  <ng-container bitDialogFooter>
+    <button bitButton type="button" buttonType="dangerPrimary" (click)="confirmLeave()">
+      {{ "leaveConfirmationDialogConfirmButton" | i18n: organizationName }}
+    </button>
+
+    <button bitButton type="button" buttonType="secondary" (click)="goBack()">
+      {{ "goBack" | i18n }}
+    </button>
+
+    <a bitLink href="#" (click)="openLearnMore($event)" class="tw-w-full tw-text-center">
+      {{ "howToManageMyVault" | i18n }}
+      <i class="bwi bwi-external-link tw-ml-1" aria-hidden="true"></i>
+    </a>
+  </ng-container>
+</bit-simple-dialog>
diff --git a/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.ts b/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.ts
new file mode 100644
index 00000000000..bd32a1ea6dd
--- /dev/null
+++ b/libs/vault/src/components/vault-items-transfer/leave-confirmation-dialog.component.ts
@@ -0,0 +1,64 @@
+import { ChangeDetectionStrategy, Component, inject } from "@angular/core";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { UnionOfValues } from "@bitwarden/common/vault/types/union-of-values";
+import {
+  DIALOG_DATA,
+  DialogConfig,
+  DialogRef,
+  DialogService,
+  ButtonModule,
+  DialogModule,
+  LinkModule,
+  TypographyModule,
+} from "@bitwarden/components";
+
+export interface LeaveConfirmationDialogParams {
+  organizationName: string;
+}
+
+export const LeaveConfirmationDialogResult = Object.freeze({
+  /**
+   * User confirmed they want to leave the organization.
+   */
+  Confirmed: "confirmed",
+  /**
+   * User chose to go back instead of leaving the organization.
+   */
+  Back: "back",
+} as const);
+
+export type LeaveConfirmationDialogResultType = UnionOfValues<typeof LeaveConfirmationDialogResult>;
+
+@Component({
+  templateUrl: "./leave-confirmation-dialog.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [ButtonModule, DialogModule, LinkModule, TypographyModule, JslibModule],
+})
+export class LeaveConfirmationDialogComponent {
+  private readonly params = inject<LeaveConfirmationDialogParams>(DIALOG_DATA);
+  private readonly dialogRef = inject(DialogRef<LeaveConfirmationDialogResultType>);
+  private readonly platformUtilsService = inject(PlatformUtilsService);
+
+  protected readonly organizationName = this.params.organizationName;
+
+  protected confirmLeave() {
+    this.dialogRef.close(LeaveConfirmationDialogResult.Confirmed);
+  }
+
+  protected goBack() {
+    this.dialogRef.close(LeaveConfirmationDialogResult.Back);
+  }
+
+  protected openLearnMore(e: Event) {
+    e.preventDefault();
+    this.platformUtilsService.launchUri("https://bitwarden.com/help/transfer-ownership/");
+  }
+
+  static open(dialogService: DialogService, config: DialogConfig<LeaveConfirmationDialogParams>) {
+    return dialogService.open<LeaveConfirmationDialogResultType>(LeaveConfirmationDialogComponent, {
+      ...config,
+    });
+  }
+}
diff --git a/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.html b/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.html
new file mode 100644
index 00000000000..0b77d4ba7d8
--- /dev/null
+++ b/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.html
@@ -0,0 +1,22 @@
+<bit-simple-dialog hideIcon>
+  <span bitDialogTitle>{{ "transferItemsToOrganizationTitle" | i18n: organizationName }}</span>
+
+  <span bitDialogContent>
+    {{ "transferItemsToOrganizationContent" | i18n: organizationName }}
+  </span>
+
+  <ng-container bitDialogFooter>
+    <button bitButton type="button" buttonType="primary" (click)="acceptTransfer()">
+      {{ "acceptTransfer" | i18n }}
+    </button>
+
+    <button bitButton type="button" buttonType="secondary" (click)="decline()">
+      {{ "declineAndLeave" | i18n }}
+    </button>
+
+    <a bitLink href="#" (click)="openLearnMore($event)" class="tw-w-full tw-text-center">
+      {{ "whyAmISeeingThis" | i18n }}
+      <i class="bwi bwi-external-link tw-ml-1" aria-hidden="true"></i>
+    </a>
+  </ng-container>
+</bit-simple-dialog>
diff --git a/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.ts b/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.ts
new file mode 100644
index 00000000000..f28ad2ab3ec
--- /dev/null
+++ b/libs/vault/src/components/vault-items-transfer/transfer-items-dialog.component.ts
@@ -0,0 +1,64 @@
+import { ChangeDetectionStrategy, Component, inject } from "@angular/core";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { UnionOfValues } from "@bitwarden/common/vault/types/union-of-values";
+import {
+  DIALOG_DATA,
+  DialogConfig,
+  DialogRef,
+  DialogService,
+  ButtonModule,
+  DialogModule,
+  LinkModule,
+  TypographyModule,
+} from "@bitwarden/components";
+
+export interface TransferItemsDialogParams {
+  organizationName: string;
+}
+
+export const TransferItemsDialogResult = Object.freeze({
+  /**
+   * User accepted the transfer of items.
+   */
+  Accepted: "accepted",
+  /**
+   * User declined the transfer of items.
+   */
+  Declined: "declined",
+} as const);
+
+export type TransferItemsDialogResultType = UnionOfValues<typeof TransferItemsDialogResult>;
+
+@Component({
+  templateUrl: "./transfer-items-dialog.component.html",
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [ButtonModule, DialogModule, LinkModule, TypographyModule, JslibModule],
+})
+export class TransferItemsDialogComponent {
+  private readonly params = inject<TransferItemsDialogParams>(DIALOG_DATA);
+  private readonly dialogRef = inject(DialogRef<TransferItemsDialogResultType>);
+  private readonly platformUtilsService = inject(PlatformUtilsService);
+
+  protected readonly organizationName = this.params.organizationName;
+
+  protected acceptTransfer() {
+    this.dialogRef.close(TransferItemsDialogResult.Accepted);
+  }
+
+  protected decline() {
+    this.dialogRef.close(TransferItemsDialogResult.Declined);
+  }
+
+  protected openLearnMore(e: Event) {
+    e.preventDefault();
+    this.platformUtilsService.launchUri("https://bitwarden.com/help/transfer-ownership/");
+  }
+
+  static open(dialogService: DialogService, config: DialogConfig<TransferItemsDialogParams>) {
+    return dialogService.open<TransferItemsDialogResultType>(TransferItemsDialogComponent, {
+      ...config,
+    });
+  }
+}
diff --git a/libs/vault/src/index.ts b/libs/vault/src/index.ts
index 2503d92299c..d06d6f3a95f 100644
--- a/libs/vault/src/index.ts
+++ b/libs/vault/src/index.ts
@@ -29,11 +29,14 @@ export * from "./components/add-edit-folder-dialog/add-edit-folder-dialog.compon
 export * from "./components/carousel";
 export * from "./components/new-cipher-menu/new-cipher-menu.component";
 export * from "./components/permit-cipher-details-popover/permit-cipher-details-popover.component";
+export * from "./components/vault-items-transfer";
 
 export { DefaultSshImportPromptService } from "./services/default-ssh-import-prompt.service";
 export { SshImportPromptService } from "./services/ssh-import-prompt.service";
 
 export * from "./abstractions/change-login-password.service";
+export * from "./abstractions/vault-items-transfer.service";
+export * from "./services/default-vault-items-transfer.service";
 export * from "./services/default-change-login-password.service";
 export * from "./services/archive-cipher-utilities.service";
 
diff --git a/libs/vault/src/models/vault-filter-section.type.ts b/libs/vault/src/models/vault-filter-section.type.ts
index f1e6222b57a..d275b1251e9 100644
--- a/libs/vault/src/models/vault-filter-section.type.ts
+++ b/libs/vault/src/models/vault-filter-section.type.ts
@@ -47,6 +47,16 @@ export type VaultFilterSection = {
     component: any;
   };
   divider?: boolean;
+  premiumOptions?: {
+    /**  When true, the premium badge will show on the filter for non-premium users. */
+    showBadgeForNonPremium?: true;
+    /**
+     * Action to be called instead of applying the filter.
+     * Useful when the user does not have access to a filter (e.g., premium feature)
+     * and custom behavior is needed when invoking the filter.
+     */
+    blockFilterAction?: () => Promise<void>;
+  };
 };
 
 export type VaultFilterList = {
diff --git a/libs/vault/src/services/default-vault-items-transfer.service.spec.ts b/libs/vault/src/services/default-vault-items-transfer.service.spec.ts
new file mode 100644
index 00000000000..d85fe2ffd43
--- /dev/null
+++ b/libs/vault/src/services/default-vault-items-transfer.service.spec.ts
@@ -0,0 +1,721 @@
+import { mock, MockProxy } from "jest-mock-extended";
+import { firstValueFrom, of } from "rxjs";
+
+// eslint-disable-next-line no-restricted-imports
+import { CollectionService, CollectionView } from "@bitwarden/admin-console/common";
+import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { OrganizationId, CollectionId } from "@bitwarden/common/types/guid";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { LogService } from "@bitwarden/logging";
+import { UserId } from "@bitwarden/user-core";
+
+import { DefaultVaultItemsTransferService } from "./default-vault-items-transfer.service";
+
+describe("DefaultVaultItemsTransferService", () => {
+  let service: DefaultVaultItemsTransferService;
+
+  let mockCipherService: MockProxy<CipherService>;
+  let mockPolicyService: MockProxy<PolicyService>;
+  let mockOrganizationService: MockProxy<OrganizationService>;
+  let mockCollectionService: MockProxy<CollectionService>;
+  let mockLogService: MockProxy<LogService>;
+  let mockI18nService: MockProxy<I18nService>;
+  let mockDialogService: MockProxy<DialogService>;
+  let mockToastService: MockProxy<ToastService>;
+  let mockConfigService: MockProxy<ConfigService>;
+
+  const userId = "user-id" as UserId;
+  const organizationId = "org-id" as OrganizationId;
+  const collectionId = "collection-id" as CollectionId;
+
+  beforeEach(() => {
+    mockCipherService = mock<CipherService>();
+    mockPolicyService = mock<PolicyService>();
+    mockOrganizationService = mock<OrganizationService>();
+    mockCollectionService = mock<CollectionService>();
+    mockLogService = mock<LogService>();
+    mockI18nService = mock<I18nService>();
+    mockDialogService = mock<DialogService>();
+    mockToastService = mock<ToastService>();
+    mockConfigService = mock<ConfigService>();
+
+    mockI18nService.t.mockImplementation((key) => key);
+
+    service = new DefaultVaultItemsTransferService(
+      mockCipherService,
+      mockPolicyService,
+      mockOrganizationService,
+      mockCollectionService,
+      mockLogService,
+      mockI18nService,
+      mockDialogService,
+      mockToastService,
+      mockConfigService,
+    );
+  });
+
+  describe("userMigrationInfo$", () => {
+    // Helper to setup common mock scenario
+    function setupMocksForMigrationScenario(options: {
+      policies?: Policy[];
+      organizations?: Organization[];
+      ciphers?: CipherView[];
+      collections?: CollectionView[];
+    }): void {
+      mockPolicyService.policiesByType$.mockReturnValue(of(options.policies ?? []));
+      mockOrganizationService.organizations$.mockReturnValue(of(options.organizations ?? []));
+      mockCipherService.cipherViews$.mockReturnValue(of(options.ciphers ?? []));
+      mockCollectionService.decryptedCollections$.mockReturnValue(of(options.collections ?? []));
+    }
+
+    it("calls policiesByType$ with correct PolicyType", async () => {
+      setupMocksForMigrationScenario({ policies: [] });
+
+      await firstValueFrom(service.userMigrationInfo$(userId));
+
+      expect(mockPolicyService.policiesByType$).toHaveBeenCalledWith(
+        PolicyType.OrganizationDataOwnership,
+        userId,
+      );
+    });
+
+    describe("when no policy exists", () => {
+      beforeEach(() => {
+        setupMocksForMigrationScenario({ policies: [] });
+      });
+
+      it("returns requiresMigration: false", async () => {
+        const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+        expect(result).toEqual({
+          requiresMigration: false,
+        });
+      });
+    });
+
+    describe("when policy exists", () => {
+      const policy = {
+        organizationId: organizationId,
+        revisionDate: new Date("2024-01-01"),
+      } as Policy;
+      const organization = {
+        id: organizationId,
+        name: "Test Org",
+      } as Organization;
+
+      beforeEach(() => {
+        setupMocksForMigrationScenario({
+          policies: [policy],
+          organizations: [organization],
+        });
+      });
+
+      describe("and user has no personal ciphers", () => {
+        beforeEach(() => {
+          mockCipherService.cipherViews$.mockReturnValue(of([]));
+        });
+
+        it("returns requiresMigration: false", async () => {
+          const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+          expect(result).toEqual({
+            requiresMigration: false,
+            enforcingOrganization: organization,
+            defaultCollectionId: undefined,
+          });
+        });
+      });
+
+      describe("and user has personal ciphers", () => {
+        beforeEach(() => {
+          mockCipherService.cipherViews$.mockReturnValue(of([{ id: "cipher-1" } as CipherView]));
+        });
+
+        it("returns requiresMigration: true", async () => {
+          const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+          expect(result).toEqual({
+            requiresMigration: true,
+            enforcingOrganization: organization,
+            defaultCollectionId: undefined,
+          });
+        });
+
+        it("includes defaultCollectionId when a default collection exists", async () => {
+          mockCollectionService.decryptedCollections$.mockReturnValue(
+            of([
+              {
+                id: collectionId,
+                organizationId: organizationId,
+                isDefaultCollection: true,
+              } as CollectionView,
+            ]),
+          );
+
+          const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+          expect(result).toEqual({
+            requiresMigration: true,
+            enforcingOrganization: organization,
+            defaultCollectionId: collectionId,
+          });
+        });
+
+        it("returns default collection only for the enforcing organization", async () => {
+          mockCollectionService.decryptedCollections$.mockReturnValue(
+            of([
+              {
+                id: "wrong-collection-id" as CollectionId,
+                organizationId: "wrong-org-id" as OrganizationId,
+                isDefaultCollection: true,
+              } as CollectionView,
+              {
+                id: collectionId,
+                organizationId: organizationId,
+                isDefaultCollection: true,
+              } as CollectionView,
+            ]),
+          );
+
+          const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+          expect(result).toEqual({
+            requiresMigration: true,
+            enforcingOrganization: organization,
+            defaultCollectionId: collectionId,
+          });
+        });
+      });
+
+      it("filters out organization ciphers when checking for personal ciphers", async () => {
+        mockCipherService.cipherViews$.mockReturnValue(
+          of([
+            {
+              id: "cipher-1",
+              organizationId: organizationId as string,
+            } as CipherView,
+          ]),
+        );
+
+        const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+        expect(result).toEqual({
+          requiresMigration: false,
+          enforcingOrganization: organization,
+          defaultCollectionId: undefined,
+        });
+      });
+    });
+
+    describe("when multiple policies exist", () => {
+      const olderPolicy = {
+        organizationId: "older-org-id" as OrganizationId,
+        revisionDate: new Date("2024-01-01"),
+      } as Policy;
+      const newerPolicy = {
+        organizationId: organizationId,
+        revisionDate: new Date("2024-06-01"),
+      } as Policy;
+      const olderOrganization = {
+        id: "older-org-id" as OrganizationId,
+        name: "Older Org",
+      } as Organization;
+      const newerOrganization = {
+        id: organizationId,
+        name: "Newer Org",
+      } as Organization;
+
+      beforeEach(() => {
+        setupMocksForMigrationScenario({
+          policies: [newerPolicy, olderPolicy],
+          organizations: [olderOrganization, newerOrganization],
+          ciphers: [{ id: "cipher-1" } as CipherView],
+        });
+      });
+
+      it("uses the oldest policy when selecting enforcing organization", async () => {
+        const result = await firstValueFrom(service.userMigrationInfo$(userId));
+
+        expect(result).toEqual({
+          requiresMigration: true,
+          enforcingOrganization: olderOrganization,
+          defaultCollectionId: undefined,
+        });
+      });
+    });
+  });
+
+  describe("transferPersonalItems", () => {
+    it("does nothing when user has no personal ciphers", async () => {
+      mockCipherService.cipherViews$.mockReturnValue(of([]));
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+      expect(mockLogService.info).not.toHaveBeenCalled();
+    });
+
+    it("calls shareManyWithServer with correct parameters", async () => {
+      const personalCiphers = [{ id: "cipher-1" }, { id: "cipher-2" }] as CipherView[];
+
+      mockCipherService.cipherViews$.mockReturnValue(of(personalCiphers));
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.shareManyWithServer).toHaveBeenCalledWith(
+        personalCiphers,
+        organizationId,
+        [collectionId],
+        userId,
+      );
+    });
+
+    it("transfers only personal ciphers, not organization ciphers", async () => {
+      const allCiphers = [
+        { id: "cipher-1" },
+        { id: "cipher-2", organizationId: "other-org-id" },
+        { id: "cipher-3" },
+      ] as CipherView[];
+
+      const expectedPersonalCiphers = [allCiphers[0], allCiphers[2]];
+
+      mockCipherService.cipherViews$.mockReturnValue(of(allCiphers));
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.shareManyWithServer).toHaveBeenCalledWith(
+        expectedPersonalCiphers,
+        organizationId,
+        [collectionId],
+        userId,
+      );
+    });
+
+    it("propagates errors from shareManyWithServer", async () => {
+      const personalCiphers = [{ id: "cipher-1" }] as CipherView[];
+
+      const error = new Error("Transfer failed");
+
+      mockCipherService.cipherViews$.mockReturnValue(of(personalCiphers));
+      mockCipherService.shareManyWithServer.mockRejectedValue(error);
+
+      await expect(
+        service.transferPersonalItems(userId, organizationId, collectionId),
+      ).rejects.toThrow("Transfer failed");
+    });
+  });
+
+  describe("upgradeOldAttachments", () => {
+    it("upgrades old attachments before transferring", async () => {
+      const cipherWithOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      const upgradedCipher = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: false,
+        attachments: [{ key: "new-key" }],
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$
+        .mockReturnValueOnce(of([cipherWithOldAttachment]))
+        .mockReturnValueOnce(of([upgradedCipher]));
+      mockCipherService.upgradeOldCipherAttachments.mockResolvedValue(upgradedCipher);
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.upgradeOldCipherAttachments).toHaveBeenCalledWith(
+        cipherWithOldAttachment,
+        userId,
+      );
+      expect(mockCipherService.shareManyWithServer).toHaveBeenCalledWith(
+        [upgradedCipher],
+        organizationId,
+        [collectionId],
+        userId,
+      );
+    });
+
+    it("upgrades multiple ciphers with old attachments", async () => {
+      const cipher1 = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      const cipher2 = {
+        id: "cipher-2",
+        name: "Cipher 2",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      const upgradedCipher1 = { ...cipher1, hasOldAttachments: false } as CipherView;
+      const upgradedCipher2 = { ...cipher2, hasOldAttachments: false } as CipherView;
+
+      mockCipherService.cipherViews$
+        .mockReturnValueOnce(of([cipher1, cipher2]))
+        .mockReturnValueOnce(of([upgradedCipher1, upgradedCipher2]));
+      mockCipherService.upgradeOldCipherAttachments
+        .mockResolvedValueOnce(upgradedCipher1)
+        .mockResolvedValueOnce(upgradedCipher2);
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.upgradeOldCipherAttachments).toHaveBeenCalledTimes(2);
+      expect(mockCipherService.upgradeOldCipherAttachments).toHaveBeenCalledWith(cipher1, userId);
+      expect(mockCipherService.upgradeOldCipherAttachments).toHaveBeenCalledWith(cipher2, userId);
+    });
+
+    it("skips attachments that already have keys", async () => {
+      const cipherWithMixedAttachments = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: "existing-key" }, { key: null }],
+      } as unknown as CipherView;
+
+      const upgradedCipher = {
+        ...cipherWithMixedAttachments,
+        hasOldAttachments: false,
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$
+        .mockReturnValueOnce(of([cipherWithMixedAttachments]))
+        .mockReturnValueOnce(of([upgradedCipher]));
+      mockCipherService.upgradeOldCipherAttachments.mockResolvedValue(upgradedCipher);
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      // Should only be called once for the attachment without a key
+      expect(mockCipherService.upgradeOldCipherAttachments).toHaveBeenCalledTimes(1);
+    });
+
+    it("throws error when upgradeOldCipherAttachments fails", async () => {
+      const cipherWithOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$.mockReturnValue(of([cipherWithOldAttachment]));
+      mockCipherService.upgradeOldCipherAttachments.mockRejectedValue(new Error("Upgrade failed"));
+
+      await expect(
+        service.transferPersonalItems(userId, organizationId, collectionId),
+      ).rejects.toThrow("Failed to upgrade old attachments for cipher cipher-1");
+
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("throws error when upgrade returns cipher still having old attachments", async () => {
+      const cipherWithOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      // Upgrade returns but cipher still has old attachments
+      const stillOldCipher = {
+        ...cipherWithOldAttachment,
+        hasOldAttachments: true,
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$.mockReturnValue(of([cipherWithOldAttachment]));
+      mockCipherService.upgradeOldCipherAttachments.mockResolvedValue(stillOldCipher);
+
+      await expect(
+        service.transferPersonalItems(userId, organizationId, collectionId),
+      ).rejects.toThrow("Failed to upgrade old attachments for cipher cipher-1");
+
+      expect(mockLogService.error).toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("throws error when sanity check finds remaining old attachments after upgrade", async () => {
+      const cipherWithOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      const upgradedCipher = {
+        ...cipherWithOldAttachment,
+        hasOldAttachments: false,
+      } as unknown as CipherView;
+
+      // First call returns cipher with old attachment, second call (after upgrade) still returns old attachment
+      mockCipherService.cipherViews$
+        .mockReturnValueOnce(of([cipherWithOldAttachment]))
+        .mockReturnValueOnce(of([cipherWithOldAttachment])); // Still has old attachments after re-fetch
+      mockCipherService.upgradeOldCipherAttachments.mockResolvedValue(upgradedCipher);
+
+      await expect(
+        service.transferPersonalItems(userId, organizationId, collectionId),
+      ).rejects.toThrow(
+        "Failed to upgrade all old attachments. 1 ciphers still have old attachments.",
+      );
+
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("logs info when upgrading old attachments", async () => {
+      const cipherWithOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: true,
+        attachments: [{ key: null }],
+      } as unknown as CipherView;
+
+      const upgradedCipher = {
+        ...cipherWithOldAttachment,
+        hasOldAttachments: false,
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$
+        .mockReturnValueOnce(of([cipherWithOldAttachment]))
+        .mockReturnValueOnce(of([upgradedCipher]));
+      mockCipherService.upgradeOldCipherAttachments.mockResolvedValue(upgradedCipher);
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        expect.stringContaining("Found 1 ciphers with old attachments needing upgrade"),
+      );
+      expect(mockLogService.info).toHaveBeenCalledWith(
+        expect.stringContaining("Successfully upgraded 1 ciphers with old attachments"),
+      );
+    });
+
+    it("does not upgrade when ciphers have no old attachments", async () => {
+      const cipherWithoutOldAttachment = {
+        id: "cipher-1",
+        name: "Cipher 1",
+        hasOldAttachments: false,
+      } as unknown as CipherView;
+
+      mockCipherService.cipherViews$.mockReturnValue(of([cipherWithoutOldAttachment]));
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.transferPersonalItems(userId, organizationId, collectionId);
+
+      expect(mockCipherService.upgradeOldCipherAttachments).not.toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).toHaveBeenCalled();
+    });
+  });
+
+  describe("enforceOrganizationDataOwnership", () => {
+    const policy = {
+      organizationId: organizationId,
+      revisionDate: new Date("2024-01-01"),
+    } as Policy;
+    const organization = {
+      id: organizationId,
+      name: "Test Org",
+    } as Organization;
+
+    function setupMocksForEnforcementScenario(options: {
+      featureEnabled?: boolean;
+      policies?: Policy[];
+      organizations?: Organization[];
+      ciphers?: CipherView[];
+      collections?: CollectionView[];
+    }): void {
+      mockConfigService.getFeatureFlag.mockResolvedValue(options.featureEnabled ?? true);
+      mockPolicyService.policiesByType$.mockReturnValue(of(options.policies ?? []));
+      mockOrganizationService.organizations$.mockReturnValue(of(options.organizations ?? []));
+      mockCipherService.cipherViews$.mockReturnValue(of(options.ciphers ?? []));
+      mockCollectionService.decryptedCollections$.mockReturnValue(of(options.collections ?? []));
+    }
+
+    it("does nothing when feature flag is disabled", async () => {
+      setupMocksForEnforcementScenario({
+        featureEnabled: false,
+        policies: [policy],
+        organizations: [organization],
+        ciphers: [{ id: "cipher-1" } as CipherView],
+        collections: [
+          {
+            id: collectionId,
+            organizationId: organizationId,
+            isDefaultCollection: true,
+          } as CollectionView,
+        ],
+      });
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockConfigService.getFeatureFlag).toHaveBeenCalledWith(
+        FeatureFlag.MigrateMyVaultToMyItems,
+      );
+      expect(mockDialogService.openSimpleDialog).not.toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("does nothing when no migration is required", async () => {
+      setupMocksForEnforcementScenario({ policies: [] });
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockDialogService.openSimpleDialog).not.toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("does nothing when user has no personal ciphers", async () => {
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: [],
+      });
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockDialogService.openSimpleDialog).not.toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("logs warning and returns when default collection is missing", async () => {
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: [{ id: "cipher-1" } as CipherView],
+        collections: [],
+      });
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockLogService.warning).toHaveBeenCalledWith(
+        "Default collection is missing for user during organization data ownership enforcement",
+      );
+      expect(mockDialogService.openSimpleDialog).not.toHaveBeenCalled();
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("shows confirmation dialog when migration is required", async () => {
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: [{ id: "cipher-1" } as CipherView],
+        collections: [
+          {
+            id: collectionId,
+            organizationId: organizationId,
+            isDefaultCollection: true,
+          } as CollectionView,
+        ],
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(false);
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockDialogService.openSimpleDialog).toHaveBeenCalledWith({
+        title: "Requires migration",
+        content: "Your vault requires migration of personal items to your organization.",
+        type: "warning",
+      });
+    });
+
+    it("does not transfer items when user declines confirmation", async () => {
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: [{ id: "cipher-1" } as CipherView],
+        collections: [
+          {
+            id: collectionId,
+            organizationId: organizationId,
+            isDefaultCollection: true,
+          } as CollectionView,
+        ],
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(false);
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockCipherService.shareManyWithServer).not.toHaveBeenCalled();
+    });
+
+    it("transfers items and shows success toast when user confirms", async () => {
+      const personalCiphers = [{ id: "cipher-1" } as CipherView];
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: personalCiphers,
+        collections: [
+          {
+            id: collectionId,
+            organizationId: organizationId,
+            isDefaultCollection: true,
+          } as CollectionView,
+        ],
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(true);
+      mockCipherService.shareManyWithServer.mockResolvedValue(undefined);
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockCipherService.shareManyWithServer).toHaveBeenCalledWith(
+        personalCiphers,
+        organizationId,
+        [collectionId],
+        userId,
+      );
+      expect(mockToastService.showToast).toHaveBeenCalledWith({
+        variant: "success",
+        message: "itemsTransferred",
+      });
+    });
+
+    it("shows error toast when transfer fails", async () => {
+      const personalCiphers = [{ id: "cipher-1" } as CipherView];
+      setupMocksForEnforcementScenario({
+        policies: [policy],
+        organizations: [organization],
+        ciphers: personalCiphers,
+        collections: [
+          {
+            id: collectionId,
+            organizationId: organizationId,
+            isDefaultCollection: true,
+          } as CollectionView,
+        ],
+      });
+      mockDialogService.openSimpleDialog.mockResolvedValue(true);
+      mockCipherService.shareManyWithServer.mockRejectedValue(new Error("Transfer failed"));
+
+      await service.enforceOrganizationDataOwnership(userId);
+
+      expect(mockLogService.error).toHaveBeenCalledWith(
+        "Error transferring personal items to organization",
+        expect.any(Error),
+      );
+      expect(mockToastService.showToast).toHaveBeenCalledWith({
+        variant: "error",
+        message: "errorOccurred",
+      });
+    });
+  });
+});
diff --git a/libs/vault/src/services/default-vault-items-transfer.service.ts b/libs/vault/src/services/default-vault-items-transfer.service.ts
new file mode 100644
index 00000000000..d9c490f870e
--- /dev/null
+++ b/libs/vault/src/services/default-vault-items-transfer.service.ts
@@ -0,0 +1,231 @@
+import { Injectable } from "@angular/core";
+import { firstValueFrom, switchMap, map, of, Observable, combineLatest } from "rxjs";
+
+// eslint-disable-next-line no-restricted-imports
+import { CollectionService } from "@bitwarden/admin-console/common";
+import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
+import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { PolicyType } from "@bitwarden/common/admin-console/enums";
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { getById } from "@bitwarden/common/platform/misc";
+import { OrganizationId, CollectionId } from "@bitwarden/common/types/guid";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import { filterOutNullish } from "@bitwarden/common/vault/utils/observable-utilities";
+import { DialogService, ToastService } from "@bitwarden/components";
+import { LogService } from "@bitwarden/logging";
+import { UserId } from "@bitwarden/user-core";
+
+import {
+  VaultItemsTransferService,
+  UserMigrationInfo,
+} from "../abstractions/vault-items-transfer.service";
+
+@Injectable()
+export class DefaultVaultItemsTransferService implements VaultItemsTransferService {
+  constructor(
+    private cipherService: CipherService,
+    private policyService: PolicyService,
+    private organizationService: OrganizationService,
+    private collectionService: CollectionService,
+    private logService: LogService,
+    private i18nService: I18nService,
+    private dialogService: DialogService,
+    private toastService: ToastService,
+    private configService: ConfigService,
+  ) {}
+
+  private enforcingOrganization$(userId: UserId): Observable<Organization | undefined> {
+    return this.policyService.policiesByType$(PolicyType.OrganizationDataOwnership, userId).pipe(
+      map(
+        (policies) =>
+          policies.sort((a, b) => a.revisionDate.getTime() - b.revisionDate.getTime())?.[0],
+      ),
+      switchMap((policy) => {
+        if (policy == null) {
+          return of(undefined);
+        }
+        return this.organizationService.organizations$(userId).pipe(getById(policy.organizationId));
+      }),
+    );
+  }
+
+  private personalCiphers$(userId: UserId): Observable<CipherView[]> {
+    return this.cipherService.cipherViews$(userId).pipe(
+      filterOutNullish(),
+      map((ciphers) => ciphers.filter((c) => c.organizationId == null)),
+    );
+  }
+
+  private defaultUserCollection$(
+    userId: UserId,
+    organizationId: OrganizationId,
+  ): Observable<CollectionId | undefined> {
+    return this.collectionService.decryptedCollections$(userId).pipe(
+      map((collections) => {
+        return collections.find((c) => c.isDefaultCollection && c.organizationId === organizationId)
+          ?.id;
+      }),
+    );
+  }
+
+  userMigrationInfo$(userId: UserId): Observable<UserMigrationInfo> {
+    return this.enforcingOrganization$(userId).pipe(
+      switchMap((enforcingOrganization) => {
+        if (enforcingOrganization == null) {
+          return of<UserMigrationInfo>({
+            requiresMigration: false,
+          });
+        }
+        return combineLatest([
+          this.personalCiphers$(userId),
+          this.defaultUserCollection$(userId, enforcingOrganization.id),
+        ]).pipe(
+          map(([personalCiphers, defaultCollectionId]): UserMigrationInfo => {
+            return {
+              requiresMigration: personalCiphers.length > 0,
+              enforcingOrganization,
+              defaultCollectionId,
+            };
+          }),
+        );
+      }),
+    );
+  }
+
+  async enforceOrganizationDataOwnership(userId: UserId): Promise<void> {
+    const featureEnabled = await this.configService.getFeatureFlag(
+      FeatureFlag.MigrateMyVaultToMyItems,
+    );
+
+    if (!featureEnabled) {
+      return;
+    }
+
+    const migrationInfo = await firstValueFrom(this.userMigrationInfo$(userId));
+
+    if (!migrationInfo.requiresMigration) {
+      return;
+    }
+
+    if (migrationInfo.defaultCollectionId == null) {
+      // TODO: Handle creating the default collection if missing (to be handled by AC in future work)
+      this.logService.warning(
+        "Default collection is missing for user during organization data ownership enforcement",
+      );
+      return;
+    }
+
+    // Temporary confirmation dialog. Full implementation in PM-27663
+    const confirmMigration = await this.dialogService.openSimpleDialog({
+      title: "Requires migration",
+      content: "Your vault requires migration of personal items to your organization.",
+      type: "warning",
+    });
+
+    if (!confirmMigration) {
+      // TODO: Show secondary confirmation dialog in PM-27663, for now we just exit
+      // TODO: Revoke user from organization if they decline migration PM-29465
+      return;
+    }
+
+    try {
+      await this.transferPersonalItems(
+        userId,
+        migrationInfo.enforcingOrganization.id,
+        migrationInfo.defaultCollectionId,
+      );
+      this.toastService.showToast({
+        variant: "success",
+        message: this.i18nService.t("itemsTransferred"),
+      });
+    } catch (error) {
+      this.logService.error("Error transferring personal items to organization", error);
+      this.toastService.showToast({
+        variant: "error",
+        message: this.i18nService.t("errorOccurred"),
+      });
+    }
+  }
+
+  async transferPersonalItems(
+    userId: UserId,
+    organizationId: OrganizationId,
+    defaultCollectionId: CollectionId,
+  ): Promise<void> {
+    let personalCiphers = await firstValueFrom(this.personalCiphers$(userId));
+
+    if (personalCiphers.length === 0) {
+      return;
+    }
+
+    const oldAttachmentCiphers = personalCiphers.filter((c) => c.hasOldAttachments);
+
+    if (oldAttachmentCiphers.length > 0) {
+      await this.upgradeOldAttachments(oldAttachmentCiphers, userId, organizationId);
+      personalCiphers = await firstValueFrom(this.personalCiphers$(userId));
+
+      // Sanity check to ensure all old attachments were upgraded, though upgradeOldAttachments should throw if any fail
+      const remainingOldAttachments = personalCiphers.filter((c) => c.hasOldAttachments);
+      if (remainingOldAttachments.length > 0) {
+        throw new Error(
+          `Failed to upgrade all old attachments. ${remainingOldAttachments.length} ciphers still have old attachments.`,
+        );
+      }
+    }
+
+    this.logService.info(
+      `Starting transfer of ${personalCiphers.length} personal ciphers to organization ${organizationId} for user ${userId}`,
+    );
+
+    await this.cipherService.shareManyWithServer(
+      personalCiphers,
+      organizationId,
+      [defaultCollectionId],
+      userId,
+    );
+  }
+
+  /**
+   * Upgrades old attachments that don't have attachment keys.
+   * Throws an error if any attachment fails to upgrade as it is not possible to share with an organization without a key.
+   */
+  private async upgradeOldAttachments(
+    ciphers: CipherView[],
+    userId: UserId,
+    organizationId: OrganizationId,
+  ): Promise<void> {
+    this.logService.info(
+      `Found ${ciphers.length} ciphers with old attachments needing upgrade during transfer to organization ${organizationId} for user ${userId}`,
+    );
+
+    for (const cipher of ciphers) {
+      try {
+        if (!cipher.hasOldAttachments) {
+          continue;
+        }
+
+        const upgraded = await this.cipherService.upgradeOldCipherAttachments(cipher, userId);
+
+        if (upgraded.hasOldAttachments) {
+          this.logService.error(
+            `Attachment upgrade did not complete successfully for cipher ${cipher.id} during transfer to organization ${organizationId} for user ${userId}`,
+          );
+          throw new Error(`Failed to upgrade old attachments for cipher ${cipher.id}`);
+        }
+      } catch (e) {
+        this.logService.error(
+          `Failed to upgrade old attachments for cipher ${cipher.id} during transfer to organization ${organizationId} for user ${userId}: ${e}`,
+        );
+        throw new Error(`Failed to upgrade old attachments for cipher ${cipher.id}`);
+      }
+    }
+
+    this.logService.info(
+      `Successfully upgraded ${ciphers.length} ciphers with old attachments during transfer to organization ${organizationId} for user ${userId}`,
+    );
+  }
+}
diff --git a/package-lock.json b/package-lock.json
index 878e8b78f1b..dc8694f77b6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,8 +23,8 @@
         "@angular/platform-browser": "20.3.15",
         "@angular/platform-browser-dynamic": "20.3.15",
         "@angular/router": "20.3.15",
-        "@bitwarden/commercial-sdk-internal": "0.2.0-main.395",
-        "@bitwarden/sdk-internal": "0.2.0-main.395",
+        "@bitwarden/commercial-sdk-internal": "0.2.0-main.409",
+        "@bitwarden/sdk-internal": "0.2.0-main.409",
         "@electron/fuses": "1.8.0",
         "@emotion/css": "11.13.5",
         "@koa/multer": "4.0.0",
@@ -32,11 +32,11 @@
         "@microsoft/signalr": "8.0.7",
         "@microsoft/signalr-protocol-msgpack": "8.0.7",
         "@ng-select/ng-select": "20.7.0",
-        "@nx/devkit": "21.6.9",
-        "@nx/eslint": "21.6.9",
-        "@nx/jest": "21.6.9",
-        "@nx/js": "21.6.9",
-        "@nx/webpack": "21.6.9",
+        "@nx/devkit": "21.6.10",
+        "@nx/eslint": "21.6.10",
+        "@nx/jest": "21.6.10",
+        "@nx/js": "21.6.10",
+        "@nx/webpack": "21.6.10",
         "big-integer": "1.6.52",
         "braintree-web-drop-in": "1.46.0",
         "buffer": "6.0.3",
@@ -49,7 +49,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.3",
+        "koa": "3.1.1",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lit": "3.3.1",
@@ -60,7 +60,7 @@
         "node-fetch": "2.6.12",
         "node-forge": "1.3.2",
         "oidc-client-ts": "2.4.1",
-        "open": "10.1.2",
+        "open": "11.0.0",
         "papaparse": "5.5.3",
         "proper-lockfile": "4.1.2",
         "qrcode-parser": "2.1.3",
@@ -68,7 +68,7 @@
         "rxjs": "7.8.1",
         "semver": "7.7.3",
         "tabbable": "6.3.0",
-        "tldts": "7.0.18",
+        "tldts": "7.0.19",
         "ts-node": "10.9.2",
         "utf-8-validate": "6.0.5",
         "vite-tsconfig-paths": "5.1.4",
@@ -82,12 +82,12 @@
         "@angular/compiler-cli": "20.3.15",
         "@babel/core": "7.28.5",
         "@babel/preset-env": "7.28.5",
-        "@compodoc/compodoc": "1.1.26",
+        "@compodoc/compodoc": "1.1.32",
         "@electron/notarize": "3.0.1",
         "@electron/rebuild": "4.0.1",
         "@eslint/compat": "2.0.0",
-        "@lit-labs/signals": "0.1.2",
-        "@ngtools/webpack": "20.3.11",
+        "@lit-labs/signals": "0.1.3",
+        "@ngtools/webpack": "20.3.12",
         "@storybook/addon-a11y": "9.1.16",
         "@storybook/addon-designs": "9.0.0-next.3",
         "@storybook/addon-docs": "9.1.16",
@@ -102,14 +102,14 @@
         "@types/inquirer": "8.2.10",
         "@types/jest": "29.5.14",
         "@types/jsdom": "21.1.7",
-        "@types/koa": "3.0.0",
+        "@types/koa": "3.0.1",
         "@types/koa__multer": "2.0.7",
         "@types/koa__router": "12.0.4",
         "@types/koa-bodyparser": "4.3.7",
         "@types/koa-json": "2.0.23",
         "@types/lowdb": "1.0.15",
         "@types/lunr": "2.3.7",
-        "@types/node": "22.19.1",
+        "@types/node": "22.19.2",
         "@types/node-fetch": "2.6.4",
         "@types/node-forge": "1.3.14",
         "@types/papaparse": "5.5.0",
@@ -121,12 +121,12 @@
         "@webcomponents/custom-elements": "1.6.0",
         "@yao-pkg/pkg": "6.5.1",
         "angular-eslint": "20.7.0",
-        "autoprefixer": "10.4.21",
+        "autoprefixer": "10.4.22",
         "axe-playwright": "2.2.2",
         "babel-loader": "9.2.1",
         "base64-loader": "1.0.0",
-        "browserslist": "4.28.0",
-        "chromatic": "13.3.1",
+        "browserslist": "4.28.1",
+        "chromatic": "13.3.4",
         "concurrently": "9.2.0",
         "copy-webpack-plugin": "13.0.1",
         "cross-env": "10.1.0",
@@ -156,20 +156,20 @@
         "json5": "2.2.3",
         "lint-staged": "16.0.0",
         "mini-css-extract-plugin": "2.9.4",
-        "nx": "21.6.9",
+        "nx": "21.6.10",
         "path-browserify": "1.0.1",
         "postcss": "8.5.6",
         "postcss-loader": "8.2.0",
-        "prettier": "3.6.2",
-        "prettier-plugin-tailwindcss": "0.6.11",
+        "prettier": "3.7.3",
+        "prettier-plugin-tailwindcss": "0.7.1",
         "process": "0.11.10",
         "remark-gfm": "4.0.1",
-        "rimraf": "6.0.1",
-        "sass": "1.94.2",
+        "rimraf": "6.1.2",
+        "sass": "1.95.1",
         "sass-loader": "16.0.6",
         "storybook": "9.1.16",
         "style-loader": "4.0.0",
-        "tailwindcss": "3.4.17",
+        "tailwindcss": "3.4.18",
         "ts-jest": "29.4.5",
         "ts-loader": "9.5.4",
         "tsconfig-paths-webpack-plugin": "4.2.0",
@@ -211,7 +211,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.3",
+        "koa": "3.1.1",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lowdb": "1.0.0",
@@ -219,12 +219,12 @@
         "multer": "2.0.2",
         "node-fetch": "2.6.12",
         "node-forge": "1.3.2",
-        "open": "10.1.2",
+        "open": "11.0.0",
         "papaparse": "5.5.3",
         "proper-lockfile": "4.1.2",
         "rxjs": "7.8.1",
         "semver": "7.7.3",
-        "tldts": "7.0.18",
+        "tldts": "7.0.19",
         "zxcvbn": "4.4.2"
       },
       "bin": {
@@ -287,12 +287,211 @@
       "version": "0.1.0",
       "license": "GPL-3.0",
       "devDependencies": {
-        "@napi-rs/cli": "2.18.4"
+        "@napi-rs/cli": "3.2.0"
+      }
+    },
+    "apps/desktop/node_modules/@inquirer/confirm": {
+      "version": "5.1.21",
+      "resolved": "https://registry.npmjs.org/@inquirer/confirm/-/confirm-5.1.21.tgz",
+      "integrity": "sha512-KR8edRkIsUayMXV+o3Gv+q4jlhENF9nMYUZs9PA2HzrXeHI8M5uDag70U7RJn9yyiMZSbtF5/UexBtAVtZGSbQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@inquirer/core": "^10.3.2",
+        "@inquirer/type": "^3.0.10"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@types/node": ">=18"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
+      }
+    },
+    "apps/desktop/node_modules/@inquirer/prompts": {
+      "version": "7.10.1",
+      "resolved": "https://registry.npmjs.org/@inquirer/prompts/-/prompts-7.10.1.tgz",
+      "integrity": "sha512-Dx/y9bCQcXLI5ooQ5KyvA4FTgeo2jYj/7plWfV5Ak5wDPKQZgudKez2ixyfz7tKXzcJciTxqLeK7R9HItwiByg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@inquirer/checkbox": "^4.3.2",
+        "@inquirer/confirm": "^5.1.21",
+        "@inquirer/editor": "^4.2.23",
+        "@inquirer/expand": "^4.0.23",
+        "@inquirer/input": "^4.3.1",
+        "@inquirer/number": "^3.0.23",
+        "@inquirer/password": "^4.0.23",
+        "@inquirer/rawlist": "^4.1.11",
+        "@inquirer/search": "^3.2.2",
+        "@inquirer/select": "^4.4.2"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@types/node": ">=18"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
+      }
+    },
+    "apps/desktop/node_modules/@napi-rs/cli": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/cli/-/cli-3.2.0.tgz",
+      "integrity": "sha512-heyXt/9OBPv/WrTFW2+PxIMzH6MCeqP9ZsvOg0LN6pLngBnszcxFsdhCAh5I6sddzQsvru53zj59GUzvmpWk8Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@inquirer/prompts": "^7.8.4",
+        "@napi-rs/cross-toolchain": "^1.0.3",
+        "@napi-rs/wasm-tools": "^1.0.1",
+        "@octokit/rest": "^22.0.0",
+        "clipanion": "^4.0.0-rc.4",
+        "colorette": "^2.0.20",
+        "debug": "^4.4.1",
+        "emnapi": "^1.5.0",
+        "es-toolkit": "^1.39.10",
+        "find-up": "^7.0.0",
+        "js-yaml": "^4.1.0",
+        "semver": "^7.7.2",
+        "typanion": "^3.14.0"
+      },
+      "bin": {
+        "napi": "dist/cli.js",
+        "napi-raw": "cli.mjs"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/runtime": "^1.1.0",
+        "emnapi": "^1.1.0"
+      },
+      "peerDependenciesMeta": {
+        "@emnapi/runtime": {
+          "optional": true
+        },
+        "emnapi": {
+          "optional": true
+        }
+      }
+    },
+    "apps/desktop/node_modules/find-up": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-7.0.0.tgz",
+      "integrity": "sha512-YyZM99iHrqLKjmt4LJDj58KI+fYyufRLBSYcqycxf//KpBk9FoewoGX0450m9nB44qrZnovzC2oeP5hUibxc/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^7.2.0",
+        "path-exists": "^5.0.0",
+        "unicorn-magic": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "apps/desktop/node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "apps/desktop/node_modules/locate-path": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
+      "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^6.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "apps/desktop/node_modules/p-limit": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
+      "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^1.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "apps/desktop/node_modules/p-locate": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
+      "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "apps/desktop/node_modules/path-exists": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
+      "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      }
+    },
+    "apps/desktop/node_modules/yocto-queue": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",
+      "integrity": "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "apps/web": {
       "name": "@bitwarden/web-vault",
-      "version": "2025.12.1"
+      "version": "2025.12.0"
     },
     "libs/admin-console": {
       "name": "@bitwarden/admin-console",
@@ -1029,23 +1228,6 @@
         "semver": "bin/semver.js"
       }
     },
-    "node_modules/@angular-devkit/build-angular/node_modules/@ngtools/webpack": {
-      "version": "20.3.12",
-      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-20.3.12.tgz",
-      "integrity": "sha512-ePuofHOtbgvEq2t+hcmL30s4q9HQ/nv9ABwpLiELdVIObcWUnrnizAvM7hujve/9CQL6gRCeEkxPLPS4ZrK9AQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0",
-        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
-        "yarn": ">= 1.13.0"
-      },
-      "peerDependencies": {
-        "@angular/compiler-cli": "^20.0.0",
-        "typescript": ">=5.8 <6.0",
-        "webpack": "^5.54.0"
-      }
-    },
     "node_modules/@angular-devkit/build-angular/node_modules/ansi-regex": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
@@ -1059,6 +1241,44 @@
         "url": "https://github.com/chalk/ansi-regex?sponsor=1"
       }
     },
+    "node_modules/@angular-devkit/build-angular/node_modules/autoprefixer": {
+      "version": "10.4.21",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz",
+      "integrity": "sha512-O+A6LWV5LDHSJD3LjHYoNi4VLsj/Whi7k6zG12xTYaU4cQ8oxQGckXNX8cRHK5yOZ/ppVHe0ZBXGzSV9jXdVbQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/autoprefixer"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "browserslist": "^4.24.4",
+        "caniuse-lite": "^1.0.30001702",
+        "fraction.js": "^4.3.7",
+        "normalize-range": "^0.1.2",
+        "picocolors": "^1.1.1",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "bin": {
+        "autoprefixer": "bin/autoprefixer"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
     "node_modules/@angular-devkit/build-angular/node_modules/babel-loader": {
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-10.0.0.tgz",
@@ -1612,16 +1832,6 @@
         "tslib": "^2.1.0"
       }
     },
-    "node_modules/@angular-devkit/core/node_modules/source-map": {
-      "version": "0.7.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
-      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/@angular-devkit/schematics": {
       "version": "20.3.12",
       "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-20.3.12.tgz",
@@ -2206,6 +2416,30 @@
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
+    "node_modules/@angular/cdk/node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/@angular/cdk/node_modules/parse5": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.0.tgz",
+      "integrity": "sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==",
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
     "node_modules/@angular/cli": {
       "version": "20.3.12",
       "resolved": "https://registry.npmjs.org/@angular/cli/-/cli-20.3.12.tgz",
@@ -2720,6 +2954,16 @@
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
+    "node_modules/@arr/every": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@arr/every/-/every-1.0.1.tgz",
+      "integrity": "sha512-UQFQ6SgyJ6LX42W8rHCs8KVc0JS0tzVL9ct4XYedJukskYVWTo49tNiMEK9C2HTyarbNiT/RVIRSY82vH+6sTg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/@asamuzakjp/css-color": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
@@ -2827,7 +3071,6 @@
       "version": "7.28.3",
       "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.28.3.tgz",
       "integrity": "sha512-3lSpxGgvnmZznmBkCRnVREPUFJv2wrv9iAoFDvADJc0ypmdOxdUtcLeBgBJ6zE0PMeTKnxeQzyk0xTBq4Ep7zw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.28.3",
@@ -4615,9 +4858,9 @@
       "link": true
     },
     "node_modules/@bitwarden/commercial-sdk-internal": {
-      "version": "0.2.0-main.395",
-      "resolved": "https://registry.npmjs.org/@bitwarden/commercial-sdk-internal/-/commercial-sdk-internal-0.2.0-main.395.tgz",
-      "integrity": "sha512-DrxL3iA29hzWpyxPyZjiXx0m+EHOgk4CVb+BAi2SoxsacmyHYuTgXuASFMieRz2rv85wS3UR0N64Ok9lC+xNYA==",
+      "version": "0.2.0-main.409",
+      "resolved": "https://registry.npmjs.org/@bitwarden/commercial-sdk-internal/-/commercial-sdk-internal-0.2.0-main.409.tgz",
+      "integrity": "sha512-86AVuOG5S9Te9ZMvozCV1FN8v98ROnUwr24nTeocqD/5OJIKoWWXk1t+g4YoVF+8AItpD6hFfO/uL05mG80jDA==",
       "license": "BITWARDEN SOFTWARE DEVELOPMENT KIT LICENSE AGREEMENT",
       "dependencies": {
         "type-fest": "^4.41.0"
@@ -4720,9 +4963,9 @@
       "link": true
     },
     "node_modules/@bitwarden/sdk-internal": {
-      "version": "0.2.0-main.395",
-      "resolved": "https://registry.npmjs.org/@bitwarden/sdk-internal/-/sdk-internal-0.2.0-main.395.tgz",
-      "integrity": "sha512-biExeL2Grp11VQjjK6QM16+WOYk87mTgUhYKFm+Bu/A0zZBzhL/6AocpA9h2T5M8rLCGVVJVUMaXUW3YrSTqEA==",
+      "version": "0.2.0-main.409",
+      "resolved": "https://registry.npmjs.org/@bitwarden/sdk-internal/-/sdk-internal-0.2.0-main.409.tgz",
+      "integrity": "sha512-3e3hZenNos1xACJ2Bsq14RrzCnWdIilJuJhFwZYQBI6PQ+R38UGGQhGJDandKvQggfR8bDCY3re8x8n9G7MDiA==",
       "license": "GPL-3.0",
       "dependencies": {
         "type-fest": "^4.41.0"
@@ -4847,34 +5090,36 @@
       "license": "(Apache-2.0 AND BSD-3-Clause)"
     },
     "node_modules/@compodoc/compodoc": {
-      "version": "1.1.26",
-      "resolved": "https://registry.npmjs.org/@compodoc/compodoc/-/compodoc-1.1.26.tgz",
-      "integrity": "sha512-CJkqTtdotxMA4SDyUx8J6Mrm3MMmcgFtfEViUnG9Of2CXhYiXIqNeD881+pxn0opmMC+VCTL0/SCD03tDYhWYA==",
+      "version": "1.1.32",
+      "resolved": "https://registry.npmjs.org/@compodoc/compodoc/-/compodoc-1.1.32.tgz",
+      "integrity": "sha512-kaYk5+o4k7GB585iphwV5NE49BKKk8d+gJLNBE8eu2fIRdhnHOWblasRbOBRULfwJ+qxfmgrIqi32K34wCag6A==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/schematics": "18.2.8",
-        "@babel/core": "7.25.8",
-        "@babel/plugin-transform-private-methods": "7.25.7",
-        "@babel/preset-env": "7.25.8",
+        "@angular-devkit/schematics": "20.3.4",
+        "@babel/core": "7.28.4",
+        "@babel/plugin-transform-private-methods": "7.27.1",
+        "@babel/preset-env": "7.28.3",
         "@compodoc/live-server": "^1.2.3",
         "@compodoc/ngd-transformer": "^2.1.3",
-        "bootstrap.native": "^5.0.13",
-        "cheerio": "1.0.0-rc.12",
-        "chokidar": "^4.0.1",
+        "@polka/send-type": "^0.5.2",
+        "body-parser": "^2.2.0",
+        "bootstrap.native": "^5.1.6",
+        "cheerio": "1.1.2",
+        "chokidar": "^4.0.3",
         "colors": "1.4.0",
-        "commander": "^12.1.0",
+        "commander": "^14.0.1",
         "cosmiconfig": "^9.0.0",
         "decache": "^4.6.2",
         "es6-shim": "^0.35.8",
         "fancy-log": "^2.0.0",
-        "fast-glob": "^3.3.2",
-        "fs-extra": "^11.2.0",
-        "glob": "^11.0.0",
+        "fast-glob": "^3.3.3",
+        "fs-extra": "^11.3.2",
+        "glob": "^11.0.3",
         "handlebars": "^4.7.8",
-        "html-entities": "^2.5.2",
-        "i18next": "^23.16.0",
+        "html-entities": "^2.6.0",
+        "i18next": "25.5.3",
         "json5": "^2.2.3",
         "lodash": "^4.17.21",
         "loglevel": "^1.9.2",
@@ -4885,62 +5130,45 @@
         "neotraverse": "^0.6.18",
         "opencollective-postinstall": "^2.0.3",
         "os-name": "4.0.1",
-        "picocolors": "^1.1.0",
-        "prismjs": "^1.29.0",
-        "semver": "^7.6.3",
-        "svg-pan-zoom": "^3.6.1",
-        "tablesort": "^5.3.0",
-        "ts-morph": "^24.0.0",
-        "uuid": "^10.0.0",
-        "vis": "^4.21.0-EOL"
+        "picocolors": "^1.1.1",
+        "polka": "^0.5.2",
+        "prismjs": "^1.30.0",
+        "semver": "^7.7.2",
+        "sirv": "^3.0.2",
+        "svg-pan-zoom": "^3.6.2",
+        "tablesort": "^5.6.0",
+        "ts-morph": "^27.0.0",
+        "uuid": "11.1.0",
+        "vis-network": "^10.0.2"
       },
       "bin": {
         "compodoc": "bin/index-cli.js"
       },
       "engines": {
-        "node": ">= 16.0.0"
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics": {
-      "version": "18.2.8",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-18.2.8.tgz",
-      "integrity": "sha512-i/h2Oji5FhJMC7wDSnIl5XUe/qym+C1ZwScaATJwDyRLCUIynZkj5rLgdG/uK6l+H0PgvxigkF+akWpokkwW6w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@angular-devkit/core": "18.2.8",
-        "jsonc-parser": "3.3.1",
-        "magic-string": "0.30.11",
-        "ora": "5.4.1",
-        "rxjs": "7.8.1"
-      },
-      "engines": {
-        "node": "^18.19.1 || ^20.11.1 || >=22.0.0",
-        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
-        "yarn": ">= 1.13.0"
-      }
-    },
-    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics/node_modules/@angular-devkit/core": {
-      "version": "18.2.8",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-18.2.8.tgz",
-      "integrity": "sha512-4o2T6wsmXGE/v53+F8L7kGoN2+qzt03C9rtjLVQpOljzpJVttQ8bhvfWxyYLWwcl04RWqRa+82fpIZtBkOlZJw==",
+    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/core": {
+      "version": "20.3.4",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-20.3.4.tgz",
+      "integrity": "sha512-r83jn9yVdPh618oGgoKPggMsQGOkQqJbxEutd4CE9mnotPCE2uRTIyaFMh8sohNUeoQNRmj9rbr2pWGVlgERpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "ajv": "8.17.1",
         "ajv-formats": "3.0.1",
         "jsonc-parser": "3.3.1",
-        "picomatch": "4.0.2",
-        "rxjs": "7.8.1",
-        "source-map": "0.7.4"
+        "picomatch": "4.0.3",
+        "rxjs": "7.8.2",
+        "source-map": "0.7.6"
       },
       "engines": {
-        "node": "^18.19.1 || ^20.11.1 || >=22.0.0",
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0",
         "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
         "yarn": ">= 1.13.0"
       },
       "peerDependencies": {
-        "chokidar": "^3.5.2"
+        "chokidar": "^4.0.0"
       },
       "peerDependenciesMeta": {
         "chokidar": {
@@ -4948,50 +5176,42 @@
         }
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics/node_modules/chokidar": {
-      "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
+    "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics": {
+      "version": "20.3.4",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-20.3.4.tgz",
+      "integrity": "sha512-JYlcmVBKNT9+cQ6T2tmu+yVQ2bJk8tG0mXvPHWXrl/M4c6NObhSSThK50tJHy0Xo3gl8WgogOxUeJNnBq67cIQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "peer": true,
       "dependencies": {
-        "anymatch": "~3.1.2",
-        "braces": "~3.0.2",
-        "glob-parent": "~5.1.2",
-        "is-binary-path": "~2.1.0",
-        "is-glob": "~4.0.1",
-        "normalize-path": "~3.0.0",
-        "readdirp": "~3.6.0"
+        "@angular-devkit/core": "20.3.4",
+        "jsonc-parser": "3.3.1",
+        "magic-string": "0.30.17",
+        "ora": "8.2.0",
+        "rxjs": "7.8.2"
       },
       "engines": {
-        "node": ">= 8.10.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.2"
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0",
+        "npm": "^6.11.0 || ^7.5.6 || >=8.0.0",
+        "yarn": ">= 1.13.0"
       }
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/core": {
-      "version": "7.25.8",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.25.8.tgz",
-      "integrity": "sha512-Oixnb+DzmRT30qu9d3tJSQkxuygWm32DFykT4bRoORPa9hZ/L4KhVB/XiRm6KG+roIEM7DBQlmg27kw2HZkdZg==",
+      "version": "7.28.4",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.4.tgz",
+      "integrity": "sha512-2BCOP7TN8M+gVDj7/ht3hsaO/B/n5oDbiAyyvnRlNOs+u1o+JWNYTQrmpuNp1/Wq2gcFrI01JAW+paEKDMx/CA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@ampproject/remapping": "^2.2.0",
-        "@babel/code-frame": "^7.25.7",
-        "@babel/generator": "^7.25.7",
-        "@babel/helper-compilation-targets": "^7.25.7",
-        "@babel/helper-module-transforms": "^7.25.7",
-        "@babel/helpers": "^7.25.7",
-        "@babel/parser": "^7.25.8",
-        "@babel/template": "^7.25.7",
-        "@babel/traverse": "^7.25.7",
-        "@babel/types": "^7.25.8",
+        "@babel/code-frame": "^7.27.1",
+        "@babel/generator": "^7.28.3",
+        "@babel/helper-compilation-targets": "^7.27.2",
+        "@babel/helper-module-transforms": "^7.28.3",
+        "@babel/helpers": "^7.28.4",
+        "@babel/parser": "^7.28.4",
+        "@babel/template": "^7.27.2",
+        "@babel/traverse": "^7.28.4",
+        "@babel/types": "^7.28.4",
+        "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
         "gensync": "^1.0.0-beta.2",
@@ -5016,97 +5236,82 @@
         "semver": "bin/semver.js"
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/@babel/plugin-transform-private-methods": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.25.7.tgz",
-      "integrity": "sha512-KY0hh2FluNxMLwOCHbxVOKfdB5sjWG4M183885FmaqWWiGMhRZq4DQRKH6mHdEucbJnyDyYiZNwNG424RymJjA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-create-class-features-plugin": "^7.25.7",
-        "@babel/helper-plugin-utils": "^7.25.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
     "node_modules/@compodoc/compodoc/node_modules/@babel/preset-env": {
-      "version": "7.25.8",
-      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.25.8.tgz",
-      "integrity": "sha512-58T2yulDHMN8YMUxiLq5YmWUnlDCyY1FsHM+v12VMx+1/FlrUj5tY50iDCpofFQEM8fMYOaY9YRvym2jcjn1Dg==",
+      "version": "7.28.3",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.28.3.tgz",
+      "integrity": "sha512-ROiDcM+GbYVPYBOeCR6uBXKkQpBExLl8k9HO1ygXEyds39j+vCCsjmj7S8GOniZQlEs81QlkdJZe76IpLSiqpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.25.8",
-        "@babel/helper-compilation-targets": "^7.25.7",
-        "@babel/helper-plugin-utils": "^7.25.7",
-        "@babel/helper-validator-option": "^7.25.7",
-        "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.25.7",
-        "@babel/plugin-bugfix-safari-class-field-initializer-scope": "^7.25.7",
-        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.25.7",
-        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.25.7",
-        "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.25.7",
+        "@babel/compat-data": "^7.28.0",
+        "@babel/helper-compilation-targets": "^7.27.2",
+        "@babel/helper-plugin-utils": "^7.27.1",
+        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.27.1",
+        "@babel/plugin-bugfix-safari-class-field-initializer-scope": "^7.27.1",
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.27.1",
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.27.1",
+        "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.28.3",
         "@babel/plugin-proposal-private-property-in-object": "7.21.0-placeholder-for-preset-env.2",
-        "@babel/plugin-syntax-import-assertions": "^7.25.7",
-        "@babel/plugin-syntax-import-attributes": "^7.25.7",
+        "@babel/plugin-syntax-import-assertions": "^7.27.1",
+        "@babel/plugin-syntax-import-attributes": "^7.27.1",
         "@babel/plugin-syntax-unicode-sets-regex": "^7.18.6",
-        "@babel/plugin-transform-arrow-functions": "^7.25.7",
-        "@babel/plugin-transform-async-generator-functions": "^7.25.8",
-        "@babel/plugin-transform-async-to-generator": "^7.25.7",
-        "@babel/plugin-transform-block-scoped-functions": "^7.25.7",
-        "@babel/plugin-transform-block-scoping": "^7.25.7",
-        "@babel/plugin-transform-class-properties": "^7.25.7",
-        "@babel/plugin-transform-class-static-block": "^7.25.8",
-        "@babel/plugin-transform-classes": "^7.25.7",
-        "@babel/plugin-transform-computed-properties": "^7.25.7",
-        "@babel/plugin-transform-destructuring": "^7.25.7",
-        "@babel/plugin-transform-dotall-regex": "^7.25.7",
-        "@babel/plugin-transform-duplicate-keys": "^7.25.7",
-        "@babel/plugin-transform-duplicate-named-capturing-groups-regex": "^7.25.7",
-        "@babel/plugin-transform-dynamic-import": "^7.25.8",
-        "@babel/plugin-transform-exponentiation-operator": "^7.25.7",
-        "@babel/plugin-transform-export-namespace-from": "^7.25.8",
-        "@babel/plugin-transform-for-of": "^7.25.7",
-        "@babel/plugin-transform-function-name": "^7.25.7",
-        "@babel/plugin-transform-json-strings": "^7.25.8",
-        "@babel/plugin-transform-literals": "^7.25.7",
-        "@babel/plugin-transform-logical-assignment-operators": "^7.25.8",
-        "@babel/plugin-transform-member-expression-literals": "^7.25.7",
-        "@babel/plugin-transform-modules-amd": "^7.25.7",
-        "@babel/plugin-transform-modules-commonjs": "^7.25.7",
-        "@babel/plugin-transform-modules-systemjs": "^7.25.7",
-        "@babel/plugin-transform-modules-umd": "^7.25.7",
-        "@babel/plugin-transform-named-capturing-groups-regex": "^7.25.7",
-        "@babel/plugin-transform-new-target": "^7.25.7",
-        "@babel/plugin-transform-nullish-coalescing-operator": "^7.25.8",
-        "@babel/plugin-transform-numeric-separator": "^7.25.8",
-        "@babel/plugin-transform-object-rest-spread": "^7.25.8",
-        "@babel/plugin-transform-object-super": "^7.25.7",
-        "@babel/plugin-transform-optional-catch-binding": "^7.25.8",
-        "@babel/plugin-transform-optional-chaining": "^7.25.8",
-        "@babel/plugin-transform-parameters": "^7.25.7",
-        "@babel/plugin-transform-private-methods": "^7.25.7",
-        "@babel/plugin-transform-private-property-in-object": "^7.25.8",
-        "@babel/plugin-transform-property-literals": "^7.25.7",
-        "@babel/plugin-transform-regenerator": "^7.25.7",
-        "@babel/plugin-transform-reserved-words": "^7.25.7",
-        "@babel/plugin-transform-shorthand-properties": "^7.25.7",
-        "@babel/plugin-transform-spread": "^7.25.7",
-        "@babel/plugin-transform-sticky-regex": "^7.25.7",
-        "@babel/plugin-transform-template-literals": "^7.25.7",
-        "@babel/plugin-transform-typeof-symbol": "^7.25.7",
-        "@babel/plugin-transform-unicode-escapes": "^7.25.7",
-        "@babel/plugin-transform-unicode-property-regex": "^7.25.7",
-        "@babel/plugin-transform-unicode-regex": "^7.25.7",
-        "@babel/plugin-transform-unicode-sets-regex": "^7.25.7",
+        "@babel/plugin-transform-arrow-functions": "^7.27.1",
+        "@babel/plugin-transform-async-generator-functions": "^7.28.0",
+        "@babel/plugin-transform-async-to-generator": "^7.27.1",
+        "@babel/plugin-transform-block-scoped-functions": "^7.27.1",
+        "@babel/plugin-transform-block-scoping": "^7.28.0",
+        "@babel/plugin-transform-class-properties": "^7.27.1",
+        "@babel/plugin-transform-class-static-block": "^7.28.3",
+        "@babel/plugin-transform-classes": "^7.28.3",
+        "@babel/plugin-transform-computed-properties": "^7.27.1",
+        "@babel/plugin-transform-destructuring": "^7.28.0",
+        "@babel/plugin-transform-dotall-regex": "^7.27.1",
+        "@babel/plugin-transform-duplicate-keys": "^7.27.1",
+        "@babel/plugin-transform-duplicate-named-capturing-groups-regex": "^7.27.1",
+        "@babel/plugin-transform-dynamic-import": "^7.27.1",
+        "@babel/plugin-transform-explicit-resource-management": "^7.28.0",
+        "@babel/plugin-transform-exponentiation-operator": "^7.27.1",
+        "@babel/plugin-transform-export-namespace-from": "^7.27.1",
+        "@babel/plugin-transform-for-of": "^7.27.1",
+        "@babel/plugin-transform-function-name": "^7.27.1",
+        "@babel/plugin-transform-json-strings": "^7.27.1",
+        "@babel/plugin-transform-literals": "^7.27.1",
+        "@babel/plugin-transform-logical-assignment-operators": "^7.27.1",
+        "@babel/plugin-transform-member-expression-literals": "^7.27.1",
+        "@babel/plugin-transform-modules-amd": "^7.27.1",
+        "@babel/plugin-transform-modules-commonjs": "^7.27.1",
+        "@babel/plugin-transform-modules-systemjs": "^7.27.1",
+        "@babel/plugin-transform-modules-umd": "^7.27.1",
+        "@babel/plugin-transform-named-capturing-groups-regex": "^7.27.1",
+        "@babel/plugin-transform-new-target": "^7.27.1",
+        "@babel/plugin-transform-nullish-coalescing-operator": "^7.27.1",
+        "@babel/plugin-transform-numeric-separator": "^7.27.1",
+        "@babel/plugin-transform-object-rest-spread": "^7.28.0",
+        "@babel/plugin-transform-object-super": "^7.27.1",
+        "@babel/plugin-transform-optional-catch-binding": "^7.27.1",
+        "@babel/plugin-transform-optional-chaining": "^7.27.1",
+        "@babel/plugin-transform-parameters": "^7.27.7",
+        "@babel/plugin-transform-private-methods": "^7.27.1",
+        "@babel/plugin-transform-private-property-in-object": "^7.27.1",
+        "@babel/plugin-transform-property-literals": "^7.27.1",
+        "@babel/plugin-transform-regenerator": "^7.28.3",
+        "@babel/plugin-transform-regexp-modifiers": "^7.27.1",
+        "@babel/plugin-transform-reserved-words": "^7.27.1",
+        "@babel/plugin-transform-shorthand-properties": "^7.27.1",
+        "@babel/plugin-transform-spread": "^7.27.1",
+        "@babel/plugin-transform-sticky-regex": "^7.27.1",
+        "@babel/plugin-transform-template-literals": "^7.27.1",
+        "@babel/plugin-transform-typeof-symbol": "^7.27.1",
+        "@babel/plugin-transform-unicode-escapes": "^7.27.1",
+        "@babel/plugin-transform-unicode-property-regex": "^7.27.1",
+        "@babel/plugin-transform-unicode-regex": "^7.27.1",
+        "@babel/plugin-transform-unicode-sets-regex": "^7.27.1",
         "@babel/preset-modules": "0.1.6-no-external-plugins",
-        "babel-plugin-polyfill-corejs2": "^0.4.10",
-        "babel-plugin-polyfill-corejs3": "^0.10.6",
-        "babel-plugin-polyfill-regenerator": "^0.6.1",
-        "core-js-compat": "^3.38.1",
+        "babel-plugin-polyfill-corejs2": "^0.4.14",
+        "babel-plugin-polyfill-corejs3": "^0.13.0",
+        "babel-plugin-polyfill-regenerator": "^0.6.5",
+        "core-js-compat": "^3.43.0",
         "semver": "^6.3.1"
       },
       "engines": {
@@ -5126,28 +5331,69 @@
         "semver": "bin/semver.js"
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/babel-plugin-polyfill-corejs3": {
-      "version": "0.10.6",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.6.tgz",
-      "integrity": "sha512-b37+KR2i/khY5sKmWNVQAnitvquQbNdWy6lJdsr0kmquCKEEUgMKK4SboVM3HtfnZilfjr4MMQ7vY58FVWDtIA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-define-polyfill-provider": "^0.6.2",
-        "core-js-compat": "^3.38.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
-      }
-    },
-    "node_modules/@compodoc/compodoc/node_modules/commander": {
-      "version": "12.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
-      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
+    "node_modules/@compodoc/compodoc/node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/chalk": {
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
+      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.17.0 || ^14.13 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/cli-cursor": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
+      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "restore-cursor": "^5.0.0"
+      },
       "engines": {
         "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/cli-spinners": {
+      "version": "2.9.2",
+      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
+      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/commander": {
+      "version": "14.0.2",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.2.tgz",
+      "integrity": "sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
       }
     },
     "node_modules/@compodoc/compodoc/node_modules/convert-source-map": {
@@ -5157,61 +5403,183 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@compodoc/compodoc/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+    "node_modules/@compodoc/compodoc/node_modules/emoji-regex": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
+      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "peer": true,
+      "license": "MIT"
+    },
+    "node_modules/@compodoc/compodoc/node_modules/is-interactive": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-2.0.0.tgz",
+      "integrity": "sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/is-unicode-supported": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-2.1.0.tgz",
+      "integrity": "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/log-symbols": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-6.0.0.tgz",
+      "integrity": "sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "is-glob": "^4.0.1"
+        "chalk": "^5.3.0",
+        "is-unicode-supported": "^1.3.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/magic-string": {
-      "version": "0.30.11",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.11.tgz",
-      "integrity": "sha512-+Wri9p0QHMy+545hKww7YAu5NyzF8iomPL/RQazugQ9+Ez4Ic3mERMd8ZTX5rfK944j+560ZJi8iAwgak1Ac7A==",
+    "node_modules/@compodoc/compodoc/node_modules/log-symbols/node_modules/is-unicode-supported": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-1.3.0.tgz",
+      "integrity": "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/onetime": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
+      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0"
-      }
-    },
-    "node_modules/@compodoc/compodoc/node_modules/readdirp": {
-      "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "picomatch": "^2.2.1"
+        "mimic-function": "^5.0.0"
       },
       "engines": {
-        "node": ">=8.10.0"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@compodoc/compodoc/node_modules/readdirp/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+    "node_modules/@compodoc/compodoc/node_modules/ora": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/ora/-/ora-8.2.0.tgz",
+      "integrity": "sha512-weP+BZ8MVNnlCm8c0Qdc1WSWq4Qn7I+9CJGm7Qali6g44e/PUzbjNqJX5NJ9ljlNMosfJvg1fKEGILklK9cwnw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "peer": true,
+      "dependencies": {
+        "chalk": "^5.3.0",
+        "cli-cursor": "^5.0.0",
+        "cli-spinners": "^2.9.2",
+        "is-interactive": "^2.0.0",
+        "is-unicode-supported": "^2.0.0",
+        "log-symbols": "^6.0.0",
+        "stdin-discarder": "^0.2.2",
+        "string-width": "^7.2.0",
+        "strip-ansi": "^7.1.0"
+      },
       "engines": {
-        "node": ">=8.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/picomatch": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/@compodoc/compodoc/node_modules/restore-cursor": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
+      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "onetime": "^7.0.0",
+        "signal-exit": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/rxjs": {
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
+      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.1.0"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/string-width": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
+      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^10.3.0",
+        "get-east-asian-width": "^1.0.0",
+        "strip-ansi": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@compodoc/compodoc/node_modules/strip-ansi": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
+      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
     "node_modules/@compodoc/live-server": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/@compodoc/live-server/-/live-server-1.2.3.tgz",
@@ -5587,6 +5955,20 @@
         "node": ">=14.17.0"
       }
     },
+    "node_modules/@egjs/hammerjs": {
+      "version": "2.0.17",
+      "resolved": "https://registry.npmjs.org/@egjs/hammerjs/-/hammerjs-2.0.17.tgz",
+      "integrity": "sha512-XQsZgjm2EcVUiZQf11UBJQfmZeEmOW8DpI1gsFeln6w0ae0ii4dMQEQ0kjl6DspdWX1aGY1/loyXnP0JS06e/A==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@types/hammerjs": "^2.0.36"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
     "node_modules/@electron/asar": {
       "version": "3.2.18",
       "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-3.2.18.tgz",
@@ -5964,28 +6346,28 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.4.3.tgz",
-      "integrity": "sha512-4m62DuCE07lw01soJwPiBGC0nAww0Q+RY70VZ+n49yDIO13yyinhbWCeNnaob0lakDtWQzSdtNWzJeOJt2ma+g==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.7.1.tgz",
+      "integrity": "sha512-o1uhUASyo921r2XtHYOHy7gdkGLge8ghBEQHMWmyJFoXlpU58kIrhhN3w26lpQb6dspetweapMn2CSNwQ8I4wg==",
       "license": "MIT",
       "dependencies": {
-        "@emnapi/wasi-threads": "1.0.2",
+        "@emnapi/wasi-threads": "1.1.0",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.4.3.tgz",
-      "integrity": "sha512-pBPWdu6MLKROBX05wSNKcNb++m5Er+KQ9QkB+WVM+pW2Kx9hoSrVTnu3BdkI5eBLZoKu/J6mW/B6i6bJB2ytXQ==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.7.1.tgz",
+      "integrity": "sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.0.2.tgz",
-      "integrity": "sha512-5n3nTJblwRi8LlXkJ9eBzu+kZR8Yxcc7ubakyQTFzPMtIhFpUBRbsnc2Dv88IZDIbCDlBiWrknhB4Lsz7mg6BA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
+      "integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.4.0"
@@ -8228,9 +8610,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@lit-labs/signals": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@lit-labs/signals/-/signals-0.1.2.tgz",
-      "integrity": "sha512-hkOL0ua4ILeHlaJ8IqFKS+Y+dpYznWaDhdikzwt3zJ1/LPz3Etft4OPIMoltzbBJS5pyXPRseD/uWRlET3ImEA==",
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@lit-labs/signals/-/signals-0.1.3.tgz",
+      "integrity": "sha512-P0yWgH5blwVyEwBg+WFspLzeu1i0ypJP1QB0l1Omr9qZLIPsUu0p4Fy2jshOg7oQyha5n163K3GJGeUhQQ682Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -8633,21 +9015,411 @@
         "win32"
       ]
     },
-    "node_modules/@napi-rs/cli": {
-      "version": "2.18.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/cli/-/cli-2.18.4.tgz",
-      "integrity": "sha512-SgJeA4df9DE2iAEpr3M2H0OKl/yjtg1BnRI5/JyowS71tUWhrfSu2LT0V3vlHET+g1hBVlrO60PmEXwUEKp8Mg==",
+    "node_modules/@napi-rs/cross-toolchain": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/cross-toolchain/-/cross-toolchain-1.0.3.tgz",
+      "integrity": "sha512-ENPfLe4937bsKVTDA6zdABx4pq9w0tHqRrJHyaGxgaPq03a2Bd1unD5XSKjXJjebsABJ+MjAv1A2OvCgK9yehg==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "napi": "scripts/index.js"
+      "workspaces": [
+        ".",
+        "arm64/*",
+        "x64/*"
+      ],
+      "dependencies": {
+        "@napi-rs/lzma": "^1.4.5",
+        "@napi-rs/tar": "^1.1.0",
+        "debug": "^4.4.1"
       },
+      "peerDependencies": {
+        "@napi-rs/cross-toolchain-arm64-target-aarch64": "^1.0.3",
+        "@napi-rs/cross-toolchain-arm64-target-armv7": "^1.0.3",
+        "@napi-rs/cross-toolchain-arm64-target-ppc64le": "^1.0.3",
+        "@napi-rs/cross-toolchain-arm64-target-s390x": "^1.0.3",
+        "@napi-rs/cross-toolchain-arm64-target-x86_64": "^1.0.3",
+        "@napi-rs/cross-toolchain-x64-target-aarch64": "^1.0.3",
+        "@napi-rs/cross-toolchain-x64-target-armv7": "^1.0.3",
+        "@napi-rs/cross-toolchain-x64-target-ppc64le": "^1.0.3",
+        "@napi-rs/cross-toolchain-x64-target-s390x": "^1.0.3",
+        "@napi-rs/cross-toolchain-x64-target-x86_64": "^1.0.3"
+      },
+      "peerDependenciesMeta": {
+        "@napi-rs/cross-toolchain-arm64-target-aarch64": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-arm64-target-armv7": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-arm64-target-ppc64le": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-arm64-target-s390x": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-arm64-target-x86_64": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-x64-target-aarch64": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-x64-target-armv7": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-x64-target-ppc64le": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-x64-target-s390x": {
+          "optional": true
+        },
+        "@napi-rs/cross-toolchain-x64-target-x86_64": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@napi-rs/lzma": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma/-/lzma-1.4.5.tgz",
+      "integrity": "sha512-zS5LuN1OBPAyZpda2ZZgYOEDC+xecUdAGnrvbYzjnLXkrq/OBC3B9qcRvlxbDR3k5H/gVfvef1/jyUqPknqjbg==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">= 10"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/lzma-android-arm-eabi": "1.4.5",
+        "@napi-rs/lzma-android-arm64": "1.4.5",
+        "@napi-rs/lzma-darwin-arm64": "1.4.5",
+        "@napi-rs/lzma-darwin-x64": "1.4.5",
+        "@napi-rs/lzma-freebsd-x64": "1.4.5",
+        "@napi-rs/lzma-linux-arm-gnueabihf": "1.4.5",
+        "@napi-rs/lzma-linux-arm64-gnu": "1.4.5",
+        "@napi-rs/lzma-linux-arm64-musl": "1.4.5",
+        "@napi-rs/lzma-linux-ppc64-gnu": "1.4.5",
+        "@napi-rs/lzma-linux-riscv64-gnu": "1.4.5",
+        "@napi-rs/lzma-linux-s390x-gnu": "1.4.5",
+        "@napi-rs/lzma-linux-x64-gnu": "1.4.5",
+        "@napi-rs/lzma-linux-x64-musl": "1.4.5",
+        "@napi-rs/lzma-wasm32-wasi": "1.4.5",
+        "@napi-rs/lzma-win32-arm64-msvc": "1.4.5",
+        "@napi-rs/lzma-win32-ia32-msvc": "1.4.5",
+        "@napi-rs/lzma-win32-x64-msvc": "1.4.5"
+      }
+    },
+    "node_modules/@napi-rs/lzma-android-arm-eabi": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-android-arm-eabi/-/lzma-android-arm-eabi-1.4.5.tgz",
+      "integrity": "sha512-Up4gpyw2SacmyKWWEib06GhiDdF+H+CCU0LAV8pnM4aJIDqKKd5LHSlBht83Jut6frkB0vwEPmAkv4NjQ5u//Q==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-android-arm64": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-android-arm64/-/lzma-android-arm64-1.4.5.tgz",
+      "integrity": "sha512-uwa8sLlWEzkAM0MWyoZJg0JTD3BkPknvejAFG2acUA1raXM8jLrqujWCdOStisXhqQjZ2nDMp3FV6cs//zjfuQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-darwin-arm64": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-darwin-arm64/-/lzma-darwin-arm64-1.4.5.tgz",
+      "integrity": "sha512-0Y0TQLQ2xAjVabrMDem1NhIssOZzF/y/dqetc6OT8mD3xMTDtF8u5BqZoX3MyPc9FzpsZw4ksol+w7DsxHrpMA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-darwin-x64": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-darwin-x64/-/lzma-darwin-x64-1.4.5.tgz",
+      "integrity": "sha512-vR2IUyJY3En+V1wJkwmbGWcYiT8pHloTAWdW4pG24+51GIq+intst6Uf6D/r46citObGZrlX0QvMarOkQeHWpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-freebsd-x64": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-freebsd-x64/-/lzma-freebsd-x64-1.4.5.tgz",
+      "integrity": "sha512-XpnYQC5SVovO35tF0xGkbHYjsS6kqyNCjuaLQ2dbEblFRr5cAZVvsJ/9h7zj/5FluJPJRDojVNxGyRhTp4z2lw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-arm-gnueabihf": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-arm-gnueabihf/-/lzma-linux-arm-gnueabihf-1.4.5.tgz",
+      "integrity": "sha512-ic1ZZMoRfRMwtSwxkyw4zIlbDZGC6davC9r+2oX6x9QiF247BRqqT94qGeL5ZP4Vtz0Hyy7TEViWhx5j6Bpzvw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-arm64-gnu": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-arm64-gnu/-/lzma-linux-arm64-gnu-1.4.5.tgz",
+      "integrity": "sha512-asEp7FPd7C1Yi6DQb45a3KPHKOFBSfGuJWXcAd4/bL2Fjetb2n/KK2z14yfW8YC/Fv6x3rBM0VAZKmJuz4tysg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-arm64-musl": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-arm64-musl/-/lzma-linux-arm64-musl-1.4.5.tgz",
+      "integrity": "sha512-yWjcPDgJ2nIL3KNvi4536dlT/CcCWO0DUyEOlBs/SacG7BeD6IjGh6yYzd3/X1Y3JItCbZoDoLUH8iB1lTXo3w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-ppc64-gnu": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-ppc64-gnu/-/lzma-linux-ppc64-gnu-1.4.5.tgz",
+      "integrity": "sha512-0XRhKuIU/9ZjT4WDIG/qnX7Xz7mSQHYZo9Gb3MP2gcvBgr6BA4zywQ9k3gmQaPn9ECE+CZg2V7DV7kT+x2pUMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-riscv64-gnu": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-riscv64-gnu/-/lzma-linux-riscv64-gnu-1.4.5.tgz",
+      "integrity": "sha512-QrqDIPEUUB23GCpyQj/QFyMlr8SGxxyExeZz9OWFnHfb70kXdTLWrHS/hEI1Ru+lSbQ/6xRqeoGyQ4Aqdg+/RA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-s390x-gnu": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-s390x-gnu/-/lzma-linux-s390x-gnu-1.4.5.tgz",
+      "integrity": "sha512-k8RVM5aMhW86E9H0QXdquwojew4H3SwPxbRVbl49/COJQWCUjGi79X6mYruMnMPEznZinUiT1jgKbFo2A00NdA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-x64-gnu": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-x64-gnu/-/lzma-linux-x64-gnu-1.4.5.tgz",
+      "integrity": "sha512-6rMtBgnIq2Wcl1rQdZsnM+rtCcVCbws1nF8S2NzaUsVaZv8bjrPiAa0lwg4Eqnn1d9lgwqT+cZgm5m+//K08Kw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-linux-x64-musl": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-x64-musl/-/lzma-linux-x64-musl-1.4.5.tgz",
+      "integrity": "sha512-eiadGBKi7Vd0bCArBUOO/qqRYPHt/VQVvGyYvDFt6C2ZSIjlD+HuOl+2oS1sjf4CFjK4eDIog6EdXnL0NE6iyQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-wasm32-wasi": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-wasm32-wasi/-/lzma-wasm32-wasi-1.4.5.tgz",
+      "integrity": "sha512-+VyHHlr68dvey6fXc2hehw9gHVFIW3TtGF1XkcbAu65qVXsA9D/T+uuoRVqhE+JCyFHFrO0ixRbZDRK1XJt1sA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@napi-rs/wasm-runtime": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@napi-rs/lzma-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.0.tgz",
+      "integrity": "sha512-Fq6DJW+Bb5jaWE69/qOE0D1TUN9+6uWhCeZpdnSBk14pjLcCWR7Q8n49PTSPHazM37JqrsdpEthXy2xn6jWWiA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      }
+    },
+    "node_modules/@napi-rs/lzma-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
+      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@napi-rs/lzma-win32-arm64-msvc": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-win32-arm64-msvc/-/lzma-win32-arm64-msvc-1.4.5.tgz",
+      "integrity": "sha512-eewnqvIyyhHi3KaZtBOJXohLvwwN27gfS2G/YDWdfHlbz1jrmfeHAmzMsP5qv8vGB+T80TMHNkro4kYjeh6Deg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-win32-ia32-msvc": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-win32-ia32-msvc/-/lzma-win32-ia32-msvc-1.4.5.tgz",
+      "integrity": "sha512-OeacFVRCJOKNU/a0ephUfYZ2Yt+NvaHze/4TgOwJ0J0P4P7X1mHzN+ig9Iyd74aQDXYqc7kaCXA2dpAOcH87Cg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/lzma-win32-x64-msvc": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-win32-x64-msvc/-/lzma-win32-x64-msvc-1.4.5.tgz",
+      "integrity": "sha512-T4I1SamdSmtyZgDXGAGP+y5LEK5vxHUFwe8mz6D4R7Sa5/WCxTcCIgPJ9BD7RkpO17lzhlaM2vmVvMy96Lvk9Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
       }
     },
     "node_modules/@napi-rs/nice": {
@@ -8973,6 +9745,330 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@napi-rs/tar": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar/-/tar-1.1.0.tgz",
+      "integrity": "sha512-7cmzIu+Vbupriudo7UudoMRH2OA3cTw67vva8MxeoAe5S7vPFI7z0vp0pMXiA25S8IUJefImQ90FeJjl8fjEaQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      },
+      "optionalDependencies": {
+        "@napi-rs/tar-android-arm-eabi": "1.1.0",
+        "@napi-rs/tar-android-arm64": "1.1.0",
+        "@napi-rs/tar-darwin-arm64": "1.1.0",
+        "@napi-rs/tar-darwin-x64": "1.1.0",
+        "@napi-rs/tar-freebsd-x64": "1.1.0",
+        "@napi-rs/tar-linux-arm-gnueabihf": "1.1.0",
+        "@napi-rs/tar-linux-arm64-gnu": "1.1.0",
+        "@napi-rs/tar-linux-arm64-musl": "1.1.0",
+        "@napi-rs/tar-linux-ppc64-gnu": "1.1.0",
+        "@napi-rs/tar-linux-s390x-gnu": "1.1.0",
+        "@napi-rs/tar-linux-x64-gnu": "1.1.0",
+        "@napi-rs/tar-linux-x64-musl": "1.1.0",
+        "@napi-rs/tar-wasm32-wasi": "1.1.0",
+        "@napi-rs/tar-win32-arm64-msvc": "1.1.0",
+        "@napi-rs/tar-win32-ia32-msvc": "1.1.0",
+        "@napi-rs/tar-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "node_modules/@napi-rs/tar-android-arm-eabi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-android-arm-eabi/-/tar-android-arm-eabi-1.1.0.tgz",
+      "integrity": "sha512-h2Ryndraj/YiKgMV/r5by1cDusluYIRT0CaE0/PekQ4u+Wpy2iUVqvzVU98ZPnhXaNeYxEvVJHNGafpOfaD0TA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-android-arm64/-/tar-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-DJFyQHr1ZxNZorm/gzc1qBNLF/FcKzcH0V0Vwan5P+o0aE2keQIGEjJ09FudkF9v6uOuJjHCVDdK6S6uHtShAw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-darwin-arm64/-/tar-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-Zz2sXRzjIX4e532zD6xm2SjXEym6MkvfCvL2RMpG2+UwNVDVscHNcz3d47Pf3sysP2e2af7fBB3TIoK2f6trPw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-darwin-x64/-/tar-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-EI+CptIMNweT0ms9S3mkP/q+J6FNZ1Q6pvpJOEcWglRfyfQpLqjlC0O+dptruTPE8VamKYuqdjxfqD8hifZDOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-freebsd-x64/-/tar-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-J0PIqX+pl6lBIAckL/c87gpodLbjZB1OtIK+RDscKC9NLdpVv6VGOxzUV/fYev/hctcE8EfkLbgFOfpmVQPg2g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-arm-gnueabihf/-/tar-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-SLgIQo3f3EjkZ82ZwvrEgFvMdDAhsxCYjyoSuWfHCz0U16qx3SuGCp8+FYOPYCECHN3ZlGjXnoAIt9ERd0dEUg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-arm64-gnu/-/tar-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-d014cdle52EGaH6GpYTQOP9Py7glMO1zz/+ynJPjjzYFSxvdYx0byrjumZk2UQdIyGZiJO2MEFpCkEEKFSgPYA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-arm64-musl/-/tar-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-L/y1/26q9L/uBqiW/JdOb/Dc94egFvNALUZV2WCGKQXc6UByPBMgdiEyW2dtoYxYYYYc+AKD+jr+wQPcvX2vrQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-ppc64-gnu/-/tar-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-EPE1K/80RQvPbLRJDJs1QmCIcH+7WRi0F73+oTe1582y9RtfGRuzAkzeBuAGRXAQEjRQw/RjtNqr6UTJ+8UuWQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-s390x-gnu/-/tar-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-B2jhWiB1ffw1nQBqLUP1h4+J1ovAxBOoe5N2IqDMOc63fsPZKNqF1PvO/dIem8z7LL4U4bsfmhy3gBfu547oNQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-x64-gnu/-/tar-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-tbZDHnb9617lTnsDMGo/eAMZxnsQFnaRe+MszRqHguKfMwkisc9CCJnks/r1o84u5fECI+J/HOrKXgczq/3Oww==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-linux-x64-musl/-/tar-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-dV6cODlzbO8u6Anmv2N/ilQHq/AWz0xyltuXoLU3yUyXbZcnWYZuB2rL8OBGPmqNcD+x9NdScBNXh7vWN0naSQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-wasm32-wasi/-/tar-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-jIa9nb2HzOrfH0F8QQ9g3WE4aMH5vSI5/1NYVNm9ysCmNjCCtMXCAhlI3WKCdm/DwHf0zLqdrrtDFXODcNaqMw==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@napi-rs/wasm-runtime": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@napi-rs/tar-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.0.tgz",
+      "integrity": "sha512-Fq6DJW+Bb5jaWE69/qOE0D1TUN9+6uWhCeZpdnSBk14pjLcCWR7Q8n49PTSPHazM37JqrsdpEthXy2xn6jWWiA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      }
+    },
+    "node_modules/@napi-rs/tar-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
+      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@napi-rs/tar-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-win32-arm64-msvc/-/tar-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-vfpG71OB0ijtjemp3WTdmBKJm9R70KM8vsSExMsIQtV0lVzP07oM1CW6JbNRPXNLhRoue9ofYLiUDk8bE0Hckg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-win32-ia32-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-win32-ia32-msvc/-/tar-win32-ia32-msvc-1.1.0.tgz",
+      "integrity": "sha512-hGPyPW60YSpOSgzfy68DLBHgi6HxkAM+L59ZZZPMQ0TOXjQg+p2EW87+TjZfJOkSpbYiEkULwa/f4a2hcVjsqQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/tar-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/tar-win32-x64-msvc/-/tar-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-L6Ed1DxXK9YSCMyvpR8MiNAyKNkQLjsHsHK9E0qnHa8NzLFqzDKhvs5LfnWxM2kJ+F7m/e5n9zPm24kHb3LsVw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "0.2.4",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.4.tgz",
@@ -8984,6 +10080,276 @@
         "@tybys/wasm-util": "^0.9.0"
       }
     },
+    "node_modules/@napi-rs/wasm-tools": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools/-/wasm-tools-1.0.1.tgz",
+      "integrity": "sha512-enkZYyuCdo+9jneCPE/0fjIta4wWnvVN9hBo2HuiMpRF0q3lzv1J6b/cl7i0mxZUKhBrV3aCKDBQnCOhwKbPmQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      },
+      "optionalDependencies": {
+        "@napi-rs/wasm-tools-android-arm-eabi": "1.0.1",
+        "@napi-rs/wasm-tools-android-arm64": "1.0.1",
+        "@napi-rs/wasm-tools-darwin-arm64": "1.0.1",
+        "@napi-rs/wasm-tools-darwin-x64": "1.0.1",
+        "@napi-rs/wasm-tools-freebsd-x64": "1.0.1",
+        "@napi-rs/wasm-tools-linux-arm64-gnu": "1.0.1",
+        "@napi-rs/wasm-tools-linux-arm64-musl": "1.0.1",
+        "@napi-rs/wasm-tools-linux-x64-gnu": "1.0.1",
+        "@napi-rs/wasm-tools-linux-x64-musl": "1.0.1",
+        "@napi-rs/wasm-tools-wasm32-wasi": "1.0.1",
+        "@napi-rs/wasm-tools-win32-arm64-msvc": "1.0.1",
+        "@napi-rs/wasm-tools-win32-ia32-msvc": "1.0.1",
+        "@napi-rs/wasm-tools-win32-x64-msvc": "1.0.1"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-android-arm-eabi": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-android-arm-eabi/-/wasm-tools-android-arm-eabi-1.0.1.tgz",
+      "integrity": "sha512-lr07E/l571Gft5v4aA1dI8koJEmF1F0UigBbsqg9OWNzg80H3lDPO+auv85y3T/NHE3GirDk7x/D3sLO57vayw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-android-arm64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-android-arm64/-/wasm-tools-android-arm64-1.0.1.tgz",
+      "integrity": "sha512-WDR7S+aRLV6LtBJAg5fmjKkTZIdrEnnQxgdsb7Cf8pYiMWBHLU+LC49OUVppQ2YSPY0+GeYm9yuZWW3kLjJ7Bg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-darwin-arm64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-darwin-arm64/-/wasm-tools-darwin-arm64-1.0.1.tgz",
+      "integrity": "sha512-qWTI+EEkiN0oIn/N2gQo7+TVYil+AJ20jjuzD2vATS6uIjVz+Updeqmszi7zq7rdFTLp6Ea3/z4kDKIfZwmR9g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-darwin-x64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-darwin-x64/-/wasm-tools-darwin-x64-1.0.1.tgz",
+      "integrity": "sha512-bA6hubqtHROR5UI3tToAF/c6TDmaAgF0SWgo4rADHtQ4wdn0JeogvOk50gs2TYVhKPE2ZD2+qqt7oBKB+sxW3A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-freebsd-x64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-freebsd-x64/-/wasm-tools-freebsd-x64-1.0.1.tgz",
+      "integrity": "sha512-90+KLBkD9hZEjPQW1MDfwSt5J1L46EUKacpCZWyRuL6iIEO5CgWU0V/JnEgFsDOGyyYtiTvHc5bUdUTWd4I9Vg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-linux-arm64-gnu": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-linux-arm64-gnu/-/wasm-tools-linux-arm64-gnu-1.0.1.tgz",
+      "integrity": "sha512-rG0QlS65x9K/u3HrKafDf8cFKj5wV2JHGfl8abWgKew0GVPyp6vfsDweOwHbWAjcHtp2LHi6JHoW80/MTHm52Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-linux-arm64-musl": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-linux-arm64-musl/-/wasm-tools-linux-arm64-musl-1.0.1.tgz",
+      "integrity": "sha512-jAasbIvjZXCgX0TCuEFQr+4D6Lla/3AAVx2LmDuMjgG4xoIXzjKWl7c4chuaD+TI+prWT0X6LJcdzFT+ROKGHQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-linux-x64-gnu": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-linux-x64-gnu/-/wasm-tools-linux-x64-gnu-1.0.1.tgz",
+      "integrity": "sha512-Plgk5rPqqK2nocBGajkMVbGm010Z7dnUgq0wtnYRZbzWWxwWcXfZMPa8EYxrK4eE8SzpI7VlZP1tdVsdjgGwMw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-linux-x64-musl": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-linux-x64-musl/-/wasm-tools-linux-x64-musl-1.0.1.tgz",
+      "integrity": "sha512-GW7AzGuWxtQkyHknHWYFdR0CHmW6is8rG2Rf4V6GNmMpmwtXt/ItWYWtBe4zqJWycMNazpfZKSw/BpT7/MVCXQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-wasm32-wasi": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-wasm32-wasi/-/wasm-tools-wasm32-wasi-1.0.1.tgz",
+      "integrity": "sha512-/nQVSTrqSsn7YdAc2R7Ips/tnw5SPUcl3D7QrXCNGPqjbatIspnaexvaOYNyKMU6xPu+pc0BTnKVmqhlJJCPLA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@napi-rs/wasm-runtime": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.0.tgz",
+      "integrity": "sha512-Fq6DJW+Bb5jaWE69/qOE0D1TUN9+6uWhCeZpdnSBk14pjLcCWR7Q8n49PTSPHazM37JqrsdpEthXy2xn6jWWiA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
+      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-win32-arm64-msvc": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-win32-arm64-msvc/-/wasm-tools-win32-arm64-msvc-1.0.1.tgz",
+      "integrity": "sha512-PFi7oJIBu5w7Qzh3dwFea3sHRO3pojMsaEnUIy22QvsW+UJfNQwJCryVrpoUt8m4QyZXI+saEq/0r4GwdoHYFQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-win32-ia32-msvc": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-win32-ia32-msvc/-/wasm-tools-win32-ia32-msvc-1.0.1.tgz",
+      "integrity": "sha512-gXkuYzxQsgkj05Zaq+KQTkHIN83dFAwMcTKa2aQcpYPRImFm2AQzEyLtpXmyCWzJ0F9ZYAOmbSyrNew8/us6bw==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/wasm-tools-win32-x64-msvc": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-tools-win32-x64-msvc/-/wasm-tools-win32-x64-msvc-1.0.1.tgz",
+      "integrity": "sha512-rEAf05nol3e3eei2sRButmgXP+6ATgm0/38MKhz9Isne82T4rPIMYsCIFj0kOisaGeVwoi2fnm7O9oWp5YVnYQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@ng-select/ng-select": {
       "version": "20.7.0",
       "resolved": "https://registry.npmjs.org/@ng-select/ng-select/-/ng-select-20.7.0.tgz",
@@ -9002,9 +10368,9 @@
       }
     },
     "node_modules/@ngtools/webpack": {
-      "version": "20.3.11",
-      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-20.3.11.tgz",
-      "integrity": "sha512-c2/66tObP9YevCt7jyhwiGifS8ldfce6vYQ63Wwj8tlXSSutHk8+3VEQmbW3wW1JH7+0aNf3kF+pA97EbGj6QA==",
+      "version": "20.3.12",
+      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-20.3.12.tgz",
+      "integrity": "sha512-ePuofHOtbgvEq2t+hcmL30s4q9HQ/nv9ABwpLiELdVIObcWUnrnizAvM7hujve/9CQL6gRCeEkxPLPS4ZrK9AQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9497,9 +10863,9 @@
       }
     },
     "node_modules/@nx/devkit": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/devkit/-/devkit-21.6.9.tgz",
-      "integrity": "sha512-Si7Lo5OgiHz/xU/NL1v5LnynE5oGrQmYE3KXxZoSRWij/nxZKi0wEB0W6dT3MtQW8RY1y5mg45Ti0Ym+Clhi8Q==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/devkit/-/devkit-21.6.10.tgz",
+      "integrity": "sha512-h2ZpwhKk9p1kWgokMXP6F4PVakUA3jPbKmjtY+wCsW2VZg72tIVVzs33DGUxTvN6WG6Z4xbLKc0LJkgaOdDTOw==",
       "license": "MIT",
       "dependencies": {
         "ejs": "^3.1.7",
@@ -9524,13 +10890,13 @@
       }
     },
     "node_modules/@nx/eslint": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/eslint/-/eslint-21.6.9.tgz",
-      "integrity": "sha512-psd6GtWII5i1M15TTmdh8UZ/pBWlh6JtaVwlE5tk/GHlnCGXHEY+g3gKTsetjbuHjaocdwrfEy4TIB5J5Zh3HQ==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/eslint/-/eslint-21.6.10.tgz",
+      "integrity": "sha512-cZPXFZsgzGrOBetSdcIR9Kb28H9+lHsaubAGeCAjS8GSvRoQBKLdgtfuB5mpnmOLRqGsiIhZ701DfekLitRnmQ==",
       "license": "MIT",
       "dependencies": {
-        "@nx/devkit": "21.6.9",
-        "@nx/js": "21.6.9",
+        "@nx/devkit": "21.6.10",
+        "@nx/js": "21.6.10",
         "semver": "^7.5.3",
         "tslib": "^2.3.0",
         "typescript": "~5.9.2"
@@ -9559,15 +10925,15 @@
       }
     },
     "node_modules/@nx/jest": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/jest/-/jest-21.6.9.tgz",
-      "integrity": "sha512-8x/B3f616ti2BUXHhOQqewMyCxMMmy++Wh1YiKr5S922m7jog1oYsCzue+fmHsNijw9xMNAgsDjgy91I/iZZ0Q==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/jest/-/jest-21.6.10.tgz",
+      "integrity": "sha512-JAYMD/RwKP/mgr7R0uC6R7/DGsluajiQsHipbp6JhbwmqxOK+tTdWBHrYzKWXyRZaCSqqmrN55ocVfuynZDP4Q==",
       "license": "MIT",
       "dependencies": {
         "@jest/reporters": "^30.0.2",
         "@jest/test-result": "^30.0.2",
-        "@nx/devkit": "21.6.9",
-        "@nx/js": "21.6.9",
+        "@nx/devkit": "21.6.10",
+        "@nx/js": "21.6.10",
         "@phenomnomnominal/tsquery": "~5.0.1",
         "identity-obj-proxy": "3.0.0",
         "jest-config": "^30.0.2",
@@ -9581,22 +10947,6 @@
         "yargs-parser": "21.1.1"
       }
     },
-    "node_modules/@nx/jest/node_modules/@babel/generator": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.28.5.tgz",
-      "integrity": "sha512-3EwLFhZ38J4VyIP6WNtt2kUdW9dokXA9Cr4IVIFHuCpZ3H8/YFOl5JjZHisrn1fATPBmKKqXzDFvh9fUwHz6CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.28.5",
-        "@babel/types": "^7.28.5",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
-        "jsesc": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@nx/jest/node_modules/@jest/console": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.2.0.tgz",
@@ -10558,9 +11908,9 @@
       }
     },
     "node_modules/@nx/js": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/js/-/js-21.6.9.tgz",
-      "integrity": "sha512-KJnqe6W0Ly5AgpBOhygcVs5RssVKnKrISVp42CSirKx3nei6cus9VItwKBvBBAqmYw4AlrCe+/A2twTQCkeq1A==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/js/-/js-21.6.10.tgz",
+      "integrity": "sha512-8d+Q5v/9/he8mq6aRfhHWORZb/WkJ7OTegF4QX2g+yVkocEKIyuUx/BC9rGBRvlZpB2xcJlU9kNcfrhuoKbehQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.23.2",
@@ -10570,8 +11920,8 @@
         "@babel/preset-env": "^7.23.2",
         "@babel/preset-typescript": "^7.22.5",
         "@babel/runtime": "^7.22.6",
-        "@nx/devkit": "21.6.9",
-        "@nx/workspace": "21.6.9",
+        "@nx/devkit": "21.6.10",
+        "@nx/workspace": "21.6.10",
         "@zkochan/js-yaml": "0.0.7",
         "babel-plugin-const-enum": "^1.0.1",
         "babel-plugin-macros": "^3.1.0",
@@ -10710,9 +12060,9 @@
       }
     },
     "node_modules/@nx/nx-darwin-arm64": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-darwin-arm64/-/nx-darwin-arm64-21.6.9.tgz",
-      "integrity": "sha512-rN5cJAjKvyXfi+Zep7wvSNtGr35X1/qrm96K/Sf4sybvowyHmDdEMYxkR6BPNT8ct5JGMm35xPfx1yF/rJek3w==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-darwin-arm64/-/nx-darwin-arm64-21.6.10.tgz",
+      "integrity": "sha512-4K8oZdzil6zpY3zxugSbVDS4dF8o82KCeyT1IYH7t+aWD/tUnYhw/zmdNx6Jq80oxYgPrPWhxmuZ/UCN0LSYLw==",
       "cpu": [
         "arm64"
       ],
@@ -10723,9 +12073,9 @@
       ]
     },
     "node_modules/@nx/nx-darwin-x64": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-darwin-x64/-/nx-darwin-x64-21.6.9.tgz",
-      "integrity": "sha512-rb/Dtum094nfJL8lYohne1duZr8uNQ4gvWTq/Cw/xowJwXGq3xzsSS2WTpDpRBMF45K+42fipGHNeHbCyYSF7g==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-darwin-x64/-/nx-darwin-x64-21.6.10.tgz",
+      "integrity": "sha512-WqFIRjxtOHoJob2f24YiKfgqTcgtVb/CKYvnuMAmKccarOi91DeABQO35gXUwvE89TjhlR5slG5YLZt7E5UCaQ==",
       "cpu": [
         "x64"
       ],
@@ -10736,9 +12086,9 @@
       ]
     },
     "node_modules/@nx/nx-freebsd-x64": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-freebsd-x64/-/nx-freebsd-x64-21.6.9.tgz",
-      "integrity": "sha512-Cd7QHeivvLBiQ6iRTsvprGk1YS+CaUCMw4A+3TOvHz608a/U3mEye8oRy2fyFTTL/lsH6dlihT3xi+HNyXKAyA==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-freebsd-x64/-/nx-freebsd-x64-21.6.10.tgz",
+      "integrity": "sha512-EqrBLRA0WRek+x3kH6/YL+fRa6xKvj9e9nRfOYyo0GSbUwew5ofGWODGoYtoHC+oCuL4qtpKGRhU27NFwhOM8A==",
       "cpu": [
         "x64"
       ],
@@ -10749,9 +12099,9 @@
       ]
     },
     "node_modules/@nx/nx-linux-arm-gnueabihf": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm-gnueabihf/-/nx-linux-arm-gnueabihf-21.6.9.tgz",
-      "integrity": "sha512-ASXay2jKhSU4tfY9Z2ByysqDQxYgTHCtoJ+XR5xRv9aoIos6oYeKAqQV/RLXpTklugu08nBtL/4IRw58x4oU4A==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm-gnueabihf/-/nx-linux-arm-gnueabihf-21.6.10.tgz",
+      "integrity": "sha512-CdbPy4s1I4f57DOncoSsnJX9dB2f7sZhdPXHKZ9tgCMcBpy6uYHhkzmrwCdiBjl/2JQLM/GwEkqoYxpzIlAJbA==",
       "cpu": [
         "arm"
       ],
@@ -10762,9 +12112,9 @@
       ]
     },
     "node_modules/@nx/nx-linux-arm64-gnu": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm64-gnu/-/nx-linux-arm64-gnu-21.6.9.tgz",
-      "integrity": "sha512-1VS38xnAC8iH05A0nnbNn1hi9ypRnEPUfgLL3tPhAwQTWX2DQz4xR/j0NYNcCzL6yBe/JhdKlYoN/LI38lj2UA==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm64-gnu/-/nx-linux-arm64-gnu-21.6.10.tgz",
+      "integrity": "sha512-4ZSjvCjnBT0WpGdF12hvgLWmok4WftaE09fOWWrMm4b2m8F/5yKgU6usPFTehQa5oqTp08KW60kZMLaOQHOJQg==",
       "cpu": [
         "arm64"
       ],
@@ -10775,9 +12125,9 @@
       ]
     },
     "node_modules/@nx/nx-linux-arm64-musl": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm64-musl/-/nx-linux-arm64-musl-21.6.9.tgz",
-      "integrity": "sha512-PScHPs0dp+Cc17RvY4Y5wlDXT6xdDlsyhna2JLawodVCyUVArtnbF7whn/VEZKesDD/vAf1avCt4oAjuYS8VXg==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-linux-arm64-musl/-/nx-linux-arm64-musl-21.6.10.tgz",
+      "integrity": "sha512-lNzlTsgr7nY56ddIpLTzYZTuNA3FoeWb9Ald07pCWc0EHSZ0W4iatJ+NNnj/QLINW8HWUehE9mAV5qZlhVFBmg==",
       "cpu": [
         "arm64"
       ],
@@ -10788,9 +12138,9 @@
       ]
     },
     "node_modules/@nx/nx-linux-x64-gnu": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-linux-x64-gnu/-/nx-linux-x64-gnu-21.6.9.tgz",
-      "integrity": "sha512-s8oX6/pLolHH3EyFJPcKITv+rzN/IZuidMCNkGfcr0jYVqrTZcJo8xUEwAQzf6u6J6urOm0bUK3BDuwJLEKESg==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-linux-x64-gnu/-/nx-linux-x64-gnu-21.6.10.tgz",
+      "integrity": "sha512-nJxUtzcHwk8TgDdcqUmbJnEMV3baQxmdWn77d1NTP4cG677A7jdV93hbnCcw+AQonaFLUzDwJOIX8eIPZ32GLw==",
       "cpu": [
         "x64"
       ],
@@ -10801,9 +12151,9 @@
       ]
     },
     "node_modules/@nx/nx-linux-x64-musl": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-linux-x64-musl/-/nx-linux-x64-musl-21.6.9.tgz",
-      "integrity": "sha512-bojpGcscRrnet5N3waeHYnBHW0y6r5tSQ1phnwMjgoBFmWXw+0M+z/f2dfZcTtBmWc7Y/TnzaGb8EenC3a63cQ==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-linux-x64-musl/-/nx-linux-x64-musl-21.6.10.tgz",
+      "integrity": "sha512-+VwITTQW9wswP7EvFzNOucyaU86l2UcO6oYxFiwNvRioTlDOE5U7lxYmCgj3OHeGCmy9jhXlujdD+t3OhOT3gQ==",
       "cpu": [
         "x64"
       ],
@@ -10814,9 +12164,9 @@
       ]
     },
     "node_modules/@nx/nx-win32-arm64-msvc": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-win32-arm64-msvc/-/nx-win32-arm64-msvc-21.6.9.tgz",
-      "integrity": "sha512-cS1bdMiJBs4AcykJ3+vtAdw4RkZLLfXT20o+k07dEskRFADIa5yXdOs2j0qKoe7iCiORKCH+gI/YsPHCyHfV9Q==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-win32-arm64-msvc/-/nx-win32-arm64-msvc-21.6.10.tgz",
+      "integrity": "sha512-kkK/0GNVs7pdcgksLfoMBT8k92XGfcePPuhhS1Tsyq+zc3gpsPo+vNIGfeIf2FumKBsUdWUHuChfpxBmjcVFVw==",
       "cpu": [
         "arm64"
       ],
@@ -10827,9 +12177,9 @@
       ]
     },
     "node_modules/@nx/nx-win32-x64-msvc": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/nx-win32-x64-msvc/-/nx-win32-x64-msvc-21.6.9.tgz",
-      "integrity": "sha512-EX0ja8gWnmomiSbK9K58oATpTn/+KU6RKcrfzqA3yL5x/a+kEPSf66QOXGQjDpCGKWMoxN+6ex7zhpmqbqKxgg==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/nx-win32-x64-msvc/-/nx-win32-x64-msvc-21.6.10.tgz",
+      "integrity": "sha512-ddYZv1Z8wLhlHASwi044gTcM0+7OJ24V1yCwlVe3wsIqZDUZvVC1Lgk+wIQXUH8mBKm3NZti8B72nldoofOmSw==",
       "cpu": [
         "x64"
       ],
@@ -10840,14 +12190,14 @@
       ]
     },
     "node_modules/@nx/webpack": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/webpack/-/webpack-21.6.9.tgz",
-      "integrity": "sha512-2RWiZ4G/1VhEUTJtSH6zo9bvMxpRlV9AQGV3/NnP/dyH/owbZXrDuzd/hGW7s5CNE0RB3oN2dZG/ZEFJcGw55Q==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/webpack/-/webpack-21.6.10.tgz",
+      "integrity": "sha512-T+eB9c3lflqWuegrsW47zzkZlSQ6YNEucEknUpWyDrKLCihucKe9siuj5s2gPkgdY6DXX4sjZcA5xgnxHNBWag==",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.23.2",
-        "@nx/devkit": "21.6.9",
-        "@nx/js": "21.6.9",
+        "@nx/devkit": "21.6.10",
+        "@nx/js": "21.6.10",
         "@phenomnomnominal/tsquery": "~5.0.1",
         "ajv": "^8.12.0",
         "autoprefixer": "^10.4.9",
@@ -10883,18 +12233,6 @@
         "webpack-subresource-integrity": "^5.1.0"
       }
     },
-    "node_modules/@nx/webpack/node_modules/array-union": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/array-union/-/array-union-3.0.1.tgz",
-      "integrity": "sha512-1OvF9IbWwaeiM9VhzYXVQacMibxpXOMYVNIvMtKRyX9SImBXpKcFr8XvFDeEslCyuH/t6KRt7HEO94AlP8Iatw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/@nx/webpack/node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -11107,35 +12445,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/@nx/webpack/node_modules/globby": {
-      "version": "12.2.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-12.2.0.tgz",
-      "integrity": "sha512-wiSuFQLZ+urS9x2gGPl1H5drc5twabmm4m2gTR27XDFyjUHJUNsS8o/2aKyIF6IoBaR630atdher0XJ5g6OMmA==",
-      "license": "MIT",
-      "dependencies": {
-        "array-union": "^3.0.1",
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.2.7",
-        "ignore": "^5.1.9",
-        "merge2": "^1.4.1",
-        "slash": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@nx/webpack/node_modules/ignore": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/@nx/webpack/node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -11204,14 +12513,11 @@
         "node": "*"
       }
     },
-    "node_modules/@nx/webpack/node_modules/path-type": {
+    "node_modules/@nx/webpack/node_modules/parse5": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-4.0.0.tgz",
+      "integrity": "sha512-VrZ7eOd3T1Fk4XWNXMgiGBK/z0MG48BWG2uQNU4I72fkQuKUTZpl+u9k+CxEG0twMVzSmXEEz12z5Fnw1jIQFA==",
+      "license": "MIT"
     },
     "node_modules/@nx/webpack/node_modules/picomatch": {
       "version": "2.3.1",
@@ -11276,18 +12582,6 @@
         "node": ">=8.10.0"
       }
     },
-    "node_modules/@nx/webpack/node_modules/slash": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/@nx/webpack/node_modules/style-loader": {
       "version": "3.3.4",
       "resolved": "https://registry.npmjs.org/style-loader/-/style-loader-3.3.4.tgz",
@@ -11314,22 +12608,188 @@
       }
     },
     "node_modules/@nx/workspace": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/@nx/workspace/-/workspace-21.6.9.tgz",
-      "integrity": "sha512-tUucr8hrpdhFITMjEEF8vm1j0GSW0ecFTySViWnnVvYyyv7tbidK/76MV/iyV/SjSamOHm2zIXS9fCfXV4LpAQ==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/@nx/workspace/-/workspace-21.6.10.tgz",
+      "integrity": "sha512-6OkXs4gAVjDtrfqhJf7lHZX/VlCFLRZpywfgvmije40wrExkJDNEHx3Gf6dvSVwl0vE6Gz8D2t6luO02hGGz4w==",
       "license": "MIT",
       "dependencies": {
-        "@nx/devkit": "21.6.9",
+        "@nx/devkit": "21.6.10",
         "@zkochan/js-yaml": "0.0.7",
         "chalk": "^4.1.0",
         "enquirer": "~2.3.6",
-        "nx": "21.6.9",
+        "nx": "21.6.10",
         "picomatch": "4.0.2",
         "semver": "^7.6.3",
         "tslib": "^2.3.0",
         "yargs-parser": "21.1.1"
       }
     },
+    "node_modules/@octokit/auth-token": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-request-log": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "10.0.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/endpoint": "^11.0.2",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^7.0.2"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/rest": {
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-22.0.1.tgz",
+      "integrity": "sha512-Jzbhzl3CEexhnivb1iQ0KJ7s5vvjMWcmRtq5aUsKmKDrRW6z3r84ngmiFKFvpZjpiU/9/S6ITPFRpn5s/3uQJw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-request-log": "^6.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^27.0.0"
+      }
+    },
     "node_modules/@parcel/watcher": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.1.tgz",
@@ -11710,6 +13170,20 @@
         "url": "https://opencollective.com/pkgr"
       }
     },
+    "node_modules/@polka/send-type": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/@polka/send-type/-/send-type-0.5.2.tgz",
+      "integrity": "sha512-jGXalKihnhGQmMQ+xxfxrRfI2cWs38TIZuwgYpnbQDD4r9TkOiU3ocjAS+6CqqMNQNAu9Ul2iHU5YFRDODak2w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@polka/url": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-0.5.0.tgz",
+      "integrity": "sha512-oZLYFEAzUKyi3SKnXvj32ZCEGH6RDnao7COuCVhDydMS9NrCSVXhM79VaKyP5+Zc33m0QXEd2DN3UkU7OsHcfw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@rollup/rollup-android-arm-eabi": {
       "version": "4.52.3",
       "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.3.tgz",
@@ -13351,28 +14825,28 @@
       }
     },
     "node_modules/@ts-morph/common": {
-      "version": "0.25.0",
-      "resolved": "https://registry.npmjs.org/@ts-morph/common/-/common-0.25.0.tgz",
-      "integrity": "sha512-kMnZz+vGGHi4GoHnLmMhGNjm44kGtKUXGnOvrKmMwAuvNjM/PgKVGfUnL7IDvK7Jb2QQ82jq3Zmp04Gy+r3Dkg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@ts-morph/common/-/common-0.28.1.tgz",
+      "integrity": "sha512-W74iWf7ILp1ZKNYXY5qbddNaml7e9Sedv5lvU1V8lftlitkc9Pq1A+jlH23ltDgWYeZFFEqGCD1Ies9hqu3O+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "minimatch": "^9.0.4",
+        "minimatch": "^10.0.1",
         "path-browserify": "^1.0.1",
-        "tinyglobby": "^0.2.9"
+        "tinyglobby": "^0.2.14"
       }
     },
     "node_modules/@ts-morph/common/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "10.1.1",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
+      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "@isaacs/brace-expansion": "^5.0.0"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -13713,6 +15187,14 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/hammerjs": {
+      "version": "2.0.46",
+      "resolved": "https://registry.npmjs.org/@types/hammerjs/-/hammerjs-2.0.46.tgz",
+      "integrity": "sha512-ynRvcq6wvqexJ9brDMS4BnBLzmr0e14d6ZJTEShTBWKymQiHwlAyGu0ZPEFI2Fh1U53F7tN9ufClWM5KvqkKOw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
     "node_modules/@types/har-format": {
       "version": "1.2.16",
       "resolved": "https://registry.npmjs.org/@types/har-format/-/har-format-1.2.16.tgz",
@@ -13887,9 +15369,9 @@
       }
     },
     "node_modules/@types/koa": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@types/koa/-/koa-3.0.0.tgz",
-      "integrity": "sha512-MOcVYdVYmkSutVHZZPh8j3+dAjLyR5Tl59CN0eKgpkE1h/LBSmPAsQQuWs+bKu7WtGNn+hKfJH9Gzml+PulmDg==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/koa/-/koa-3.0.1.tgz",
+      "integrity": "sha512-VkB6WJUQSe0zBpR+Q7/YIUESGp5wPHcaXr0xueU5W0EOUWtlSbblsl+Kl31lyRQ63nIILh0e/7gXjQ09JXJIHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14008,9 +15490,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.19.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
-      "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "version": "22.19.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
+      "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~6.21.0"
@@ -14134,15 +15616,15 @@
       "license": "MIT"
     },
     "node_modules/@types/react": {
-      "version": "18.3.20",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.20.tgz",
-      "integrity": "sha512-IPaCZN7PShZK/3t6Q87pfTkRm6oLTd4vztyoj+cbHUF1g3FfVb2tFIL79uCRKEfv16AhqDMBywP2VW3KIZUvcg==",
+      "version": "18.3.27",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.27.tgz",
+      "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
-        "csstype": "^3.0.2"
+        "csstype": "^3.2.2"
       }
     },
     "node_modules/@types/responselike": {
@@ -16487,9 +17969,9 @@
       }
     },
     "node_modules/autoprefixer": {
-      "version": "10.4.21",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz",
-      "integrity": "sha512-O+A6LWV5LDHSJD3LjHYoNi4VLsj/Whi7k6zG12xTYaU4cQ8oxQGckXNX8cRHK5yOZ/ppVHe0ZBXGzSV9jXdVbQ==",
+      "version": "10.4.22",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.22.tgz",
+      "integrity": "sha512-ARe0v/t9gO28Bznv6GgqARmVqcWOV3mfgUPn9becPHMiD3o9BwlRgaeccZnwTpZ7Zwqrm+c1sUSsMxIzQzc8Xg==",
       "funding": [
         {
           "type": "opencollective",
@@ -16506,9 +17988,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.24.4",
-        "caniuse-lite": "^1.0.30001702",
-        "fraction.js": "^4.3.7",
+        "browserslist": "^4.27.0",
+        "caniuse-lite": "^1.0.30001754",
+        "fraction.js": "^5.3.4",
         "normalize-range": "^0.1.2",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
@@ -16523,6 +18005,19 @@
         "postcss": "^8.1.0"
       }
     },
+    "node_modules/autoprefixer/node_modules/fraction.js": {
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-5.3.4.tgz",
+      "integrity": "sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/rawify"
+      }
+    },
     "node_modules/available-typed-arrays": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
@@ -16747,15 +18242,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/babel-plugin-macros/node_modules/path-type": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/babel-plugin-macros/node_modules/yaml": {
       "version": "1.10.2",
       "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
@@ -16910,9 +18396,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.8.30",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.30.tgz",
-      "integrity": "sha512-aTUKW4ptQhS64+v2d6IkPzymEzzhw+G0bA1g3uBRV3+ntkH+svttKseW5IOR4Ed6NUVKqnY7qT3dKvzQ7io4AA==",
+      "version": "2.9.3",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.3.tgz",
+      "integrity": "sha512-8QdH6czo+G7uBsNo0GiUfouPN1lRzKdJTGnKXwe12gkFbnnOUaUKGN55dMkfy+mnxmvjwl9zcI4VncczcVXDhA==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.js"
@@ -17001,6 +18487,13 @@
         "url": "https://github.com/sponsors/fb55"
       }
     },
+    "node_modules/before-after-hook": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/bent": {
       "version": "7.3.12",
       "resolved": "https://registry.npmjs.org/bent/-/bent-7.3.12.tgz",
@@ -17215,9 +18708,9 @@
       "optional": true
     },
     "node_modules/bootstrap.native": {
-      "version": "5.1.5",
-      "resolved": "https://registry.npmjs.org/bootstrap.native/-/bootstrap.native-5.1.5.tgz",
-      "integrity": "sha512-sQdFng2Szpseyo1TlpG5pV+se4nbGeQWFXBemsPSnrVzd82ps9F6hti+lHFwcGgS80oIc54dY5ycOYJwUpQn3A==",
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/bootstrap.native/-/bootstrap.native-5.1.6.tgz",
+      "integrity": "sha512-bLveDBWhNLoFLsPctVo6yxSRQ1ysmKHBa+1FFMTQuruzTb3y7/InGSoe5lZdOiqZ4L0UOzpdbXMsI+bA5DoRew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17295,9 +18788,9 @@
       "license": "MIT"
     },
     "node_modules/browserslist": {
-      "version": "4.28.0",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.0.tgz",
-      "integrity": "sha512-tbydkR/CxfMwelN0vwdP/pLkDwyAASZ+VfWm4EOwlB6SWhx1sYnWLqo8N5j0rAzPfzfRaxt0mM/4wPU/Su84RQ==",
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
       "funding": [
         {
           "type": "opencollective",
@@ -17314,11 +18807,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.8.25",
-        "caniuse-lite": "^1.0.30001754",
-        "electron-to-chromium": "^1.5.249",
+        "baseline-browser-mapping": "^2.9.0",
+        "caniuse-lite": "^1.0.30001759",
+        "electron-to-chromium": "^1.5.263",
         "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.1.4"
+        "update-browserslist-db": "^1.2.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -17675,40 +19168,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/cache-content-type": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/cache-content-type/-/cache-content-type-1.0.1.tgz",
-      "integrity": "sha512-IKufZ1o4Ut42YUrZSo8+qnMTrFuKkvyoLXUywKz9GJ5BrhOFGhLdkx9sG4KAnVvbY6kEcSFjLQul+DVmBm2bgA==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-types": "^2.1.18",
-        "ylru": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 6.0.0"
-      }
-    },
-    "node_modules/cache-content-type/node_modules/mime-db": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/cache-content-type/node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/cacheable-lookup": {
       "version": "5.0.4",
       "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-5.0.4.tgz",
@@ -17909,9 +19368,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001756",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001756.tgz",
-      "integrity": "sha512-4HnCNKbMLkLdhJz3TToeVWHSnfJvPaq6vu/eRP0Ahub/07n484XHhBF5AJoSGHdVrS8tKFauUQz8Bp9P7LVx7A==",
+      "version": "1.0.30001759",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001759.tgz",
+      "integrity": "sha512-Pzfx9fOKoKvevQf8oCXoyNRQ5QyxJj+3O0Rqx2V5oxT61KGx8+n6hV/IUyJeifUci2clnmmKVpvtiqRzgiWjSw==",
       "funding": [
         {
           "type": "opencollective",
@@ -18035,22 +19494,26 @@
       }
     },
     "node_modules/cheerio": {
-      "version": "1.0.0-rc.12",
-      "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.12.tgz",
-      "integrity": "sha512-VqR8m68vM46BNnuZ5NtnGBKIE/DfN0cRIzg9n40EIq9NOv90ayxLBXA8fXC5gquFRGJSTRqBq25Jt2ECLR431Q==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.1.2.tgz",
+      "integrity": "sha512-IkxPpb5rS/d1IiLbHMgfPuS0FgiWTtFIm/Nj+2woXDLTZ7fOT2eqzgYbdMlLweqlHbsZjxEChoVK+7iph7jyQg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "cheerio-select": "^2.1.0",
         "dom-serializer": "^2.0.0",
         "domhandler": "^5.0.3",
-        "domutils": "^3.0.1",
-        "htmlparser2": "^8.0.1",
-        "parse5": "^7.0.0",
-        "parse5-htmlparser2-tree-adapter": "^7.0.0"
+        "domutils": "^3.2.2",
+        "encoding-sniffer": "^0.2.1",
+        "htmlparser2": "^10.0.0",
+        "parse5": "^7.3.0",
+        "parse5-htmlparser2-tree-adapter": "^7.1.0",
+        "parse5-parser-stream": "^7.1.2",
+        "undici": "^7.12.0",
+        "whatwg-mimetype": "^4.0.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">=20.18.1"
       },
       "funding": {
         "url": "https://github.com/cheeriojs/cheerio?sponsor=1"
@@ -18074,26 +19537,6 @@
         "url": "https://github.com/sponsors/fb55"
       }
     },
-    "node_modules/cheerio/node_modules/htmlparser2": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-8.0.2.tgz",
-      "integrity": "sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==",
-      "dev": true,
-      "funding": [
-        "https://github.com/fb55/htmlparser2?sponsor=1",
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fb55"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "domelementtype": "^2.3.0",
-        "domhandler": "^5.0.3",
-        "domutils": "^3.0.1",
-        "entities": "^4.4.0"
-      }
-    },
     "node_modules/chokidar": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
@@ -18120,9 +19563,9 @@
       }
     },
     "node_modules/chromatic": {
-      "version": "13.3.1",
-      "resolved": "https://registry.npmjs.org/chromatic/-/chromatic-13.3.1.tgz",
-      "integrity": "sha512-qJ/el70Wo7jFgiXPpuukqxCEc7IKiH/e8MjTzIF9uKw+3XZ6GghOTTLC7lGfeZtosiQBMkRlYet77tC4KKHUng==",
+      "version": "13.3.4",
+      "resolved": "https://registry.npmjs.org/chromatic/-/chromatic-13.3.4.tgz",
+      "integrity": "sha512-TR5rvyH0ESXobBB3bV8jc87AEAFQC7/n+Eb4XWhJz6hW3YNxIQPVjcbgLv+a4oKHEl1dUBueWSoIQsOVGTd+RQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -18266,6 +19709,22 @@
         "node": ">= 12"
       }
     },
+    "node_modules/clipanion": {
+      "version": "4.0.0-rc.4",
+      "resolved": "https://registry.npmjs.org/clipanion/-/clipanion-4.0.0-rc.4.tgz",
+      "integrity": "sha512-CXkMQxU6s9GklO/1f714dkKBMu1lopS1WFF0B8o4AxPykR1hpozxSiUZ5ZUeBjfPgCWqbcNOtZVFhB8Lkfp1+Q==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "website"
+      ],
+      "dependencies": {
+        "typanion": "^3.8.0"
+      },
+      "peerDependencies": {
+        "typanion": "*"
+      }
+    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -18579,6 +20038,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/component-emitter": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-2.0.0.tgz",
+      "integrity": "sha512-4m5s3Me2xxlVKG9PkZpQqHQR7bgpnN7joDMJ4yvVkVXngjoITG76IaZmzmywSeRTeTpc6N6r3H3+KyUurV8OYw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/compressible": {
       "version": "2.0.18",
       "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
@@ -19466,9 +20939,9 @@
       }
     },
     "node_modules/csstype": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
-      "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==",
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
       "license": "MIT"
     },
     "node_modules/cwd": {
@@ -19713,9 +21186,9 @@
       }
     },
     "node_modules/default-browser": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.2.1.tgz",
-      "integrity": "sha512-WY/3TUME0x3KPYdRRxEJJvXRHV4PyPoUsxtZa78lwItwRQRHhd2U9xOscaT/YTf8uCXIAjeJOFBVEh/7FtD8Xg==",
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.4.0.tgz",
+      "integrity": "sha512-XDuvSq38Hr1MdN47EDvYtx3U0MTqpCEn+F6ft8z2vYDzMrvQhVp0ui9oQdqW3MvK3vqUETglt1tVGgjLuJ5izg==",
       "license": "MIT",
       "dependencies": {
         "bundle-name": "^4.1.0",
@@ -20108,15 +21581,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/dir-glob/node_modules/path-type": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/dlv": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
@@ -20658,9 +22122,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.259",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.259.tgz",
-      "integrity": "sha512-I+oLXgpEJzD6Cwuwt1gYjxsDmu/S/Kd41mmLA3O+/uH2pFRO/DvOjUyGozL8j3KeLV6WyZ7ssPwELMsXCcsJAQ==",
+      "version": "1.5.266",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.266.tgz",
+      "integrity": "sha512-kgWEglXvkEfMH7rxP5OSZZwnaDWT7J9EoZCujhnpLbfi0bbNtRkgdX2E3gt0Uer11c61qCYktB3hwkAS325sJg==",
       "license": "ISC"
     },
     "node_modules/electron-updater": {
@@ -20782,15 +22246,6 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/emitter-component": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/emitter-component/-/emitter-component-1.1.2.tgz",
-      "integrity": "sha512-QdXO3nXOzZB4pAjM0n6ZE+R9/+kPpECA/XSELIcc54NeYVnBqIk+4DFiBgK+8QbV3mdvTG6nedl7dTYgO+5wDw==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/emittery": {
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz",
@@ -20803,6 +22258,21 @@
         "url": "https://github.com/sindresorhus/emittery?sponsor=1"
       }
     },
+    "node_modules/emnapi": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/emnapi/-/emnapi-1.7.1.tgz",
+      "integrity": "sha512-wlLK2xFq+T+rCBlY6+lPlFVDEyE93b7hSn9dMrfWBIcPf4ArwUvymvvMnN9M5WWuiryYQe9M+UJrkqw4trdyRA==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "node-addon-api": ">= 6.1.0"
+      },
+      "peerDependenciesMeta": {
+        "node-addon-api": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -20837,6 +22307,20 @@
         "iconv-lite": "^0.6.2"
       }
     },
+    "node_modules/encoding-sniffer": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/encoding-sniffer/-/encoding-sniffer-0.2.1.tgz",
+      "integrity": "sha512-5gvq20T6vfpekVtqrYQsSCFZ1wEg5+wW0/QaZMWkFr6BqD3NfKs0rLCx4rrVlSWJeZb5NBJgVLswK/w2MWU+Gw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "^0.6.3",
+        "whatwg-encoding": "^3.1.1"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/encoding-sniffer?sponsor=1"
+      }
+    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -21112,6 +22596,17 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/es-toolkit": {
+      "version": "1.42.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.42.0.tgz",
+      "integrity": "sha512-SLHIyY7VfDJBM8clz4+T2oquwTQxEzu263AyhVK4jREOAwJ+8eebaa4wM3nlvnAqhDrMm2EsA6hWHaQsMPQ1nA==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks"
+      ]
+    },
     "node_modules/es6-error": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
@@ -22115,6 +23610,23 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -22719,16 +24231,6 @@
         "node": "*"
       }
     },
-    "node_modules/fork-ts-checker-webpack-plugin/node_modules/path-type": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/picomatch": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
@@ -22834,6 +24336,7 @@
       "version": "4.3.7",
       "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
       "integrity": "sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -22926,9 +24429,9 @@
       }
     },
     "node_modules/fs-extra": {
-      "version": "11.3.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.0.tgz",
-      "integrity": "sha512-Z4XaCL6dUDHfP/jT25jJKMmtxvuwbkrD1vNSMFlo9lNLY2c5FHYSQgHPRZUjAB26TpDEoW9HCOgplrdbaPV/ew==",
+      "version": "11.3.2",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.2.tgz",
+      "integrity": "sha512-Xr9F6z6up6Ws+NjzMCZc6WXg2YFRlrLP9NQDO3VQrWrfiojdhS56TzueT88ze0uBdCTwEIhQ3ptnmKeWGFAe0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23314,6 +24817,59 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/globby": {
+      "version": "12.2.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-12.2.0.tgz",
+      "integrity": "sha512-wiSuFQLZ+urS9x2gGPl1H5drc5twabmm4m2gTR27XDFyjUHJUNsS8o/2aKyIF6IoBaR630atdher0XJ5g6OMmA==",
+      "license": "MIT",
+      "dependencies": {
+        "array-union": "^3.0.1",
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.2.7",
+        "ignore": "^5.1.9",
+        "merge2": "^1.4.1",
+        "slash": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globby/node_modules/array-union": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/array-union/-/array-union-3.0.1.tgz",
+      "integrity": "sha512-1OvF9IbWwaeiM9VhzYXVQacMibxpXOMYVNIvMtKRyX9SImBXpKcFr8XvFDeEslCyuH/t6KRt7HEO94AlP8Iatw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globby/node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/globby/node_modules/slash": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
+      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/globrex": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/globrex/-/globrex-0.1.2.tgz",
@@ -23371,16 +24927,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/hammerjs": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/hammerjs/-/hammerjs-2.0.8.tgz",
-      "integrity": "sha512-tSQXBXS/MWQOn/RKckawJ61vvsDpCom87JgxiYdGwHdOa0ht0vzUWDlfioofFCRU0L+6NGDt6XzbgoJvZkMeRQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
     "node_modules/handle-thing": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
@@ -24048,9 +25594,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "23.16.8",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-23.16.8.tgz",
-      "integrity": "sha512-06r/TitrM88Mg5FdUXAKL96dJMzgqLE5dv3ryBAra4KCwD9mJ4ndOTS95ZuymIGoE+2hzfdaMak2X11/es7ZWg==",
+      "version": "25.5.3",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.5.3.tgz",
+      "integrity": "sha512-joFqorDeQ6YpIXni944upwnuHBf5IoPMuqAchGVeQLdWC2JOjxgM9V8UGLhNIIH/Q8QleRxIi0BSRQehSrDLcg==",
       "dev": true,
       "funding": [
         {
@@ -24068,7 +25614,15 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.23.2"
+        "@babel/runtime": "^7.27.6"
+      },
+      "peerDependencies": {
+        "typescript": "^5"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
       }
     },
     "node_modules/iconv-corefoundation": {
@@ -24759,6 +26313,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.0.tgz",
       "integrity": "sha512-nPUB5km40q9e8UfN/Zc24eLlzdSf9OfKByBw9CIdw4H1giPMeA0OIJvbchsCu4npfI2QcMVBsGEBHKZ7wLTWmQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -24785,6 +26340,18 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-in-ssh": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-in-ssh/-/is-in-ssh-1.0.0.tgz",
+      "integrity": "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-inside-container": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
@@ -24932,6 +26499,7 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
       "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -27418,7 +28986,8 @@
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/keycharm/-/keycharm-0.2.0.tgz",
       "integrity": "sha512-i/XBRTiLqRConPKioy2oq45vbv04e8x59b0mnsIRQM+7Ec/8BC7UcL5pnC4FMeGb8KwG7q4wOMw7CtNZf5tiIg==",
-      "dev": true
+      "dev": true,
+      "peer": true
     },
     "node_modules/keygrip": {
       "version": "1.1.0",
@@ -27471,37 +29040,32 @@
       }
     },
     "node_modules/koa": {
-      "version": "2.16.3",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.3.tgz",
-      "integrity": "sha512-zPPuIt+ku1iCpFBRwseMcPYQ1cJL8l60rSmKeOuGfOXyE6YnTBmf2aEFNL2HQGrD0cPcLO/t+v9RTgC+fwEh/g==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-3.1.1.tgz",
+      "integrity": "sha512-KDDuvpfqSK0ZKEO2gCPedNjl5wYpfj+HNiuVRlbhd1A88S3M0ySkdf2V/EJ4NWt5dwh5PXCdcenrKK2IQJAxsg==",
       "license": "MIT",
       "dependencies": {
-        "accepts": "^1.3.5",
-        "cache-content-type": "^1.0.0",
-        "content-disposition": "~0.5.2",
-        "content-type": "^1.0.4",
-        "cookies": "~0.9.0",
-        "debug": "^4.3.2",
+        "accepts": "^1.3.8",
+        "content-disposition": "~0.5.4",
+        "content-type": "^1.0.5",
+        "cookies": "~0.9.1",
         "delegates": "^1.0.0",
-        "depd": "^2.0.0",
-        "destroy": "^1.0.4",
-        "encodeurl": "^1.0.2",
+        "destroy": "^1.2.0",
+        "encodeurl": "^2.0.0",
         "escape-html": "^1.0.3",
         "fresh": "~0.5.2",
-        "http-assert": "^1.3.0",
-        "http-errors": "^1.6.3",
-        "is-generator-function": "^1.0.7",
+        "http-assert": "^1.5.0",
+        "http-errors": "^2.0.0",
         "koa-compose": "^4.1.0",
-        "koa-convert": "^2.0.0",
-        "on-finished": "^2.3.0",
-        "only": "~0.0.2",
-        "parseurl": "^1.3.2",
-        "statuses": "^1.5.0",
-        "type-is": "^1.6.16",
+        "mime-types": "^3.0.1",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
         "vary": "^1.1.2"
       },
       "engines": {
-        "node": "^4.8.4 || ^6.10.1 || ^7.10.1 || >= 8.1.4"
+        "node": ">= 18"
       }
     },
     "node_modules/koa-bodyparser": {
@@ -27567,19 +29131,6 @@
       "integrity": "sha512-8ODW8TrDuMYvXRwra/Kh7/rJo9BtOfPc6qO8eAfC80CnCvSjSl0bkRM24X6/XBBEyj0v1nRUQ1LyOy3dbqOWXw==",
       "license": "MIT"
     },
-    "node_modules/koa-convert": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/koa-convert/-/koa-convert-2.0.0.tgz",
-      "integrity": "sha512-asOvN6bFlSnxewce2e/DK3p4tltyfC4VM7ZwuTuepI7dEQVcvpyFuBcEARu1+Hxg8DIwytce2n7jrZtRlPrARA==",
-      "license": "MIT",
-      "dependencies": {
-        "co": "^4.6.0",
-        "koa-compose": "^4.1.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/koa-is-json": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/koa-is-json/-/koa-is-json-1.0.0.tgz",
@@ -27609,6 +29160,18 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/koa/node_modules/accepts/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/koa/node_modules/content-disposition": {
       "version": "0.5.4",
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
@@ -27621,15 +29184,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/koa/node_modules/encodeurl": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/koa/node_modules/fresh": {
       "version": "0.5.2",
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
@@ -27639,40 +29193,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/koa/node_modules/http-errors": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
-      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "~1.1.2",
-        "inherits": "2.0.4",
-        "setprototypeof": "1.2.0",
-        "statuses": ">= 1.5.0 < 2",
-        "toidentifier": "1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/koa/node_modules/http-errors/node_modules/depd": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
-      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/koa/node_modules/media-typer": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/koa/node_modules/mime-db": {
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -27682,18 +29202,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/koa/node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/koa/node_modules/negotiator": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@ -27703,28 +29211,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/koa/node_modules/statuses": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
-      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/koa/node_modules/type-is": {
-      "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
-      "license": "MIT",
-      "dependencies": {
-        "media-typer": "0.3.0",
-        "mime-types": "~2.1.24"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/launch-editor": {
       "version": "2.10.0",
       "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.10.0.tgz",
@@ -28976,6 +30462,19 @@
         "node": ">=10"
       }
     },
+    "node_modules/matchit": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/matchit/-/matchit-1.1.0.tgz",
+      "integrity": "sha512-+nGYoOlfHmxe5BW5tE0EMJppXEwdSf8uBA1GTZC7Q77kbT35+VKLYJMzVNWCHSsga1ps1tPYFtFyvxvKzWVmMA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@arr/every": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -30238,16 +31737,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/moment": {
-      "version": "2.30.1",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
-      "integrity": "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/morgan": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz",
@@ -31753,9 +33242,9 @@
       "license": "MIT"
     },
     "node_modules/nx": {
-      "version": "21.6.9",
-      "resolved": "https://registry.npmjs.org/nx/-/nx-21.6.9.tgz",
-      "integrity": "sha512-RPuIb04QIOE2WLDcvKDjrAQlkI9+EnP8/9KyG/I296JA1lJhlIk7BH3F6Py7uLHD7B1adSBsCDf/tT6540Ng7A==",
+      "version": "21.6.10",
+      "resolved": "https://registry.npmjs.org/nx/-/nx-21.6.10.tgz",
+      "integrity": "sha512-iKSyAg0VGG1MEOnlyyseMOt4n9J7I955VC+0UPQbNQTLdIUW8ibIHubpQyjd8Qvq4CfrLxzm+iq1AmbZ5vEG4A==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -31800,16 +33289,16 @@
         "nx-cloud": "bin/nx-cloud.js"
       },
       "optionalDependencies": {
-        "@nx/nx-darwin-arm64": "21.6.9",
-        "@nx/nx-darwin-x64": "21.6.9",
-        "@nx/nx-freebsd-x64": "21.6.9",
-        "@nx/nx-linux-arm-gnueabihf": "21.6.9",
-        "@nx/nx-linux-arm64-gnu": "21.6.9",
-        "@nx/nx-linux-arm64-musl": "21.6.9",
-        "@nx/nx-linux-x64-gnu": "21.6.9",
-        "@nx/nx-linux-x64-musl": "21.6.9",
-        "@nx/nx-win32-arm64-msvc": "21.6.9",
-        "@nx/nx-win32-x64-msvc": "21.6.9"
+        "@nx/nx-darwin-arm64": "21.6.10",
+        "@nx/nx-darwin-x64": "21.6.10",
+        "@nx/nx-freebsd-x64": "21.6.10",
+        "@nx/nx-linux-arm-gnueabihf": "21.6.10",
+        "@nx/nx-linux-arm64-gnu": "21.6.10",
+        "@nx/nx-linux-arm64-musl": "21.6.10",
+        "@nx/nx-linux-x64-gnu": "21.6.10",
+        "@nx/nx-linux-x64-musl": "21.6.10",
+        "@nx/nx-win32-arm64-msvc": "21.6.10",
+        "@nx/nx-win32-x64-msvc": "21.6.10"
       },
       "peerDependencies": {
         "@swc-node/register": "^1.8.0",
@@ -32471,24 +33960,37 @@
         "node": ">=6"
       }
     },
-    "node_modules/only": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/only/-/only-0.0.2.tgz",
-      "integrity": "sha512-Fvw+Jemq5fjjyWz6CpKx6w9s7xxqo3+JCyM0WXWeCSOboZ8ABkyvP8ID4CZuChA/wxSx+XSJmdOm8rGVyJ1hdQ=="
-    },
     "node_modules/open": {
-      "version": "10.1.2",
-      "resolved": "https://registry.npmjs.org/open/-/open-10.1.2.tgz",
-      "integrity": "sha512-cxN6aIDPz6rm8hbebcP7vrQNhvRcveZoJU72Y7vskh4oIm+BZwBECnx5nTmrlres1Qapvx27Qo1Auukpf8PKXw==",
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-11.0.0.tgz",
+      "integrity": "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==",
       "license": "MIT",
       "dependencies": {
-        "default-browser": "^5.2.1",
+        "default-browser": "^5.4.0",
         "define-lazy-prop": "^3.0.0",
+        "is-in-ssh": "^1.0.0",
         "is-inside-container": "^1.0.0",
-        "is-wsl": "^3.1.0"
+        "powershell-utils": "^0.1.0",
+        "wsl-utils": "^0.3.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/open/node_modules/wsl-utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.3.0.tgz",
+      "integrity": "sha512-3sFIGLiaDP7rTO4xh3g+b3AzhYDIUGGywE/WsmqzJWDxus5aJXVnPTNC/6L+r2WzrwXqVOdD262OaO+cEyPMSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "is-wsl": "^3.1.0",
+        "powershell-utils": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -33133,12 +34635,12 @@
       }
     },
     "node_modules/parse5": {
-      "version": "7.2.1",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.2.1.tgz",
-      "integrity": "sha512-BuBYQYlv1ckiPdQi/ohiivi9Sagc9JG+Ozs0r7b/0iK3sKmrb0b9FdWdBbOdx6hBCM/F9Ir82ofnBhtZOjCRPQ==",
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
       "license": "MIT",
       "dependencies": {
-        "entities": "^4.5.0"
+        "entities": "^6.0.0"
       },
       "funding": {
         "url": "https://github.com/inikulin/parse5?sponsor=1"
@@ -33172,6 +34674,19 @@
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
+    "node_modules/parse5-html-rewriting-stream/node_modules/parse5": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.0.tgz",
+      "integrity": "sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
     "node_modules/parse5-htmlparser2-tree-adapter": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz",
@@ -33186,6 +34701,19 @@
         "url": "https://github.com/inikulin/parse5?sponsor=1"
       }
     },
+    "node_modules/parse5-parser-stream": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/parse5-parser-stream/-/parse5-parser-stream-7.1.2.tgz",
+      "integrity": "sha512-JyeQc9iwFLn5TbvvqACIF/VXG6abODeB3Fwmv/TGdLk2LfbWkaySGY72at4+Ty7EkPZj854u4CrICqNk2qIbow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parse5": "^7.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
     "node_modules/parse5-sax-parser": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/parse5-sax-parser/-/parse5-sax-parser-8.0.0.tgz",
@@ -33199,6 +34727,44 @@
         "url": "https://github.com/inikulin/parse5?sponsor=1"
       }
     },
+    "node_modules/parse5-sax-parser/node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/parse5-sax-parser/node_modules/parse5": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.0.tgz",
+      "integrity": "sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/parse5/node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/parseurl": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -33295,6 +34861,15 @@
         "node": ">=16"
       }
     },
+    "node_modules/path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/pathval": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.1.tgz",
@@ -33649,6 +35224,17 @@
         "node": ">=10.4.0"
       }
     },
+    "node_modules/polka": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/polka/-/polka-0.5.2.tgz",
+      "integrity": "sha512-FVg3vDmCqP80tOrs+OeNlgXYmFppTXdjD5E7I4ET1NjvtNmQrb1/mJibybKkb/d4NA7YWAr1ojxuhpL3FHqdlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@polka/url": "^0.5.0",
+        "trouter": "^2.0.1"
+      }
+    },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -34417,6 +36003,18 @@
         "node": "^12.20.0 || >=14"
       }
     },
+    "node_modules/powershell-utils": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/powershell-utils/-/powershell-utils-0.1.0.tgz",
+      "integrity": "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
@@ -34454,9 +36052,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.6.2.tgz",
-      "integrity": "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==",
+      "version": "3.7.3",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.7.3.tgz",
+      "integrity": "sha512-QgODejq9K3OzoBbuyobZlUhznP5SKwPqp+6Q6xw6o8gnhr4O85L2U915iM2IDcfF2NPXVaM9zlo9tdwipnYwzg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -34470,16 +36068,18 @@
       }
     },
     "node_modules/prettier-plugin-tailwindcss": {
-      "version": "0.6.11",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.6.11.tgz",
-      "integrity": "sha512-YxaYSIvZPAqhrrEpRtonnrXdghZg1irNg4qrjboCXrpybLWVs55cW2N3juhspVJiO0JBvYJT8SYsJpc8OQSnsA==",
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.1.tgz",
+      "integrity": "sha512-Bzv1LZcuiR1Sk02iJTS1QzlFNp/o5l2p3xkopwOrbPmtMeh3fK9rVW5M3neBQzHq+kGKj/4LGQMTNcTH4NGPtQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=14.21.3"
+        "node": ">=20.19"
       },
       "peerDependencies": {
         "@ianvs/prettier-plugin-sort-imports": "*",
+        "@prettier/plugin-hermes": "*",
+        "@prettier/plugin-oxc": "*",
         "@prettier/plugin-pug": "*",
         "@shopify/prettier-plugin-liquid": "*",
         "@trivago/prettier-plugin-sort-imports": "*",
@@ -34487,20 +36087,24 @@
         "prettier": "^3.0",
         "prettier-plugin-astro": "*",
         "prettier-plugin-css-order": "*",
-        "prettier-plugin-import-sort": "*",
         "prettier-plugin-jsdoc": "*",
         "prettier-plugin-marko": "*",
         "prettier-plugin-multiline-arrays": "*",
         "prettier-plugin-organize-attributes": "*",
         "prettier-plugin-organize-imports": "*",
         "prettier-plugin-sort-imports": "*",
-        "prettier-plugin-style-order": "*",
         "prettier-plugin-svelte": "*"
       },
       "peerDependenciesMeta": {
         "@ianvs/prettier-plugin-sort-imports": {
           "optional": true
         },
+        "@prettier/plugin-hermes": {
+          "optional": true
+        },
+        "@prettier/plugin-oxc": {
+          "optional": true
+        },
         "@prettier/plugin-pug": {
           "optional": true
         },
@@ -34519,9 +36123,6 @@
         "prettier-plugin-css-order": {
           "optional": true
         },
-        "prettier-plugin-import-sort": {
-          "optional": true
-        },
         "prettier-plugin-jsdoc": {
           "optional": true
         },
@@ -34540,9 +36141,6 @@
         "prettier-plugin-sort-imports": {
           "optional": true
         },
-        "prettier-plugin-style-order": {
-          "optional": true
-        },
         "prettier-plugin-svelte": {
           "optional": true
         }
@@ -34689,16 +36287,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/propagating-hammerjs": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/propagating-hammerjs/-/propagating-hammerjs-1.5.0.tgz",
-      "integrity": "sha512-3PUXWmomwutoZfydC+lJwK1bKCh6sK6jZGB31RUX6+4EXzsbkDZrK4/sVR7gBrvJaEIwpTVyxQUAd29FKkmVdw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "hammerjs": "^2.0.8"
-      }
-    },
     "node_modules/proper-lockfile": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
@@ -35658,14 +37246,14 @@
       "license": "MIT"
     },
     "node_modules/rimraf": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.0.1.tgz",
-      "integrity": "sha512-9dkvaxAsk/xNXSJzMgFqqMCuFgt2+KsOFek3TMLfo8NCPfWpBmqwyNn5Y+NX56QUYfCtsyhF3ayiboEoUmJk/A==",
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.2.tgz",
+      "integrity": "sha512-cFCkPslJv7BAXJsYlK1dZsbP8/ZNLkCAQ0bi1hf5EKX2QHegmDFEFA6QhuYJlk7UDdc+02JjO80YSOrWPpw06g==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "glob": "^11.0.0",
-        "package-json-from-dist": "^1.0.0"
+        "glob": "^13.0.0",
+        "package-json-from-dist": "^1.0.1"
       },
       "bin": {
         "rimraf": "dist/esm/bin.mjs"
@@ -35677,6 +37265,40 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/rimraf/node_modules/glob": {
+      "version": "13.0.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.0.tgz",
+      "integrity": "sha512-tvZgpqk6fz4BaNZ66ZsRaZnbHvP/jG3uKJvAZOwEVUL4RTA5nJeeLYfyN9/VA8NX/V3IBG+hkeuGpKjvELkVhA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.1.1",
+        "minipass": "^7.1.2",
+        "path-scurry": "^2.0.0"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/rimraf/node_modules/minimatch": {
+      "version": "10.1.1",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
+      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/brace-expansion": "^5.0.0"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/roarr": {
       "version": "2.15.4",
       "resolved": "https://registry.npmjs.org/roarr/-/roarr-2.15.4.tgz",
@@ -35945,6 +37567,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
       "integrity": "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -35975,9 +37598,9 @@
       }
     },
     "node_modules/sass": {
-      "version": "1.94.2",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.94.2.tgz",
-      "integrity": "sha512-N+7WK20/wOr7CzA2snJcUSSNTCzeCGUTFY3OgeQP3mZ1aj9NMQ0mSTXwlrnd89j33zzQJGqIN52GIOmYrfq46A==",
+      "version": "1.95.1",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.95.1.tgz",
+      "integrity": "sha512-uPoDh5NIEZV4Dp5GBodkmNY9tSQfXY02pmCcUo+FR1P+x953HGkpw+vV28D4IqYB6f8webZtwoSaZaiPtpTeMg==",
       "license": "MIT",
       "dependencies": {
         "chokidar": "^4.0.0",
@@ -37012,6 +38635,28 @@
         "node": ">=10"
       }
     },
+    "node_modules/sirv": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
+      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@polka/url": "^1.0.0-next.24",
+        "mrmime": "^2.0.0",
+        "totalist": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/sirv/node_modules/@polka/url": {
+      "version": "1.0.0-next.29",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
+      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/sisteransi": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
@@ -37119,12 +38764,12 @@
       }
     },
     "node_modules/source-map": {
-      "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.4.tgz",
-      "integrity": "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==",
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
       "license": "BSD-3-Clause",
       "engines": {
-        "node": ">= 8"
+        "node": ">= 12"
       }
     },
     "node_modules/source-map-js": {
@@ -38126,9 +39771,9 @@
       }
     },
     "node_modules/tailwindcss": {
-      "version": "3.4.17",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.17.tgz",
-      "integrity": "sha512-w33E2aCvSDP0tW9RZuNXadXlkHXqFzSkQew/aIa2i/Sj8fThxwovwlXHSPXTbAHwEIhBFXAedUhP2tueAKP8Og==",
+      "version": "3.4.18",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.18.tgz",
+      "integrity": "sha512-6A2rnmW5xZMdw11LYjhcI5846rt9pbLSabY5XPxo+XWdxwZaFEn47Go4NzFiHu9sNNmr/kXivP1vStfvMaK1GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -38140,7 +39785,7 @@
         "fast-glob": "^3.3.2",
         "glob-parent": "^6.0.2",
         "is-glob": "^4.0.3",
-        "jiti": "^1.21.6",
+        "jiti": "^1.21.7",
         "lilconfig": "^3.1.3",
         "micromatch": "^4.0.8",
         "normalize-path": "^3.0.0",
@@ -38149,7 +39794,7 @@
         "postcss": "^8.4.47",
         "postcss-import": "^15.1.0",
         "postcss-js": "^4.0.1",
-        "postcss-load-config": "^4.0.2",
+        "postcss-load-config": "^4.0.2 || ^5.0 || ^6.0",
         "postcss-nested": "^6.2.0",
         "postcss-selector-parser": "^6.1.2",
         "resolve": "^1.22.8",
@@ -38727,12 +40372,12 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.0.18",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.0.18.tgz",
-      "integrity": "sha512-lCcgTAgMxQ1JKOWrVGo6E69Ukbnx4Gc1wiYLRf6J5NN4HRYJtCby1rPF8rkQ4a6qqoFBK5dvjJ1zJ0F7VfDSvw==",
+      "version": "7.0.19",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.0.19.tgz",
+      "integrity": "sha512-8PWx8tvC4jDB39BQw1m4x8y5MH1BcQ5xHeL2n7UVFulMPH/3Q0uiamahFJ3lXA0zO2SUyRXuVVbWSDmstlt9YA==",
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.0.18"
+        "tldts-core": "^7.0.19"
       },
       "bin": {
         "tldts": "bin/cli.js"
@@ -38790,6 +40435,16 @@
         "node": ">=0.6"
       }
     },
+    "node_modules/totalist": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
+      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/tough-cookie": {
       "version": "4.1.4",
       "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz",
@@ -38862,6 +40517,19 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/trouter": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/trouter/-/trouter-2.0.1.tgz",
+      "integrity": "sha512-kr8SKKw94OI+xTGOkfsvwZQ8mWoikZDd2n8XZHjJVZUARZT+4/VV6cacRS6CLsH9bNm+HFIPU1Zx4CnNnb4qlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "matchit": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/truncate-utf8-bytes": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz",
@@ -39004,13 +40672,13 @@
       }
     },
     "node_modules/ts-morph": {
-      "version": "24.0.0",
-      "resolved": "https://registry.npmjs.org/ts-morph/-/ts-morph-24.0.0.tgz",
-      "integrity": "sha512-2OAOg/Ob5yx9Et7ZX4CvTCc0UFoZHwLEJ+dpDPSUi5TgwwlTlX47w+iFRrEwzUZwYACjq83cgjS/Da50Ga37uw==",
+      "version": "27.0.2",
+      "resolved": "https://registry.npmjs.org/ts-morph/-/ts-morph-27.0.2.tgz",
+      "integrity": "sha512-fhUhgeljcrdZ+9DZND1De1029PrE+cMkIP7ooqkLRTrRLTqcki2AstsyJm0vRNbTbVCNJ0idGlbBrfqc7/nA8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@ts-morph/common": "~0.25.0",
+        "@ts-morph/common": "~0.28.1",
         "code-block-writer": "^13.0.3"
       }
     },
@@ -39535,6 +41203,16 @@
         "node": "*"
       }
     },
+    "node_modules/typanion": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/typanion/-/typanion-3.14.0.tgz",
+      "integrity": "sha512-ZW/lVMRabETuYCd9O9ZvMhAh8GslSqaUjxmK/JLPCh6l73CvLBiuXswj/+7LdnWOgYsQ130FqLzFz5aGT4I3Ug==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "website"
+      ]
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -39884,6 +41562,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/undici": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.16.0.tgz",
+      "integrity": "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/undici-types": {
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
@@ -39930,6 +41618,19 @@
         "node": ">=4"
       }
     },
+    "node_modules/unicorn-magic": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.1.0.tgz",
+      "integrity": "sha512-lRfVq8fE8gz6QMBuDM6a+LO3IAzTi05H6gCVaUpir2E1Rwpo4ZUog45KpNXKC/Mn3Yb9UDuHumeFTo9iV/D9FQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/unified": {
       "version": "11.0.5",
       "resolved": "https://registry.npmjs.org/unified/-/unified-11.0.5.tgz",
@@ -40035,6 +41736,13 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/universal-user-agent": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
@@ -40123,9 +41831,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz",
-      "integrity": "sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.2.tgz",
+      "integrity": "sha512-E85pfNzMQ9jpKkA7+TJAi4TJN+tBCuWh5rUcS/sv6cFi+1q9LYDwDI5dpUL0u/73EElyQ8d3TEaeW4sPedBqYA==",
       "funding": [
         {
           "type": "opencollective",
@@ -40249,9 +41957,9 @@
       }
     },
     "node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
+      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -40259,7 +41967,7 @@
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/v8-compile-cache-lib": {
@@ -40378,19 +42086,58 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/vis": {
-      "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/vis/-/vis-4.21.0.tgz",
-      "integrity": "sha512-jonDXTGm2mFU/X6Kg9pvkZEQtXh2J6+NlDJD1tDP7TDCFy+qNeKlsTcXKQtv4nAtUIiKo6sphCt4kbRlEKw75A==",
-      "deprecated": "Please consider using https://github.com/visjs",
+    "node_modules/vis-data": {
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/vis-data/-/vis-data-8.0.3.tgz",
+      "integrity": "sha512-jhnb6rJNqkKR1Qmlay0VuDXY9ZlvAnYN1udsrP4U+krgZEq7C0yNSKdZqmnCe13mdnf9AdVcdDGFOzy2mpPoqw==",
       "dev": true,
       "license": "(Apache-2.0 OR MIT)",
-      "dependencies": {
-        "emitter-component": "^1.1.1",
-        "hammerjs": "^2.0.8",
-        "keycharm": "^0.2.0",
-        "moment": "^2.18.1",
-        "propagating-hammerjs": "^1.4.6"
+      "peer": true,
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/visjs"
+      },
+      "peerDependencies": {
+        "uuid": "^3.4.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 || ^13.0.0",
+        "vis-util": ">=6.0.0"
+      }
+    },
+    "node_modules/vis-network": {
+      "version": "10.0.2",
+      "resolved": "https://registry.npmjs.org/vis-network/-/vis-network-10.0.2.tgz",
+      "integrity": "sha512-qPl8GLYBeHEFqiTqp4VBbYQIJ2EA8KLr7TstA2E8nJxfEHaKCU81hQLz7hhq11NUpHbMaRzBjW5uZpVKJ45/wA==",
+      "dev": true,
+      "license": "(Apache-2.0 OR MIT)",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/visjs"
+      },
+      "peerDependencies": {
+        "@egjs/hammerjs": "^2.0.0",
+        "component-emitter": "^1.3.0 || ^2.0.0",
+        "keycharm": "^0.2.0 || ^0.3.0 || ^0.4.0",
+        "uuid": "^3.4.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 || ^13.0.0",
+        "vis-data": ">=8.0.0",
+        "vis-util": ">=6.0.0"
+      }
+    },
+    "node_modules/vis-util": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/vis-util/-/vis-util-6.0.0.tgz",
+      "integrity": "sha512-qtpts3HRma0zPe4bO7t9A2uejkRNj8Z2Tb6do6lN85iPNWExFkUiVhdAq5uLGIUqBFduyYeqWJKv/jMkxX0R5g==",
+      "dev": true,
+      "license": "(Apache-2.0 OR MIT)",
+      "peer": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/visjs"
+      },
+      "peerDependencies": {
+        "@egjs/hammerjs": "^2.0.0",
+        "component-emitter": "^1.3.0 || ^2.0.0"
       }
     },
     "node_modules/vite": {
@@ -41311,6 +43058,24 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/webpack-dev-server/node_modules/open": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
+      "integrity": "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==",
+      "license": "MIT",
+      "dependencies": {
+        "default-browser": "^5.2.1",
+        "define-lazy-prop": "^3.0.0",
+        "is-inside-container": "^1.0.0",
+        "wsl-utils": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/webpack-dev-server/node_modules/path-to-regexp": {
       "version": "0.1.12",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
@@ -41895,7 +43660,6 @@
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.1.0.tgz",
       "integrity": "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "is-wsl": "^3.1.0"
@@ -42013,15 +43777,6 @@
         "fd-slicer": "~1.1.0"
       }
     },
-    "node_modules/ylru": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/ylru/-/ylru-1.4.0.tgz",
-      "integrity": "sha512-2OQsPNEmBCvXuFlIni/a+Rn+R2pHW9INm0BxXJ4hVDA8TirqMj+J/Rp9ItLatT/5pZqWwefVrTQcHpixsxnVlA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4.0.0"
-      }
-    },
     "node_modules/yn": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
diff --git a/package.json b/package.json
index 024323a8038..cd1262ac373 100644
--- a/package.json
+++ b/package.json
@@ -44,12 +44,12 @@
     "@angular/compiler-cli": "20.3.15",
     "@babel/core": "7.28.5",
     "@babel/preset-env": "7.28.5",
-    "@compodoc/compodoc": "1.1.26",
+    "@compodoc/compodoc": "1.1.32",
     "@electron/notarize": "3.0.1",
     "@electron/rebuild": "4.0.1",
     "@eslint/compat": "2.0.0",
-    "@lit-labs/signals": "0.1.2",
-    "@ngtools/webpack": "20.3.11",
+    "@lit-labs/signals": "0.1.3",
+    "@ngtools/webpack": "20.3.12",
     "@storybook/addon-a11y": "9.1.16",
     "@storybook/addon-designs": "9.0.0-next.3",
     "@storybook/addon-docs": "9.1.16",
@@ -64,14 +64,14 @@
     "@types/inquirer": "8.2.10",
     "@types/jest": "29.5.14",
     "@types/jsdom": "21.1.7",
-    "@types/koa": "3.0.0",
+    "@types/koa": "3.0.1",
     "@types/koa__multer": "2.0.7",
     "@types/koa__router": "12.0.4",
     "@types/koa-bodyparser": "4.3.7",
     "@types/koa-json": "2.0.23",
     "@types/lowdb": "1.0.15",
     "@types/lunr": "2.3.7",
-    "@types/node": "22.19.1",
+    "@types/node": "22.19.2",
     "@types/node-fetch": "2.6.4",
     "@types/node-forge": "1.3.14",
     "@types/papaparse": "5.5.0",
@@ -83,12 +83,12 @@
     "@webcomponents/custom-elements": "1.6.0",
     "@yao-pkg/pkg": "6.5.1",
     "angular-eslint": "20.7.0",
-    "autoprefixer": "10.4.21",
+    "autoprefixer": "10.4.22",
     "axe-playwright": "2.2.2",
     "babel-loader": "9.2.1",
     "base64-loader": "1.0.0",
-    "browserslist": "4.28.0",
-    "chromatic": "13.3.1",
+    "browserslist": "4.28.1",
+    "chromatic": "13.3.4",
     "concurrently": "9.2.0",
     "copy-webpack-plugin": "13.0.1",
     "cross-env": "10.1.0",
@@ -118,20 +118,20 @@
     "json5": "2.2.3",
     "lint-staged": "16.0.0",
     "mini-css-extract-plugin": "2.9.4",
-    "nx": "21.6.9",
+    "nx": "21.6.10",
     "path-browserify": "1.0.1",
     "postcss": "8.5.6",
     "postcss-loader": "8.2.0",
-    "prettier": "3.6.2",
-    "prettier-plugin-tailwindcss": "0.6.11",
+    "prettier": "3.7.3",
+    "prettier-plugin-tailwindcss": "0.7.1",
     "process": "0.11.10",
     "remark-gfm": "4.0.1",
-    "rimraf": "6.0.1",
-    "sass": "1.94.2",
+    "rimraf": "6.1.2",
+    "sass": "1.95.1",
     "sass-loader": "16.0.6",
     "storybook": "9.1.16",
     "style-loader": "4.0.0",
-    "tailwindcss": "3.4.17",
+    "tailwindcss": "3.4.18",
     "ts-jest": "29.4.5",
     "ts-loader": "9.5.4",
     "tsconfig-paths-webpack-plugin": "4.2.0",
@@ -157,8 +157,8 @@
     "@angular/platform-browser": "20.3.15",
     "@angular/platform-browser-dynamic": "20.3.15",
     "@angular/router": "20.3.15",
-    "@bitwarden/sdk-internal": "0.2.0-main.395",
-    "@bitwarden/commercial-sdk-internal": "0.2.0-main.395",
+    "@bitwarden/sdk-internal": "0.2.0-main.409",
+    "@bitwarden/commercial-sdk-internal": "0.2.0-main.409",
     "@electron/fuses": "1.8.0",
     "@emotion/css": "11.13.5",
     "@koa/multer": "4.0.0",
@@ -166,11 +166,11 @@
     "@microsoft/signalr": "8.0.7",
     "@microsoft/signalr-protocol-msgpack": "8.0.7",
     "@ng-select/ng-select": "20.7.0",
-    "@nx/devkit": "21.6.9",
-    "@nx/eslint": "21.6.9",
-    "@nx/jest": "21.6.9",
-    "@nx/js": "21.6.9",
-    "@nx/webpack": "21.6.9",
+    "@nx/devkit": "21.6.10",
+    "@nx/eslint": "21.6.10",
+    "@nx/jest": "21.6.10",
+    "@nx/js": "21.6.10",
+    "@nx/webpack": "21.6.10",
     "big-integer": "1.6.52",
     "braintree-web-drop-in": "1.46.0",
     "buffer": "6.0.3",
@@ -183,7 +183,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.3",
+    "koa": "3.1.1",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lit": "3.3.1",
@@ -194,7 +194,7 @@
     "node-fetch": "2.6.12",
     "node-forge": "1.3.2",
     "oidc-client-ts": "2.4.1",
-    "open": "10.1.2",
+    "open": "11.0.0",
     "papaparse": "5.5.3",
     "proper-lockfile": "4.1.2",
     "qrcode-parser": "2.1.3",
@@ -202,7 +202,7 @@
     "rxjs": "7.8.1",
     "semver": "7.7.3",
     "tabbable": "6.3.0",
-    "tldts": "7.0.18",
+    "tldts": "7.0.19",
     "ts-node": "10.9.2",
     "utf-8-validate": "6.0.5",
     "vite-tsconfig-paths": "5.1.4",
@@ -217,10 +217,9 @@
       "eslint": "$eslint"
     },
     "tailwindcss": "$tailwindcss",
-    "parse5": "7.2.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "@types/react": "18.3.20"
+    "@types/react": "18.3.27"
   },
   "lint-staged": {
     "*": "prettier --cache --ignore-unknown --write",