Update handlers.py

Merge branch 'release/v2.20.x' into dev
Auto translate strings
2026-02-28 14:26:24 +00:00 · 2026-01-25 22:46:25 -08:00 · 2026-01-25 16:58:04 -08:00 · 2026-01-25 21:47:42 +00:00 · 2026-01-25 13:45:50 -08:00 · 2026-01-25 03:31:55 +00:00
364 changed files with 16206 additions and 20195 deletions
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -1,6 +1,7 @@
+# https://docs.codecov.com/docs/codecovyml-reference#codecov
 codecov:
  require_ci_to_pass: true
-  # https://docs.codecov.com/docs/components
+# https://docs.codecov.com/docs/components
 component_management:
  individual_components:
    - component_id: backend
@@ -9,26 +10,70 @@ component_management:
    - component_id: frontend
      paths:
        - src-ui/**
-# https://docs.codecov.com/docs/pull-request-comments
+# https://docs.codecov.com/docs/flags#step-2-flag-management-in-yaml
+# https://docs.codecov.com/docs/carryforward-flags
+flags:
+  # Backend Python versions
+  backend-python-3.10:
+    paths:
+      - src/**
+    carryforward: true
+  backend-python-3.11:
+    paths:
+      - src/**
+    carryforward: true
+  backend-python-3.12:
+    paths:
+      - src/**
+    carryforward: true
+  # Frontend (shards merge into single flag)
+  frontend-node-24.x:
+    paths:
+      - src-ui/**
+    carryforward: true
 comment:
  layout: "header, diff, components, flags, files"
-  # https://docs.codecov.com/docs/javascript-bundle-analysis
  require_bundle_changes: true
  bundle_change_threshold: "50Kb"
 coverage:
+  # https://docs.codecov.com/docs/commit-status
  status:
    project:
-      default:
+      backend:
+        flags:
+          - backend-python-3.10
+          - backend-python-3.11
+          - backend-python-3.12
+        paths:
+          - src/**
        # https://docs.codecov.com/docs/commit-status#threshold
        threshold: 1%
+        removed_code_behavior: adjust_base
+      frontend:
+        flags:
+          - frontend-node-24.x
+        paths:
+          - src-ui/**
+        threshold: 1%
+        removed_code_behavior: adjust_base
    patch:
-      default:
-        # For the changed lines only, target 100% covered, but
-        # allow as low as 75%
+      backend:
+        flags:
+          - backend-python-3.10
+          - backend-python-3.11
+          - backend-python-3.12
+        paths:
+          - src/**
+        target: 100%
+        threshold: 25%
+      frontend:
+        flags:
+          - frontend-node-24.x
+        paths:
+          - src-ui/**
        target: 100%
        threshold: 25%
 # https://docs.codecov.com/docs/javascript-bundle-analysis
 bundle_analysis:
-  # Fail if the bundle size increases by more than 1MB
  warning_threshold: "1MB"
  status: true
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1

-FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim as main-app
+FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim as main-app

 ARG DEBIAN_FRONTEND=noninteractive

--- a/.devcontainer/vscode/tasks.json
+++ b/.devcontainer/vscode/tasks.json
@@ -116,9 +116,9 @@
 		},
 		{
 			"label": "Maintenance: Build Documentation",
-			"description": "Build the documentation with Zensical",
+			"description": "Build the documentation with MkDocs",
 			"type": "shell",
-			"command": "uv run zensical build && uv run zensical serve",
+			"command": "uv run mkdocs build --config-file mkdocs.yml && uv run mkdocs serve",
 			"group": "none",
 			"presentation": {
 				"echo": true,
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -46,7 +46,7 @@ updates:
        patterns:
          - "*pytest*"
          - "ruff"
-          - "zensical"
+          - "mkdocs-material"
          - "pre-commit*"
      # Django & DRF Ecosystem
      django-ecosystem:
--- a/.github/workflows/ci-backend.yml
+++ b/.github/workflows/ci-backend.yml
@@ -0,0 +1,104 @@
+name: Backend Tests
+on:
+  push:
+    branches-ignore:
+      - 'translations**'
+    paths:
+      - 'src/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'docker/compose/docker-compose.ci-test.yml'
+      - '.github/workflows/ci-backend.yml'
+  pull_request:
+    branches-ignore:
+      - 'translations**'
+    paths:
+      - 'src/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'docker/compose/docker-compose.ci-test.yml'
+      - '.github/workflows/ci-backend.yml'
+  workflow_dispatch:
+concurrency:
+  group: backend-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  DEFAULT_UV_VERSION: "0.9.x"
+  NLTK_DATA: "/usr/share/nltk_data"
+jobs:
+  test:
+    name: "Python ${{ matrix.python-version }}"
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        python-version: ['3.10', '3.11', '3.12']
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Start containers
+        run: |
+          docker compose --file docker/compose/docker-compose.ci-test.yml pull --quiet
+          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "${{ matrix.python-version }}"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends \
+            unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
+      - name: Configure ImageMagick
+        run: |
+          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
+      - name: Install Python dependencies
+        run: |
+          uv sync \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --group testing \
+            --frozen
+      - name: List installed Python dependencies
+        run: |
+          uv pip list
+      - name: Install NLTK data
+        run: |
+          uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
+      - name: Run tests
+        env:
+          NLTK_DATA: ${{ env.NLTK_DATA }}
+          PAPERLESS_CI_TEST: 1
+          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
+          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
+          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
+        run: |
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            pytest
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          flags: backend-python-${{ matrix.python-version }}
+          files: junit.xml
+          report_type: test_results
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          flags: backend-python-${{ matrix.python-version }}
+          files: coverage.xml
+          report_type: coverage
+      - name: Stop containers
+        if: always()
+        run: |
+          docker compose --file docker/compose/docker-compose.ci-test.yml logs
+          docker compose --file docker/compose/docker-compose.ci-test.yml down
--- a/.github/workflows/ci-docker.yml
+++ b/.github/workflows/ci-docker.yml
@@ -0,0 +1,251 @@
+name: Docker Build
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
+    branches:
+      - dev
+      - beta
+  pull_request:
+    branches:
+      - dev
+      - main
+  workflow_dispatch:
+concurrency:
+  group: docker-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  REGISTRY: ghcr.io
+jobs:
+  build-arch:
+    name: Build ${{ matrix.arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            arch: amd64
+            platform: linux/amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+            platform: linux/arm64
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      should-push: ${{ steps.check-push.outputs.should-push }}
+      push-external: ${{ steps.check-push.outputs.push-external }}
+      repository: ${{ steps.repo.outputs.name }}
+      ref-name: ${{ steps.ref.outputs.name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.1
+      - name: Determine ref name
+        id: ref
+        run: |
+          ref_name="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
+          # Sanitize by replacing / with - for cache keys
+          cache_ref="${ref_name//\//-}"
+
+          echo "ref_name=${ref_name}"
+          echo "cache_ref=${cache_ref}"
+
+          echo "name=${ref_name}" >> $GITHUB_OUTPUT
+          echo "cache-ref=${cache_ref}" >> $GITHUB_OUTPUT
+      - name: Check push permissions
+        id: check-push
+        env:
+          REF_NAME: ${{ steps.ref.outputs.name }}
+        run: |
+          # should-push: Should we push to GHCR?
+          # True for:
+          #   1. Pushes (tags/dev/beta) - filtered via the workflow triggers
+          #   2. Internal PRs where the branch name starts with 'feature-' - filtered here when a PR is synced
+
+          should_push="false"
+
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            should_push="true"
+          elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
+            if [[ "${REF_NAME}" == feature-* || "${REF_NAME}" == fix-* ]]; then
+              should_push="true"
+            fi
+          fi
+
+          echo "should-push=${should_push}"
+          echo "should-push=${should_push}" >> $GITHUB_OUTPUT
+
+          # push-external: Should we also push to Docker Hub and Quay.io?
+          # Only for main repo on dev/beta branches or version tags
+          push_external="false"
+          if [[ "${should_push}" == "true" && "${{ github.repository_owner }}" == "paperless-ngx" ]]; then
+            case "${REF_NAME}" in
+              dev|beta)
+                push_external="true"
+                ;;
+            esac
+            case "${{ github.ref }}" in
+              refs/tags/v*|*beta.rc*)
+                push_external="true"
+                ;;
+            esac
+          fi
+          echo "push-external=${push_external}"
+          echo "push-external=${push_external}" >> $GITHUB_OUTPUT
+      - name: Set repository name
+        id: repo
+        run: |
+          repo_name="${{ github.repository }}"
+          repo_name="${repo_name,,}"
+
+          echo "repository=${repo_name}"
+          echo "name=${repo_name}" >> $GITHUB_OUTPUT
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.12.0
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Maximize space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
+      - name: Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5.10.0
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
+          tags: |
+            type=ref,event=branch
+            type=raw,value=${{ steps.ref.outputs.name }},enable=${{ github.event_name == 'pull_request' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6.18.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
+          outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }},push-by-digest=true,name-canonical=true,push=${{ steps.check-push.outputs.should-push }}
+          cache-from: |
+            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:${{ steps.ref.outputs.cache-ref }}-${{ matrix.arch }}
+            type=registry,ref=${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/cache/app:dev-${{ matrix.arch }}
+          cache-to: ${{ steps.check-push.outputs.should-push == 'true' && format('type=registry,mode=max,ref={0}/{1}/cache/app:{2}-{3}', env.REGISTRY, steps.repo.outputs.name, steps.ref.outputs.cache-ref, matrix.arch) || '' }}
+      - name: Export digest
+        if: steps.check-push.outputs.should-push == 'true'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          echo "digest=${digest}"
+          touch "/tmp/digests/${digest#sha256:}"
+      - name: Upload digest
+        if: steps.check-push.outputs.should-push == 'true'
+        uses: actions/upload-artifact@v6.0.0
+        with:
+          name: digests-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+  merge-and-push:
+    name: Merge and Push Manifest
+    runs-on: ubuntu-24.04
+    needs: build-arch
+    if: needs.build-arch.outputs.should-push == 'true'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v7.0.0
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+      - name: List digests
+        run: |
+          echo "Downloaded digests:"
+          ls -la /tmp/digests/
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.12.0
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        if: needs.build-arch.outputs.push-external == 'true'
+        uses: docker/login-action@v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to Quay.io
+        if: needs.build-arch.outputs.push-external == 'true'
+        uses: docker/login-action@v3.6.0
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+      - name: Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5.10.0
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
+          tags: |
+            type=ref,event=branch
+            type=raw,value=${{ needs.build-arch.outputs.ref-name }},enable=${{ github.event_name == 'pull_request' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        env:
+          REPOSITORY: ${{ needs.build-arch.outputs.repository }}
+        run: |
+          tags=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "${DOCKER_METADATA_OUTPUT_JSON}")
+
+          digests=""
+          for digest in *; do
+            digests+="${{ env.REGISTRY }}/${REPOSITORY}@sha256:${digest} "
+          done
+
+          echo "Creating manifest with tags: ${tags}"
+          echo "From digests: ${digests}"
+
+          docker buildx imagetools create ${tags} ${digests}
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+      - name: Copy to Docker Hub
+        if: needs.build-arch.outputs.push-external == 'true'
+        env:
+          TAGS: ${{ steps.docker-meta.outputs.tags }}
+          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
+        run: |
+          for tag in ${TAGS}; do
+            dockerhub_tag="${tag/${GHCR_REPO}/docker.io/paperlessngx/paperless-ngx}"
+            echo "Copying ${tag} to ${dockerhub_tag}"
+            skopeo copy --all "docker://${tag}" "docker://${dockerhub_tag}"
+          done
+      - name: Copy to Quay.io
+        if: needs.build-arch.outputs.push-external == 'true'
+        env:
+          TAGS: ${{ steps.docker-meta.outputs.tags }}
+          GHCR_REPO: ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
+        run: |
+          for tag in ${TAGS}; do
+            quay_tag="${tag/${GHCR_REPO}/quay.io/paperlessngx/paperless-ngx}"
+            echo "Copying ${tag} to ${quay_tag}"
+            skopeo copy --all "docker://${tag}" "docker://${quay_tag}"
+          done
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -0,0 +1,88 @@
+name: Documentation
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/ci-docs.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/ci-docs.yml'
+  workflow_dispatch:
+concurrency:
+  group: docs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  DEFAULT_UV_VERSION: "0.9.x"
+  DEFAULT_PYTHON_VERSION: "3.11"
+jobs:
+  build:
+    name: Build Documentation
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Build documentation
+        run: |
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs build --config-file ./mkdocs.yml
+      - name: Upload artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: documentation
+          path: site/
+          retention-days: 7
+  deploy:
+    name: Deploy Documentation
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Deploy documentation
+        run: |
+          echo "docs.paperless-ngx.com" > "${{ github.workspace }}/docs/CNAME"
+          git config --global user.name "${{ github.actor }}"
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs gh-deploy --force --no-history
--- a/.github/workflows/ci-frontend.yml
+++ b/.github/workflows/ci-frontend.yml
@@ -0,0 +1,189 @@
+name: Frontend Tests
+on:
+  push:
+    branches-ignore:
+      - 'translations**'
+    paths:
+      - 'src-ui/**'
+      - '.github/workflows/ci-frontend.yml'
+  pull_request:
+    branches-ignore:
+      - 'translations**'
+    paths:
+      - 'src-ui/**'
+      - '.github/workflows/ci-frontend.yml'
+  workflow_dispatch:
+concurrency:
+  group: frontend-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  install-dependencies:
+    name: Install Dependencies
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        id: cache-frontend-deps
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Install dependencies
+        run: cd src-ui && pnpm install
+  lint:
+    name: Lint
+    needs: install-dependencies
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular CLI
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Run lint
+        run: cd src-ui && pnpm run lint
+  unit-tests:
+    name: "Unit Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
+    needs: install-dependencies
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [24.x]
+        shard-index: [1, 2, 3, 4]
+        shard-count: [4]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular CLI
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Run Jest unit tests
+        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          flags: frontend-node-${{ matrix.node-version }}
+          directory: src-ui/
+          report_type: test_results
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          flags: frontend-node-${{ matrix.node-version }}
+          directory: src-ui/coverage/
+  e2e-tests:
+    name: "E2E Tests (${{ matrix.shard-index }}/${{ matrix.shard-count }})"
+    needs: install-dependencies
+    runs-on: ubuntu-24.04
+    container: mcr.microsoft.com/playwright:v1.57.0-noble
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [24.x]
+        shard-index: [1, 2]
+        shard-count: [2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular CLI
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Install dependencies
+        run: cd src-ui && pnpm install --no-frozen-lockfile
+      - name: Run Playwright E2E tests
+        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
+  bundle-analysis:
+    name: Bundle Analysis
+    needs: [unit-tests, e2e-tests]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Cache frontend dependencies
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.pnpm-store
+            ~/.cache
+          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
+      - name: Re-link Angular CLI
+        run: cd src-ui && pnpm link @angular/cli
+      - name: Build and analyze
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        run: cd src-ui && pnpm run build --configuration=production
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -0,0 +1,24 @@
+name: Lint
+on:
+  push:
+    branches-ignore:
+      - 'translations**'
+  pull_request:
+    branches-ignore:
+      - 'translations**'
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  pre-commit:
+    name: Pre-commit Checks
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Run pre-commit
+        uses: pre-commit/action@v3.0.1
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -0,0 +1,237 @@
+name: Release
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+env:
+  DEFAULT_UV_VERSION: "0.9.x"
+  DEFAULT_PYTHON_VERSION: "3.11"
+jobs:
+  wait-for-docker:
+    name: Wait for Docker Build
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Wait for Docker build
+        uses: lewagon/wait-on-check-action@v1.4.1
+        with:
+          ref: ${{ github.sha }}
+          check-name: 'Build Docker Image'
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 60
+  build-release:
+    name: Build Release
+    needs: wait-for-docker
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      # ---- Frontend Build ----
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: 'pnpm'
+          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+      - name: Install frontend dependencies
+        run: cd src-ui && pnpm install
+      - name: Build frontend
+        run: cd src-ui && pnpm run build --configuration production
+      # ---- Backend Setup ----
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ steps.setup-python.outputs.python-version }}
+      - name: Install Python dependencies
+        run: |
+          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq --no-install-recommends gettext liblept5
+      # ---- Build Documentation ----
+      - name: Build documentation
+        run: |
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            --frozen \
+            mkdocs build --config-file ./mkdocs.yml
+      # ---- Prepare Release ----
+      - name: Generate requirements file
+        run: |
+          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
+      - name: Compile messages
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py compilemessages
+      - name: Collect static files
+        run: |
+          cd src/
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            manage.py collectstatic --no-input --clear
+      - name: Assemble release package
+        run: |
+          mkdir -p dist/paperless-ngx/scripts
+
+          for file_name in .dockerignore \
+                          .env \
+                          Dockerfile \
+                          pyproject.toml \
+                          uv.lock \
+                          requirements.txt \
+                          LICENSE \
+                          README.md \
+                          paperless.conf.example
+          do
+            cp --verbose ${file_name} dist/paperless-ngx/
+          done
+          mv dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
+
+          cp --recursive docker/ dist/paperless-ngx/docker
+          cp scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
+          cp --recursive src/ dist/paperless-ngx/src
+          cp --recursive site/ dist/paperless-ngx/docs
+          mv static dist/paperless-ngx/
+
+          find dist/paperless-ngx -name "__pycache__" -type d -exec rm -rf {} +
+      - name: Create release archive
+        run: |
+          cd dist
+          sudo chown -R 1000:1000 paperless-ngx/
+          tar -cJf paperless-ngx.tar.xz paperless-ngx/
+      - name: Upload release artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: release
+          path: dist/paperless-ngx.tar.xz
+          retention-days: 7
+  publish-release:
+    name: Publish Release
+    needs: build-release
+    runs-on: ubuntu-24.04
+    outputs:
+      prerelease: ${{ steps.get-version.outputs.prerelease }}
+      changelog: ${{ steps.create-release.outputs.body }}
+      version: ${{ steps.get-version.outputs.version }}
+    steps:
+      - name: Download release artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: release
+          path: ./
+      - name: Get version info
+        id: get-version
+        run: |
+          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+          if [[ "${{ github.ref_name }}" == *"-beta.rc"* ]]; then
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Create release and changelog
+        id: create-release
+        uses: release-drafter/release-drafter@v6
+        with:
+          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
+          tag: ${{ steps.get-version.outputs.version }}
+          version: ${{ steps.get-version.outputs.version }}
+          prerelease: ${{ steps.get-version.outputs.prerelease }}
+          publish: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload release archive
+        uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ./paperless-ngx.tar.xz
+          asset_name: paperless-ngx-${{ steps.get-version.outputs.version }}.tar.xz
+          asset_content_type: application/x-xz
+  # ---------------------------------------------------------------------------
+  # Append changelog to docs (only on non-prerelease)
+  # ---------------------------------------------------------------------------
+  append-changelog:
+    name: Append Changelog
+    needs: publish-release
+    if: needs.publish-release.outputs.prerelease == 'false'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: main
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: ${{ env.DEFAULT_UV_VERSION }}
+          enable-cache: true
+          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
+      - name: Update changelog
+        working-directory: docs
+        run: |
+          git branch ${{ needs.publish-release.outputs.version }}-changelog
+          git checkout ${{ needs.publish-release.outputs.version }}-changelog
+
+          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
+
+          echo "Manually linking usernames"
+          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
+
+          echo "Removing unneeded comment tags"
+          sed -i -r 's|@<!---->|@|g' changelog-new.md
+
+          CURRENT_CHANGELOG=$(tail --lines +2 changelog.md)
+          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
+          mv changelog-new.md changelog.md
+
+          uv run \
+            --python ${{ steps.setup-python.outputs.python-version }} \
+            --dev \
+            pre-commit run --files changelog.md || true
+
+          git config --global user.name "github-actions"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
+          git push origin ${{ needs.publish-release.outputs.version }}-changelog
+      - name: Create pull request
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { repo, owner } = context.repo;
+            const result = await github.rest.pulls.create({
+              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
+              owner,
+              repo,
+              head: '${{ needs.publish-release.outputs.version }}-changelog',
+              base: 'main',
+              body: 'This PR is auto-generated by CI.'
+            });
+            github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: result.data.number,
+              labels: ['documentation', 'skip-changelog']
+            });
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,714 +0,0 @@
-name: ci
-on:
-  push:
-    tags:
-      # https://semver.org/#spec-item-2
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-      # https://semver.org/#spec-item-9
-      - 'v[0-9]+.[0-9]+.[0-9]+-beta.rc[0-9]+'
-    branches-ignore:
-      - 'translations**'
-  pull_request:
-    branches-ignore:
-      - 'translations**'
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-env:
-  DEFAULT_UV_VERSION: "0.9.x"
-  # This is the default version of Python to use in most steps which aren't specific
-  DEFAULT_PYTHON_VERSION: "3.11"
-  NLTK_DATA: "/usr/share/nltk_data"
-jobs:
-  detect-duplicate:
-    name: Detect Duplicate Run
-    runs-on: ubuntu-24.04
-    outputs:
-      should_run: ${{ steps.check.outputs.should_run }}
-    steps:
-      - name: Check if workflow should run
-        id: check
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            if (context.eventName !== 'push') {
-              core.info('Not a push event; running workflow.');
-              core.setOutput('should_run', 'true');
-              return;
-            }
-
-            const ref = context.ref || '';
-            if (!ref.startsWith('refs/heads/')) {
-              core.info('Push is not to a branch; running workflow.');
-              core.setOutput('should_run', 'true');
-              return;
-            }
-
-            const branch = ref.substring('refs/heads/'.length);
-            const { owner, repo } = context.repo;
-            const prs = await github.paginate(github.rest.pulls.list, {
-              owner,
-              repo,
-              state: 'open',
-              head: `${owner}:${branch}`,
-              per_page: 100,
-            });
-
-            if (prs.length === 0) {
-              core.info(`No open PR found for ${branch}; running workflow.`);
-              core.setOutput('should_run', 'true');
-            } else {
-              core.info(`Found ${prs.length} open PR(s) for ${branch}; skipping duplicate push run.`);
-              core.setOutput('should_run', 'false');
-            }
-  pre-commit:
-    needs:
-      - detect-duplicate
-    if: needs.detect-duplicate.outputs.should_run == 'true'
-    name: Linting Checks
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Install python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Check files
-        uses: pre-commit/action@v3.0.1
-  documentation:
-    name: "Build Documentation"
-    runs-on: ubuntu-24.04
-    needs:
-      - pre-commit
-    steps:
-      - uses: actions/configure-pages@v5
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Make documentation
-        run: |
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            zensical build --clean
-      - name: Upload documentation artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: documentation
-          path: site/
-      - uses: actions/upload-pages-artifact@v4
-        with:
-          path: site
-          name: github-pages-${{ github.run_id }}-${{ github.run_attempt }}
-  deploy-documentation:
-    name: "Deploy Documentation"
-    runs-on: ubuntu-24.04
-    needs:
-      - documentation
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - uses: actions/deploy-pages@v4
-        id: deployment
-        with:
-          artifact_name: github-pages-${{ github.run_id }}-${{ github.run_attempt }}
-  tests-backend:
-    name: "Backend Tests (Python ${{ matrix.python-version }})"
-    runs-on: ubuntu-24.04
-    needs:
-      - pre-commit
-    strategy:
-      matrix:
-        python-version: ['3.10', '3.11', '3.12']
-      fail-fast: false
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Start containers
-        run: |
-          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml pull --quiet
-          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml up --detach
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "${{ matrix.python-version }}"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ steps.setup-python.outputs.python-version }}
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -qq --no-install-recommends unpaper tesseract-ocr imagemagick ghostscript libzbar0 poppler-utils
-      - name: Configure ImageMagick
-        run: |
-          sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
-      - name: Install Python dependencies
-        run: |
-          uv sync \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --group testing \
-            --frozen
-      - name: List installed Python dependencies
-        run: |
-          uv pip list
-      - name: Install or update NLTK dependencies
-        run: uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
-      - name: Tests
-        env:
-          NLTK_DATA: ${{ env.NLTK_DATA }}
-          PAPERLESS_CI_TEST: 1
-          # Enable paperless_mail testing against real server
-          PAPERLESS_MAIL_TEST_HOST: ${{ secrets.TEST_MAIL_HOST }}
-          PAPERLESS_MAIL_TEST_USER: ${{ secrets.TEST_MAIL_USER }}
-          PAPERLESS_MAIL_TEST_PASSWD: ${{ secrets.TEST_MAIL_PASSWD }}
-        run: |
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            --frozen \
-            pytest
-      - name: Upload backend test results to Codecov
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          flags: backend-python-${{ matrix.python-version }}
-          files: junit.xml
-          report_type: test_results
-      - name: Upload backend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          flags: backend-python-${{ matrix.python-version }}
-          files: coverage.xml
-      - name: Stop containers
-        if: always()
-        run: |
-          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml logs
-          docker compose --file ${{ github.workspace }}/docker/compose/docker-compose.ci-test.yml down
-  install-frontend-dependencies:
-    name: "Install Frontend Dependencies"
-    runs-on: ubuntu-24.04
-    needs:
-      - pre-commit
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 20
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        id: cache-frontend-deps
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Install dependencies
-        run: cd src-ui && pnpm install
-  tests-frontend:
-    name: "Frontend Unit Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
-    runs-on: ubuntu-24.04
-    needs:
-      - install-frontend-dependencies
-    strategy:
-      fail-fast: false
-      matrix:
-        node-version: [20.x]
-        shard-index: [1, 2, 3, 4]
-        shard-count: [4]
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 20
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        id: cache-frontend-deps
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular cli
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Linting checks
-        run: cd src-ui && pnpm run lint
-      - name: Run Jest unit tests
-        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
-      - name: Upload frontend test results to Codecov
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          flags: frontend-node-${{ matrix.node-version }}
-          directory: src-ui/
-          report_type: test_results
-      - name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          flags: frontend-node-${{ matrix.node-version }}
-          directory: src-ui/coverage/
-  tests-frontend-e2e:
-    name: "Frontend E2E Tests (Node ${{ matrix.node-version }} - ${{ matrix.shard-index }}/${{ matrix.shard-count }})"
-    runs-on: ubuntu-24.04
-    container: mcr.microsoft.com/playwright:v1.57.0-noble
-    needs:
-      - install-frontend-dependencies
-    env:
-      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
-      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-    strategy:
-      fail-fast: false
-      matrix:
-        node-version: [20.x]
-        shard-index: [1, 2]
-        shard-count: [2]
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 20
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        id: cache-frontend-deps
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular cli
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Install dependencies
-        run: cd src-ui && pnpm install --no-frozen-lockfile
-      - name: Run Playwright e2e tests
-        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
-  frontend-bundle-analysis:
-    name: "Frontend Bundle Analysis"
-    runs-on: ubuntu-24.04
-    needs:
-      - tests-frontend
-      - tests-frontend-e2e
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - name: Use Node.js 20
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
-      - name: Cache frontend dependencies
-        id: cache-frontend-deps
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            ~/.cache
-          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/package-lock.json') }}
-      - name: Re-link Angular cli
-        run: cd src-ui && pnpm link @angular/cli
-      - name: Build frontend and upload analysis
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        run: cd src-ui && pnpm run build --configuration=production
-  build-docker-image:
-    name: Build Docker image for ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: write
-    if: (github.event_name == 'push' && (startsWith(github.ref, 'refs/heads/feature-') || startsWith(github.ref, 'refs/heads/fix-') || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/beta' || contains(github.ref, 'beta.rc') || startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/heads/l10n_'))) || (github.event_name == 'pull_request' && (startsWith(github.head_ref, 'feature-') || startsWith(github.head_ref, 'fix-') || github.head_ref == 'dev' || github.head_ref == 'beta' || contains(github.head_ref, 'beta.rc') || startsWith(github.head_ref, 'l10n_')))
-    concurrency:
-      group: ${{ github.workflow }}-build-docker-image-${{ github.ref_name }}
-      cancel-in-progress: true
-    needs:
-      - tests-backend
-      - tests-frontend
-      - tests-frontend-e2e
-    steps:
-      - name: Prepare build variables
-        id: build-vars
-        uses: actions/github-script@v8
-        with:
-          result-encoding: string
-          script: |
-            const isPR = context.eventName === 'pull_request';
-            const defaultRefName = context.ref.replace('refs/heads/', '');
-            const headRef = isPR ? context.payload.pull_request.head.ref : defaultRefName;
-            const buildRef = isPR ? `refs/heads/${headRef}` : context.ref;
-            const buildCacheKey = headRef.split('/').join('-');
-            const canPush = context.eventName === 'push' || (isPR && context.payload.pull_request.head.repo.full_name === `${context.repo.owner}/${context.repo.repo}`);
-
-            core.setOutput('build-ref', buildRef);
-            core.setOutput('build-ref-name', headRef);
-            core.setOutput('build-cache-key', buildCacheKey);
-            core.setOutput('can-push', canPush ? 'true' : 'false');
-      - name: Check pushing to Docker Hub
-        id: push-other-places
-        # Only push to Dockerhub from the main repo AND the ref is either:
-        #  main
-        #  dev
-        #  beta
-        #  a tag
-        # Otherwise forks would require a Docker Hub account and secrets setup
-        env:
-          BUILD_REF: ${{ steps.build-vars.outputs.build-ref }}
-          BUILD_REF_NAME: ${{ steps.build-vars.outputs.build-ref-name }}
-        run: |
-          if [[ ${{ github.repository_owner }} == "paperless-ngx" && ( "$BUILD_REF_NAME" == "dev" || "$BUILD_REF_NAME" == "beta" || $BUILD_REF == refs/tags/v* || $BUILD_REF == *beta.rc* ) ]] ; then
-            echo "Enabling DockerHub image push"
-            echo "enable=true" >> $GITHUB_OUTPUT
-          else
-            echo "Not pushing to DockerHub"
-            echo "enable=false" >> $GITHUB_OUTPUT
-          fi
-      - name: Set ghcr repository name
-        id: set-ghcr-repository
-        run: |
-          ghcr_name=$(echo "${{ github.repository }}" | awk '{ print tolower($0) }')
-          echo "Name is ${ghcr_name}"
-          echo "ghcr-repository=${ghcr_name}" >> $GITHUB_OUTPUT
-      - name: Gather Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}
-            name=paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
-            name=quay.io/paperlessngx/paperless-ngx,enable=${{ steps.push-other-places.outputs.enable }}
-          tags: |
-            # Tag branches with branch name
-            type=ref,event=branch
-            # Pull requests need a sanitized branch tag for pushing images
-            type=raw,value=${{ steps.build-vars.outputs.build-cache-key }},enable=${{ github.event_name == 'pull_request' }}
-            # Process semver tags
-            # For a tag x.y.z or vX.Y.Z, output an x.y.z and x.y image tag
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-      - name: Checkout
-        uses: actions/checkout@v6
-      # If https://github.com/docker/buildx/issues/1044 is resolved,
-      # the append input with a native arm64 arch could be used to
-      # significantly speed up building
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        # Don't attempt to login if not pushing to Docker Hub
-        if: steps.push-other-places.outputs.enable == 'true'
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to Quay.io
-        uses: docker/login-action@v3
-        # Don't attempt to login if not pushing to Quay.io
-        if: steps.push-other-places.outputs.enable == 'true'
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: ${{ steps.build-vars.outputs.can-push == 'true' }}
-          tags: ${{ steps.docker-meta.outputs.tags }}
-          labels: ${{ steps.docker-meta.outputs.labels }}
-          build-args: |
-            PNGX_TAG_VERSION=${{ steps.docker-meta.outputs.version }}
-          # Get cache layers from this branch, then dev
-          # This allows new branches to get at least some cache benefits, generally from dev
-          cache-from: |
-            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:${{ steps.build-vars.outputs.build-cache-key }}
-            type=registry,ref=ghcr.io/${{ steps.set-ghcr-repository.outputs.ghcr-repository }}/builder/cache/app:dev
-          cache-to: ${{ steps.build-vars.outputs.can-push == 'true' && format('type=registry,mode=max,ref=ghcr.io/{0}/builder/cache/app:{1}', steps.set-ghcr-repository.outputs.ghcr-repository, steps.build-vars.outputs.build-cache-key) || '' }}
-      - name: Inspect image
-        if: steps.build-vars.outputs.can-push == 'true'
-        run: |
-          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
-      - name: Export frontend artifact from docker
-        if: steps.build-vars.outputs.can-push == 'true'
-        run: |
-          docker create --name frontend-extract ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
-          docker cp frontend-extract:/usr/src/paperless/src/documents/static/frontend src/documents/static/frontend/
-      - name: Upload frontend artifact
-        if: steps.build-vars.outputs.can-push == 'true'
-        uses: actions/upload-artifact@v5
-        with:
-          name: frontend-compiled
-          path: src/documents/static/frontend/
-          retention-days: 7
-  build-release:
-    name: "Build Release"
-    needs:
-      - build-docker-image
-      - documentation
-    if: github.event_name == 'push'
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ steps.setup-python.outputs.python-version }}
-      - name: Install Python dependencies
-        run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -qq --no-install-recommends gettext liblept5
-      - name: Download frontend artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: frontend-compiled
-          path: src/documents/static/frontend/
-      - name: Download documentation artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: documentation
-          path: docs/_build/html/
-      - name: Generate requirements file
-        run: |
-          uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
-      - name: Compile messages
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py compilemessages
-      - name: Collect static files
-        run: |
-          cd src/
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            manage.py collectstatic --no-input
-      - name: Move files
-        run: |
-          echo "Making dist folders"
-          for directory in dist \
-                          dist/paperless-ngx \
-                          dist/paperless-ngx/scripts;
-          do
-            mkdir --verbose --parents ${directory}
-          done
-
-          echo "Copying basic files"
-          for file_name in .dockerignore \
-                          .env \
-                          Dockerfile \
-                          pyproject.toml \
-                          uv.lock \
-                          requirements.txt \
-                          LICENSE \
-                          README.md \
-                          paperless.conf.example
-          do
-            cp --verbose ${file_name} dist/paperless-ngx/
-          done
-          mv --verbose dist/paperless-ngx/paperless.conf.example dist/paperless-ngx/paperless.conf
-
-          echo "Copying Docker related files"
-          cp --recursive docker/ dist/paperless-ngx/docker
-
-          echo "Copying startup scripts"
-          cp --verbose scripts/*.service scripts/*.sh scripts/*.socket dist/paperless-ngx/scripts/
-
-          echo "Copying source files"
-          cp --recursive src/ dist/paperless-ngx/src
-          echo "Copying documentation"
-          cp --recursive docs/_build/html/ dist/paperless-ngx/docs
-
-          mv --verbose static dist/paperless-ngx
-      - name: Make release package
-        run: |
-          echo "Creating release archive"
-          cd dist
-          sudo chown -R 1000:1000 paperless-ngx/
-          tar -cJf paperless-ngx.tar.xz paperless-ngx/
-      - name: Upload release artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: release
-          path: dist/paperless-ngx.tar.xz
-          retention-days: 7
-  publish-release:
-    name: "Publish Release"
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    outputs:
-      prerelease: ${{ steps.get_version.outputs.prerelease }}
-      changelog: ${{ steps.create-release.outputs.body }}
-      version: ${{ steps.get_version.outputs.version }}
-    needs:
-      - build-release
-    if: github.ref_type == 'tag' && (startsWith(github.ref_name, 'v') || contains(github.ref_name, '-beta.rc'))
-    steps:
-      - name: Download release artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: release
-          path: ./
-      - name: Get version
-        id: get_version
-        run: |
-          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
-          if [[ ${{ contains(github.ref_name, '-beta.rc') }} == 'true' ]]; then
-            echo "prerelease=true" >> $GITHUB_OUTPUT
-          else
-            echo "prerelease=false" >> $GITHUB_OUTPUT
-          fi
-      - name: Create Release and Changelog
-        id: create-release
-        uses: release-drafter/release-drafter@v6
-        with:
-          name: Paperless-ngx ${{ steps.get_version.outputs.version }}
-          tag: ${{ steps.get_version.outputs.version }}
-          version: ${{ steps.get_version.outputs.version }}
-          prerelease: ${{ steps.get_version.outputs.prerelease }}
-          publish: true # ensures release is not marked as draft
-          commitish: main
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload release archive
-        id: upload-release-asset
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: ./paperless-ngx.tar.xz
-          asset_name: paperless-ngx-${{ steps.get_version.outputs.version }}.tar.xz
-          asset_content_type: application/x-xz
-  append-changelog:
-    name: "Append Changelog"
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-    needs:
-      - publish-release
-    if: needs.publish-release.outputs.prerelease == 'false'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: main
-      - name: Set up Python
-        id: setup-python
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
-          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
-      - name: Append Changelog to docs
-        id: append-Changelog
-        working-directory: docs
-        run: |
-          git branch ${{ needs.publish-release.outputs.version }}-changelog
-          git checkout ${{ needs.publish-release.outputs.version }}-changelog
-          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
-          echo "Manually linking usernames"
-          sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md
-          echo "Removing unneeded comment tags"
-          sed -i -r 's|@<!---->|@|g' changelog-new.md
-          CURRENT_CHANGELOG=`tail --lines +2 changelog.md`
-          echo -e "$CURRENT_CHANGELOG" >> changelog-new.md
-          mv changelog-new.md changelog.md
-          uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
-            --dev \
-            pre-commit run --files changelog.md || true
-          git config --global user.name "github-actions"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
-          git push origin ${{ needs.publish-release.outputs.version }}-changelog
-      - name: Create Pull Request
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { repo, owner } = context.repo;
-            const result = await github.rest.pulls.create({
-              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
-              owner,
-              repo,
-              head: '${{ needs.publish-release.outputs.version }}-changelog',
-              base: 'main',
-              body: 'This PR is auto-generated by CI.'
-            });
-            github.rest.issues.addLabels({
-              owner,
-              repo,
-              issue_number: result.data.number,
-              labels: ['documentation', 'skip-changelog']
-            });
--- a/.github/workflows/repo-maintenance.yml
+++ b/.github/workflows/repo-maintenance.yml
@@ -37,7 +37,7 @@ jobs:
    if: github.repository_owner == 'paperless-ngx'
    runs-on: ubuntu-24.04
    steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v6
        with:
          issue-inactive-days: '30'
          pr-inactive-days: '30'
--- a/.github/workflows/translate-strings.yml
+++ b/.github/workflows/translate-strings.yml
@@ -12,9 +12,11 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
+        env:
+          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
-          ref: ${{ github.head_ref }}
+          ref: ${{ env.GH_REF }}
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v6
@@ -37,15 +39,15 @@ jobs:
        uses: pnpm/action-setup@v4
        with:
          version: 10
-      - name: Use Node.js 20
+      - name: Use Node.js 24
        uses: actions/setup-node@v6
        with:
-          node-version: 20.x
+          node-version: 24.x
          cache: 'pnpm'
          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
      - name: Cache frontend dependencies
        id: cache-frontend-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        with:
          path: |
            ~/.pnpm-store
--- a/.gitignore
+++ b/.gitignore
@@ -53,7 +53,7 @@ junit.xml
 # Django stuff:
 *.log

-# Zensical documentation
+# MkDocs documentation
 site/

 # PyBuilder
--- a/18
+++ b/18
@@ -5,14 +5,12 @@
 # Purpose: Compiles the frontend
 # Notes:
 #  - Does PNPM stuff with Typescript and such
-FROM --platform=$BUILDPLATFORM docker.io/node:20-trixie-slim AS compile-frontend
+FROM --platform=$BUILDPLATFORM docker.io/node:24-trixie-slim AS compile-frontend

 COPY ./src-ui /src/src-ui

 WORKDIR /src/src-ui
 RUN set -eux \
-  && npm update -g pnpm \
-  && npm install -g corepack@latest \
  && corepack enable \
  && pnpm install

@@ -32,7 +30,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.9.15-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.9.26-python3.12-trixie-slim AS s6-overlay-base

 WORKDIR /usr/src/s6

@@ -110,8 +108,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONWARNINGS="ignore:::django.http.response:517" \
    PNGX_CONTAINERIZED=1 \
    # https://docs.astral.sh/uv/reference/settings/#link-mode
-    UV_LINK_MODE=copy \
-    UV_CACHE_DIR=/cache/uv/
+    UV_LINK_MODE=copy

 #
 # Begin installation and configuration
@@ -193,14 +190,17 @@ ARG BUILD_PACKAGES="\
  pkg-config"

 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=${UV_CACHE_DIR},id=python-cache \
-  set -eux \
+RUN set -eux \
  && echo "Installing build system packages" \
    && apt-get update \
    && apt-get install --yes --quiet --no-install-recommends ${BUILD_PACKAGES} \
  && echo "Installing Python requirements" \
    && uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt \
-    && uv pip install --system --no-python-downloads --python-preference system --requirements requirements.txt \
+    && uv pip install --no-cache --system --no-python-downloads --python-preference system \
+      --index https://pypi.org/simple \
+      --index https://download.pytorch.org/whl/cpu \
+      --index-strategy unsafe-best-match \
+      --requirements requirements.txt \
  && echo "Installing NLTK data" \
    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" snowball_data \
    && python3 -W ignore::RuntimeWarning -m nltk.downloader -d "/usr/share/nltk_data" stopwords \
--- a/docker/install_management_commands.sh
+++ b/docker/install_management_commands.sh
@@ -4,13 +4,13 @@

 set -eu

-for command in decrypt_documents \
-	document_archiver \
+for command in document_archiver \
 	document_exporter \
 	document_importer \
 	mail_fetcher \
 	document_create_classifier \
 	document_index \
+	document_llmindex \
 	document_renamer \
 	document_retagger \
 	document_thumbnails \
--- a/docker/management_script.sh
+++ b/docker/management_script.sh
@@ -7,11 +7,6 @@ cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
 	python3 manage.py management_command "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py management_command "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py management_command "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py management_command "$@"
 fi
--- a/docker/rootfs/usr/local/bin/convert_mariadb_uuid
+++ b/docker/rootfs/usr/local/bin/convert_mariadb_uuid
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py convert_mariadb_uuid "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py convert_mariadb_uuid "$@"
+		python3 manage.py convert_mariadb_uuid "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py convert_mariadb_uuid "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py convert_mariadb_uuid "$@"
 fi
--- a/docker/rootfs/usr/local/bin/createsuperuser
+++ b/docker/rootfs/usr/local/bin/createsuperuser
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py createsuperuser "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py createsuperuser "$@"
+		python3 manage.py createsuperuser "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py createsuperuser "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py createsuperuser "$@"
 fi
--- a/docker/rootfs/usr/local/bin/decrypt_documents
+++ b/docker/rootfs/usr/local/bin/decrypt_documents
@@ -1,17 +0,0 @@
-#!/command/with-contenv /usr/bin/bash
-# shellcheck shell=bash
-
-set -e
-
-cd "${PAPERLESS_SRC_DIR}"
-
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py decrypt_documents "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py decrypt_documents "$@"
-elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py decrypt_documents "$@"
-else
-	echo "Unknown user."
-	exit 1
-fi
--- a/docker/rootfs/usr/local/bin/document_archiver
+++ b/docker/rootfs/usr/local/bin/document_archiver
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_archiver "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_archiver "$@"
+		python3 manage.py document_archiver "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_archiver "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_archiver "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_create_classifier
+++ b/docker/rootfs/usr/local/bin/document_create_classifier
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_create_classifier "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_create_classifier "$@"
+		python3 manage.py document_create_classifier "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_create_classifier "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_create_classifier "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_exporter
+++ b/docker/rootfs/usr/local/bin/document_exporter
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_exporter "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_exporter "$@"
+		python3 manage.py document_exporter "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_exporter "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_exporter "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_fuzzy_match
+++ b/docker/rootfs/usr/local/bin/document_fuzzy_match
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_fuzzy_match "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_fuzzy_match "$@"
+		python3 manage.py document_fuzzy_match "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_fuzzy_match "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_fuzzy_match "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_importer
+++ b/docker/rootfs/usr/local/bin/document_importer
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_importer "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_importer "$@"
+		python3 manage.py document_importer "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_importer "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_importer "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_index
+++ b/docker/rootfs/usr/local/bin/document_index
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_index "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_index "$@"
+		python3 manage.py document_index "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_index "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_index "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_llmindex
+++ b/docker/rootfs/usr/local/bin/document_llmindex
@@ -0,0 +1,14 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+set -e
+
+cd "${PAPERLESS_SRC_DIR}"
+
+if [[ $(id -u) == 0 ]]; then
+	s6-setuidgid paperless python3 manage.py document_llmindex "$@"
+elif [[ $(id -un) == "paperless" ]]; then
+	python3 manage.py document_llmindex "$@"
+else
+	echo "Unknown user."
+fi
--- a/docker/rootfs/usr/local/bin/document_renamer
+++ b/docker/rootfs/usr/local/bin/document_renamer
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_renamer "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_renamer "$@"
+		python3 manage.py document_renamer "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_renamer "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_renamer "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_retagger
+++ b/docker/rootfs/usr/local/bin/document_retagger
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_retagger "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_retagger "$@"
+		python3 manage.py document_retagger "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_retagger "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_retagger "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_sanity_checker
+++ b/docker/rootfs/usr/local/bin/document_sanity_checker
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_sanity_checker "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_sanity_checker "$@"
+		python3 manage.py document_sanity_checker "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_sanity_checker "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_sanity_checker "$@"
 fi
--- a/docker/rootfs/usr/local/bin/document_thumbnails
+++ b/docker/rootfs/usr/local/bin/document_thumbnails
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py document_thumbnails "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py document_thumbnails "$@"
+		python3 manage.py document_thumbnails "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py document_thumbnails "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py document_thumbnails "$@"
 fi
--- a/docker/rootfs/usr/local/bin/mail_fetcher
+++ b/docker/rootfs/usr/local/bin/mail_fetcher
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py mail_fetcher "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py mail_fetcher "$@"
+		python3 manage.py mail_fetcher "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py mail_fetcher "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py mail_fetcher "$@"
 fi
--- a/docker/rootfs/usr/local/bin/manage_superuser
+++ b/docker/rootfs/usr/local/bin/manage_superuser
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py manage_superuser "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py manage_superuser "$@"
+		python3 manage.py manage_superuser "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py manage_superuser "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py manage_superuser "$@"
 fi
--- a/docker/rootfs/usr/local/bin/prune_audit_logs
+++ b/docker/rootfs/usr/local/bin/prune_audit_logs
@@ -6,12 +6,7 @@ set -e
 cd "${PAPERLESS_SRC_DIR}"

 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py prune_audit_logs "$@"
-elif [[ $(id -u) == 0 ]]; then
-	s6-setuidgid paperless python3 manage.py prune_audit_logs "$@"
+		python3 manage.py prune_audit_logs "$@"
 elif [[ $(id -un) == "paperless" ]]; then
-	python3 manage.py prune_audit_logs "$@"
-else
-	echo "Unknown user."
-	exit 1
+	s6-setuidgid paperless python3 manage.py prune_audit_logs "$@"
 fi
--- a/docs/administration.md
+++ b/docs/administration.md
@@ -580,36 +580,6 @@ document.
    documents, such as encrypted PDF documents. The archiver will skip over
    these documents each time it sees them.

-### Managing encryption {#encryption}
-
-!!! warning
-
-    Encryption was removed in [paperless-ng 0.9](changelog.md#paperless-ng-090)
-    because it did not really provide any additional security, the passphrase
-    was stored in a configuration file on the same system as the documents.
-    Furthermore, the entire text content of the documents is stored plain in
-    the database, even if your documents are encrypted. Filenames are not
-    encrypted as well. Finally, the web server provides transparent access to
-    your encrypted documents.
-
-    Consider running paperless on an encrypted filesystem instead, which
-    will then at least provide security against physical hardware theft.
-
-#### Enabling encryption
-
-Enabling encryption is no longer supported.
-
-#### Disabling encryption
-
-Basic usage to disable encryption of your document store:
-
-(Note: If `PAPERLESS_PASSPHRASE` isn't set already, you need to specify
-it here)
-
-```
-decrypt_documents [--passphrase SECR3TP4SSPHRA$E]
-```
-
 ### Detecting duplicates {#fuzzy_duplicate}

 Paperless already catches and prevents upload of exactly matching documents,
--- a/docs/advanced_usage.md
+++ b/docs/advanced_usage.md
@@ -431,10 +431,8 @@ This allows for complex logic to be included in the format, including [logical s
 and [filters](https://jinja.palletsprojects.com/en/3.1.x/templates/#id11) to manipulate the [variables](#filename-format-variables)
 provided. The template is provided as a string, potentially multiline, and rendered into a single line.

-In addition, a limited `document` object is available for advanced templates.
-This object includes common metadata fields such as `id`, `pk`, `title`, `content`, `page_count`, `created`, `added`, `modified`, `mime_type`,
-`checksum`, `archive_checksum`, `archive_serial_number`, `filename`, `archive_filename`, and `original_filename`.
-Related values are available as nested objects with limited fields, for example document.correspondent.name, etc.
+In addition, the entire Document instance is available to be utilized in a more advanced way, as well as some variables which only make sense to be accessed
+with more complex logic.

 #### Custom Jinja2 Filters

@@ -503,7 +501,7 @@ The `datetime` filter formats a datetime string or datetime object using Python'
 See the [strftime format code documentation](https://docs.python.org/3.13/library/datetime.html#strftime-and-strptime-format-codes)
 for the possible codes and their meanings.

-##### Date Localization
+##### Date Localization {#date-localization}

 The `localize_date` filter formats a date or datetime object into a localized string using Babel internationalization.
 This takes into account the provided locale for translation. Since this must be used on a date or datetime object,
@@ -853,8 +851,8 @@ followed by the even pages.

 It's important that the scan files get consumed in the correct order, and one at a time.
 You therefore need to make sure that Paperless is running while you upload the files into
-the directory; and if you're using [polling](configuration.md#polling), make sure that
-`CONSUMER_POLLING` is set to a value lower than it takes for the second scan to appear,
+the directory; and if you're using polling, make sure that
+`CONSUMER_POLLING_INTERVAL` is set to a value lower than it takes for the second scan to appear,
 like 5-10 or even lower.

 Another thing that might happen is that you start a double sided scan, but then forget
--- a/docs/api.md
+++ b/docs/api.md
@@ -1,4 +1,4 @@
-# REST API
+# The REST API

 Paperless-ngx now ships with a fully-documented REST API and a browsable
 web interface to explore it. The API browsable interface is available at
@@ -294,6 +294,13 @@ The following methods are supported:
        -   `"delete_original": true` to delete the original documents after editing.
        -   `"update_document": true` to update the existing document with the edited PDF.
        -   `"include_metadata": true` to copy metadata from the original document to the edited document.
+-   `remove_password`
+    -   Requires `parameters`:
+        -   `"password": "PASSWORD_STRING"` The password to remove from the PDF documents.
+    -   Optional `parameters`:
+        -   `"update_document": true` to replace the existing document with the password-less PDF.
+        -   `"delete_original": true` to delete the original document after editing.
+        -   `"include_metadata": true` to copy metadata from the original document to the new password-less document.
 -   `merge`
    -   No additional `parameters` required.
    -   The ordering of the merged document is determined by the list of IDs.
--- a/docs/assets/extra.css
+++ b/docs/assets/extra.css
@@ -1,31 +1,13 @@
-:root>* {
-    --paperless-green: #17541f;
-    --paperless-green-accent: #2b8a38;
-    --md-primary-fg-color: var(--paperless-green);
-    --md-primary-fg-color--dark: var(--paperless-green);
-    --md-primary-fg-color--light: var(--paperless-green-accent);
-    --md-accent-fg-color: var(--paperless-green-accent);
+:root > * {
+    --md-primary-fg-color: #17541f;
+    --md-primary-fg-color--dark: #17541f;
+    --md-primary-fg-color--light: #17541f;
+    --md-accent-fg-color: #2b8a38;
    --md-typeset-a-color: #21652a;
 }

-.md-header,
-.md-tabs {
-    background-color: var(--paperless-green);
-    color: #fff;
-}
-
-.md-tabs__link {
-    color: rgba(255, 255, 255, 0.82);
-}
-
-.md-tabs__link:hover,
-.md-tabs__link--active {
-    color: #fff;
-}
-
 [data-md-color-scheme="slate"] {
    --md-hue: 222;
-    --md-default-bg-color: hsla(var(--md-hue), 15%, 10%, 1);
 }

@media (min-width: 768px) {
@@ -87,8 +69,8 @@ h4 code {
 }

 /* Hide config vars from sidebar, toc and move the border on mobile case their hidden */
-.md-nav.md-nav--secondary .md-nav__item:has(> .md-nav__link[href*="PAPERLESS_"]),
-.md-nav.md-nav--secondary .md-nav__item:has(> .md-nav__link[href*="USERMAP_"]) {
+.md-nav.md-nav--secondary .md-nav__item .md-nav__link[href*="PAPERLESS_"],
+.md-nav.md-nav--secondary .md-nav__item .md-nav__link[href*="USERMAP_"] {
    display: none;
 }

@@ -101,3 +83,18 @@ h4 code {
        border-top: .05rem solid var(--md-default-fg-color--lightest);
    }
 }
+
+/* Show search shortcut key */
+[data-md-toggle="search"]:not(:checked) ~ .md-header .md-search__form::after {
+    position: absolute;
+    top: .3rem;
+    right: .3rem;
+    display: block;
+    padding: .1rem .4rem;
+    color: var(--md-default-fg-color--lighter);
+    font-weight: bold;
+    font-size: .8rem;
+    border: .05rem solid var(--md-default-fg-color--lighter);
+    border-radius: .1rem;
+    content: "/";
+  }
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,56 +1,5 @@
 # Changelog

-## paperless-ngx 2.20.8
-
-### Security
-
-   Resolve [GHSA-7qqc-wrcw-2fj9](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-7qqc-wrcw-2fj9)
-
-## paperless-ngx 2.20.7
-
-### Security
-
-   Resolve [GHSA-x395-6h48-wr8v](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-x395-6h48-wr8v)
-
-### Bug Fixes
-
-   Performance fix: use subqueries to improve object retrieval in large installs [@shamoon](https://github.com/shamoon) ([#11950](https://github.com/paperless-ngx/paperless-ngx/pull/11950))
-   Fix: correct user dropdown button icon styling [@shamoon](https://github.com/shamoon) ([#12092](https://github.com/paperless-ngx/paperless-ngx/issues/12092))
-   Fix: fix broken docker create_classifier command in 2.20.6 [@shamoon](https://github.com/shamoon) ([#11965](https://github.com/paperless-ngx/paperless-ngx/issues/11965))
-
-### All App Changes
-
-<details>
-<summary>3 changes</summary>
-
-   Performance fix: use subqueries to improve object retrieval in large installs [@shamoon](https://github.com/shamoon) ([#11950](https://github.com/paperless-ngx/paperless-ngx/pull/11950))
-   Fix: correct user dropdown button icon styling [@shamoon](https://github.com/shamoon) ([#12092](https://github.com/paperless-ngx/paperless-ngx/issues/12092))
-   Fix: fix broken docker create_classifier command in 2.20.6 [@shamoon](https://github.com/shamoon) ([#11965](https://github.com/paperless-ngx/paperless-ngx/issues/11965))
-</details>
-
-## paperless-ngx 2.20.6
-
-### Security
-
-   Resolve [GHSA-jqwv-hx7q-fxh3](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-jqwv-hx7q-fxh3) and [GHSA-w47q-3m69-84v8](https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-w47q-3m69-84v8)
-
-### Bug Fixes
-
-   Fix: extract all ids for nested tags [@shamoon](https://github.com/shamoon) ([#11888](https://github.com/paperless-ngx/paperless-ngx/pull/11888))
-   Fixhancement: change date calculation for 'this year' to include future documents [@shamoon](https://github.com/shamoon) ([#11884](https://github.com/paperless-ngx/paperless-ngx/pull/11884))
-   Fix: Running management scripts under rootless could fail [@stumpylog](https://github.com/stumpylog) ([#11870](https://github.com/paperless-ngx/paperless-ngx/pull/11870))
-   Fix: use correct field id for overrides [@shamoon](https://github.com/shamoon) ([#11869](https://github.com/paperless-ngx/paperless-ngx/pull/11869))
-
-### All App Changes
-
-<details>
-<summary>3 changes</summary>
-
-   Fix: extract all ids for nested tags [@shamoon](https://github.com/shamoon) ([#11888](https://github.com/paperless-ngx/paperless-ngx/pull/11888))
-   Fixhancement: change date calculation for 'this year' to include future documents [@shamoon](https://github.com/shamoon) ([#11884](https://github.com/paperless-ngx/paperless-ngx/pull/11884))
-   Fix: use correct field id for overrides [@shamoon](https://github.com/shamoon) ([#11869](https://github.com/paperless-ngx/paperless-ngx/pull/11869))
-</details>
-
 ## paperless-ngx 2.20.5

 ### Bug Fixes
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1175,21 +1175,45 @@ don't exist yet.

 #### [`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`](#PAPERLESS_CONSUMER_IGNORE_PATTERNS) {#PAPERLESS_CONSUMER_IGNORE_PATTERNS}

-: By default, paperless ignores certain files and folders in the
-consumption directory, such as system files created by the Mac OS
-or hidden folders some tools use to store data.
+: Additional regex patterns for files to ignore in the consumption directory. Patterns are matched against filenames only (not full paths)
+using Python's `re.match()`, which anchors at the start of the filename.

-    This can be adjusted by configuring a custom json array with
-    patterns to exclude.
+    See the [watchfiles documentation](https://watchfiles.helpmanual.io/api/filters/#watchfiles.BaseFilter.ignore_entity_patterns)

-    For example, `.DS_STORE/*` will ignore any files found in a folder
-    named `.DS_STORE`, including `.DS_STORE/bar.pdf` and `foo/.DS_STORE/bar.pdf`
+    This setting is for additional patterns beyond the built-in defaults. Common system files and directories are already ignored automatically.
+    The patterns will be compiled via Python's standard `re` module.

-    A pattern like `._*` will ignore anything starting with `._`, including:
-    `._foo.pdf` and `._bar/foo.pdf`
+    Example custom patterns:

-    Defaults to
-    `[".DS_Store", ".DS_STORE", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*", "Thumbs.db"]`.
+    ```json
+    ["^temp_", "\\.bak$", "^~"]
+    ```
+
+    This would ignore:
+
+    - Files starting with `temp_` (e.g., `temp_scan.pdf`)
+    - Files ending with `.bak` (e.g., `document.pdf.bak`)
+    - Files starting with `~` (e.g., `~$document.docx`)
+
+    Defaults to `[]` (empty list, uses only built-in defaults).
+
+    The default ignores are `[.DS_Store, .DS_STORE, ._*, desktop.ini, Thumbs.db]` and cannot be overridden.
+
+#### [`PAPERLESS_CONSUMER_IGNORE_DIRS=<json>`](#PAPERLESS_CONSUMER_IGNORE_DIRS) {#PAPERLESS_CONSUMER_IGNORE_DIRS}
+
+: Additional directory names to ignore in the consumption directory. Directories matching these names (and all their contents) will be skipped.
+
+    This setting is for additional directories beyond the built-in defaults. Matching is done by directory name only, not full path.
+
+    Example:
+
+    ```json
+    ["temp", "incoming", ".hidden"]
+    ```
+
+    Defaults to `[]` (empty list, uses only built-in defaults).
+
+    The default ignores are `[.stfolder, .stversions, .localized, @eaDir, .Spotlight-V100, .Trashes, __MACOSX]` and cannot be overridden.

 #### [`PAPERLESS_CONSUMER_BARCODE_SCANNER=<string>`](#PAPERLESS_CONSUMER_BARCODE_SCANNER) {#PAPERLESS_CONSUMER_BARCODE_SCANNER}

@@ -1288,48 +1312,24 @@ within your documents.

    Defaults to false.

-### Polling {#polling}
+#### [`PAPERLESS_CONSUMER_POLLING_INTERVAL=<num>`](#PAPERLESS_CONSUMER_POLLING_INTERVAL) {#PAPERLESS_CONSUMER_POLLING_INTERVAL}

-#### [`PAPERLESS_CONSUMER_POLLING=<num>`](#PAPERLESS_CONSUMER_POLLING) {#PAPERLESS_CONSUMER_POLLING}
+: Configures how the consumer detects new files in the consumption directory.

-: If paperless won't find documents added to your consume folder, it
-might not be able to automatically detect filesystem changes. In
-that case, specify a polling interval in seconds here, which will
-then cause paperless to periodically check your consumption
-directory for changes. This will also disable listening for file
-system changes with `inotify`.
+    When set to `0` (default), paperless uses native filesystem notifications for efficient, immediate detection of new files.

-    Defaults to 0, which disables polling and uses filesystem
-    notifications.
+    When set to a positive number, paperless polls the consumption directory at that interval in seconds. Use polling for network filesystems (NFS, SMB/CIFS) where native notifications may not work reliably.

-#### [`PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=<num>`](#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT) {#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT}
+    Defaults to 0.

-: If consumer polling is enabled, sets the maximum number of times
-paperless will check for a file to remain unmodified. If a file's
-modification time and size are identical for two consecutive checks, it
-will be consumed.
+#### [`PAPERLESS_CONSUMER_STABILITY_DELAY=<num>`](#PAPERLESS_CONSUMER_STABILITY_DELAY) {#PAPERLESS_CONSUMER_STABILITY_DELAY}

-    Defaults to 5.
+: Sets the time in seconds that a file must remain unchanged (same size and modification time) before paperless will begin consuming it.

-#### [`PAPERLESS_CONSUMER_POLLING_DELAY=<num>`](#PAPERLESS_CONSUMER_POLLING_DELAY) {#PAPERLESS_CONSUMER_POLLING_DELAY}
+    Increase this value if you experience issues with files being consumed before they are fully written, particularly on slower network storage or
+    with certain scanner quirks

-: If consumer polling is enabled, sets the delay in seconds between
-each check (above) paperless will do while waiting for a file to
-remain unmodified.
-
-    Defaults to 5.
-
-### iNotify {#inotify}
-
-#### [`PAPERLESS_CONSUMER_INOTIFY_DELAY=<num>`](#PAPERLESS_CONSUMER_INOTIFY_DELAY) {#PAPERLESS_CONSUMER_INOTIFY_DELAY}
-
-: Sets the time in seconds the consumer will wait for additional
-events from inotify before the consumer will consider a file ready
-and begin consumption. Certain scanners or network setups may
-generate multiple events for a single file, leading to multiple
-consumers working on the same file. Configure this to prevent that.
-
-    Defaults to 0.5 seconds.
+    Defaults to 5.0 seconds.

 ## Workflow webhooks

@@ -1811,3 +1811,87 @@ password. All of these options come from their similarly-named [Django settings]
 #### [`PAPERLESS_EMAIL_USE_SSL=<bool>`](#PAPERLESS_EMAIL_USE_SSL) {#PAPERLESS_EMAIL_USE_SSL}

 : Defaults to false.
+
+## Remote OCR
+
+#### [`PAPERLESS_REMOTE_OCR_ENGINE=<str>`](#PAPERLESS_REMOTE_OCR_ENGINE) {#PAPERLESS_REMOTE_OCR_ENGINE}
+
+: The remote OCR engine to use. Currently only Azure AI is supported as "azureai".
+
+    Defaults to None, which disables remote OCR.
+
+#### [`PAPERLESS_REMOTE_OCR_API_KEY=<str>`](#PAPERLESS_REMOTE_OCR_API_KEY) {#PAPERLESS_REMOTE_OCR_API_KEY}
+
+: The API key to use for the remote OCR engine.
+
+    Defaults to None.
+
+#### [`PAPERLESS_REMOTE_OCR_ENDPOINT=<str>`](#PAPERLESS_REMOTE_OCR_ENDPOINT) {#PAPERLESS_REMOTE_OCR_ENDPOINT}
+
+: The endpoint to use for the remote OCR engine. This is required for Azure AI.
+
+    Defaults to None.
+
+## AI {#ai}
+
+#### [`PAPERLESS_AI_ENABLED=<bool>`](#PAPERLESS_AI_ENABLED) {#PAPERLESS_AI_ENABLED}
+
+: Enables the AI features in Paperless. This includes the AI-based
+suggestions. This setting is required to be set to true in order to use the AI features.
+
+    Defaults to false.
+
+#### [`PAPERLESS_AI_LLM_EMBEDDING_BACKEND=<str>`](#PAPERLESS_AI_LLM_EMBEDDING_BACKEND) {#PAPERLESS_AI_LLM_EMBEDDING_BACKEND}
+
+: The embedding backend to use for RAG. This can be either "openai" or "huggingface".
+
+    Defaults to None.
+
+#### [`PAPERLESS_AI_LLM_EMBEDDING_MODEL=<str>`](#PAPERLESS_AI_LLM_EMBEDDING_MODEL) {#PAPERLESS_AI_LLM_EMBEDDING_MODEL}
+
+: The model to use for the embedding backend for RAG. This can be set to any of the embedding models supported by the current embedding backend. If not supplied, defaults to "text-embedding-3-small" for OpenAI and "sentence-transformers/all-MiniLM-L6-v2" for Huggingface.
+
+    Defaults to None.
+
+#### [`PAPERLESS_AI_LLM_BACKEND=<str>`](#PAPERLESS_AI_LLM_BACKEND) {#PAPERLESS_AI_LLM_BACKEND}
+
+: The AI backend to use. This can be either "openai" or "ollama". If set to "ollama", the AI
+features will be run locally on your machine. If set to "openai", the AI features will be run
+using the OpenAI API. This setting is required to be set to use the AI features.
+
+    Defaults to None.
+
+    !!! note
+
+        The OpenAI API is a paid service. You will need to set up an OpenAI account and
+        will be charged for usage incurred by Paperless-ngx features and your document data
+        will (of course) be sent to the OpenAI API. Paperless-ngx does not endorse the use of the
+        OpenAI API in any way.
+
+        Refer to the OpenAI terms of service, and use at your own risk.
+
+#### [`PAPERLESS_AI_LLM_MODEL=<str>`](#PAPERLESS_AI_LLM_MODEL) {#PAPERLESS_AI_LLM_MODEL}
+
+: The model to use for the AI backend, i.e. "gpt-3.5-turbo", "gpt-4" or any of the models supported by the
+current backend. If not supplied, defaults to "gpt-3.5-turbo" for OpenAI and "llama3.1" for Ollama.
+
+    Defaults to None.
+
+#### [`PAPERLESS_AI_LLM_API_KEY=<str>`](#PAPERLESS_AI_LLM_API_KEY) {#PAPERLESS_AI_LLM_API_KEY}
+
+: The API key to use for the AI backend. This is required for the OpenAI backend (optional for others).
+
+    Defaults to None.
+
+#### [`PAPERLESS_AI_LLM_ENDPOINT=<str>`](#PAPERLESS_AI_LLM_ENDPOINT) {#PAPERLESS_AI_LLM_ENDPOINT}
+
+: The endpoint / url to use for the AI backend. This is required for the Ollama backend (optional for others).
+
+    Defaults to None.
+
+#### [`PAPERLESS_AI_LLM_INDEX_TASK_CRON=<cron expression>`](#PAPERLESS_AI_LLM_INDEX_TASK_CRON) {#PAPERLESS_AI_LLM_INDEX_TASK_CRON}
+
+: Configures the schedule to update the AI embeddings of text content and metadata for all documents. Only performed if
+AI is enabled and the LLM embedding backend is set.
+
+    Defaults to `10 2 * * *`, once per day.
--- a/docs/development.md
+++ b/docs/development.md
@@ -175,7 +175,7 @@ To add a new development package `uv add --dev <package>`

 ## Front end development

-The front end is built using AngularJS. In order to get started, you need Node.js (version 14.15+) and
+The front end is built using AngularJS. In order to get started, you need Node.js (version 24+) and
 `pnpm`.

 !!! note
@@ -338,13 +338,13 @@ LANGUAGES = [

 ## Building the documentation

-The documentation is built using Zensical, see their [documentation](https://zensical.org/docs/).
+The documentation is built using material-mkdocs, see their [documentation](https://squidfunk.github.io/mkdocs-material/reference/).
 If you want to build the documentation locally, this is how you do it:

 1.  Build the documentation

    ```bash
-    $ uv run zensical build
+    $ uv run mkdocs build --config-file mkdocs.yml
    ```

    _alternatively..._
@@ -355,10 +355,10 @@ If you want to build the documentation locally, this is how you do it:
    something.

    ```bash
-    $ uv run zensical serve
+    $ uv run mkdocs serve
    ```

-## Building the Docker image {#docker_build}
+## Building the Docker image

 The docker image is primarily built by the GitHub actions workflow, but
 it can be faster when developing to build and tag an image locally.
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -1,7 +1,3 @@
---
-title: FAQs
---
-
 # Frequently Asked Questions

 ## _What's the general plan for Paperless-ngx?_
@@ -67,10 +63,8 @@ elsewhere. Here are a couple notes about that.
    Paperless also supports various Office documents (.docx, .doc, odt,
    .ppt, .pptx, .odp, .xls, .xlsx, .ods).

-Paperless-ngx determines the type of a file by inspecting its content
-rather than its file extensions. However, files processed via the
-consumption directory will be rejected if they have a file extension that
-not supported by any of the available parsers.
+Paperless-ngx determines the type of a file by inspecting its content.
+The file extensions do not matter.

 ## _Will paperless-ngx run on Raspberry Pi?_

--- a/docs/index.md
+++ b/docs/index.md
@@ -1,7 +1,3 @@
---
-title: Home
---
-
 <div class="grid-left" markdown>
 ![image](assets/logo_full_black.svg#only-light){.index-logo}
 ![image](assets/logo_full_white.svg#only-dark){.index-logo}
@@ -29,11 +25,13 @@ physical documents into a searchable online archive so you can keep, well, _less
 ## Features

 -   **Organize and index** your scanned documents with tags, correspondents, types, and more.
-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way.
+-   _Your_ data is stored locally on _your_ server and is never transmitted or shared in any way, unless you explicitly choose to do so.
 -   Performs **OCR** on your documents, adding searchable and selectable text, even to documents scanned with only images.
-   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+    -   Utilizes the open-source Tesseract engine to recognize more than 100 languages.
+    -   _New!_ Supports remote OCR with Azure AI (opt-in).
 -   Documents are saved as PDF/A format which is designed for long term storage, alongside the unaltered originals.
 -   Uses machine-learning to automatically add tags, correspondents and document types to your documents.
+-   **New**: Paperless-ngx can now leverage AI (Large Language Models or LLMs) for document suggestions. This is an optional feature that can be enabled (and is disabled by default).
 -   Supports PDF documents, images, plain text files, Office documents (Word, Excel, PowerPoint, and LibreOffice equivalents)[^1] and more.
 -   Paperless stores your documents plain on disk. Filenames and folders are managed by paperless and their format can be configured freely with different configurations assigned to different documents.
 -   **Beautiful, modern web application** that features:
--- a/docs/migration.md
+++ b/docs/migration.md
@@ -0,0 +1,25 @@
+# v3 Migration Guide
+
+## Consumer Settings Changes
+
+The v3 consumer command uses a [different library](https://watchfiles.helpmanual.io/) to unify
+the watching for new files in the consume directory. For the user, this removes several configuration options related to delays and retries
+and replaces with a single unified setting. It also adjusts how the consumer ignore filtering happens, replaced `fnmatch` with `regex` and
+separating the directory ignore from the file ignore.
+
+### Summary
+
+| Old Setting                    | New Setting                                                                         | Notes                                                                                |
+| ------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| `CONSUMER_POLLING`             | [`CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL) | Renamed for clarity                                                                  |
+| `CONSUMER_INOTIFY_DELAY`       | [`CONSUMER_STABILITY_DELAY`](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY)   | Unified for all modes                                                                |
+| `CONSUMER_POLLING_DELAY`       | _Removed_                                                                           | Use `CONSUMER_STABILITY_DELAY`                                                       |
+| `CONSUMER_POLLING_RETRY_COUNT` | _Removed_                                                                           | Automatic with stability tracking                                                    |
+| `CONSUMER_IGNORE_PATTERNS`     | [`CONSUMER_IGNORE_PATTERNS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_PATTERNS)   | **Now regex, not fnmatch**; user patterns are added to (not replacing) default ones  |
+| _New_                          | [`CONSUMER_IGNORE_DIRS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_DIRS)           | Additional directories to ignore; user entries are added to (not replacing) defaults |
+
+## Encryption Support
+
+Document and thumbnail encryption is no longer supported. This was previously deprecated in [paperless-ng 0.9.3](https://github.com/paperless-ngx/paperless-ngx/blob/dev/docs/changelog.md#paperless-ng-093)
+
+Users must decrypt their document using the `decrypt_documents` command before upgrading.
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -1,77 +1,52 @@
---
-title: Setup
---
+## Installation

-# Installation
+You can go multiple routes to setup and run Paperless:

-!!! tip "Quick Start"
+-   [Use the script to setup a Docker install](#docker_script)
+-   [Use the Docker compose templates](#docker)
+-   [Build the Docker image yourself](#docker_build)
+-   [Install Paperless-ngx directly on your system manually ("bare metal")](#bare_metal)
+-   A user-maintained list of commercial hosting providers can be found [in the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Related-Projects)
+
+The Docker routes are quick & easy. These are the recommended routes.
+This configures all the stuff from the above automatically so that it
+just works and uses sensible defaults for all configuration options.
+Here you find a cheat-sheet for docker beginners: [CLI
+Basics](https://www.sehn.tech/refs/devops-with-docker/)
+
+The bare metal route is complicated to setup but makes it easier should
+you want to contribute some code back. You need to configure and run the
+above mentioned components yourself.
+
+### Use the Installation Script {#docker_script}
+
+Paperless provides an interactive installation script to setup a Docker Compose
+installation. The script asks for a couple configuration options, and will then create the
+necessary configuration files, pull the docker image, start Paperless-ngx and create your superuser
+account. The script essentially automatically performs the steps described in [Docker setup](#docker).
+
+1.  Make sure that Docker and Docker Compose are [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
+
+2.  Download and run the installation script:

-    If you just want Paperless-ngx running quickly, use our installation script:
    ```shell-session
    bash -c "$(curl --location --silent --show-error https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
    ```
-    _If piping into a shell directly from the internet makes you nervous, inspect [the script](https://github.com/paperless-ngx/paperless-ngx/blob/main/install-paperless-ngx.sh) first!_

-## Overview
+    !!! note

-Choose the installation route that best fits your setup:
+        macOS users will need to install [gnu-sed](https://formulae.brew.sh/formula/gnu-sed) with support
+        for running as `sed` as well as [wget](https://formulae.brew.sh/formula/wget).

-| Route                                                                                                             | Best for                                                                            | Effort |
-| ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ------ |
-| [Installation script](#docker_script)                                                                             | Fastest first-time setup with guided prompts (recommended for most users)           | Low    |
-| [Docker Compose templates](#docker)                                                                               | Manual control over compose files and settings                                      | Medium |
-| [Bare metal](#bare_metal)                                                                                         | Advanced setups, packaging, and development-adjacent workflows                      | High   |
-| [Hosted providers (wiki)](https://github.com/paperless-ngx/paperless-ngx/wiki/Related-Projects#hosting-providers) | Managed hosting options maintained by the community &mdash; check details carefully | Varies |
+### Use Docker Compose {#docker}

-For most users, Docker is the best option. It is faster to set up,
-easier to maintain, and ships with sensible defaults.
+1.  Make sure that Docker and Docker Compose are [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.

-The bare-metal route gives you more control, but it requires manual
-installation and operation of all components. It is usually best suited
-for advanced users and contributors.
-
-!!! info
-
-    Because [superuser](usage.md#superusers) accounts have full access to all objects and documents, you may want to create a separate user account for daily use,
-    or "downgrade" your superuser account to a normal user account after setup.
-
-## Installation Script {#docker_script}
-
-Paperless-ngx provides an interactive script for Docker Compose setups.
-It asks a few configuration questions, then creates the required files,
-pulls the image, starts the containers, and creates your [superuser](usage.md#superusers)
-account. In short, it automates the [Docker Compose setup](#docker) described below.
-
-#### Prerequisites
-
-   Docker and Docker Compose must be [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
-   macOS users will need [GNU sed](https://formulae.brew.sh/formula/gnu-sed) with support for running as `sed` as well as [wget](https://formulae.brew.sh/formula/wget).
-
-#### Run the installation script
-
-```shell-session
-bash -c "$(curl --location --silent --show-error https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/install-paperless-ngx.sh)"
-```
-
-#### After installation
-
-Paperless-ngx should be available at `http://127.0.0.1:8000` (or similar,
-depending on your configuration) and you will be able to login with the
-credentials you provided during the installation script.
-
-## Docker Compose Install {#docker}
-
-#### Prerequisites
-
-   Docker and Docker Compose must be [installed](https://docs.docker.com/engine/install/){:target="\_blank"}.
-
-#### Installation
-
-1.  Go to the [/docker/compose directory on the project
+2.  Go to the [/docker/compose directory on the project
    page](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose){:target="\_blank"}
-    and download one `docker-compose.*.yml` file for your preferred
-    database backend. Save it in a local directory as `docker-compose.yml`.
-    Also download `docker-compose.env` and `.env` into that same directory.
+    and download one of the `docker-compose.*.yml` files, depending on which database backend
+    you want to use. Place the files in a local directory and rename it `docker-compose.yml`. Download the
+    `docker-compose.env` file and the `.env` file as well in the same directory.

    If you want to enable optional support for Office and other documents, download a
    file with `-tika` in the file name.
@@ -81,16 +56,15 @@ credentials you provided during the installation script.
        For new installations, it is recommended to use PostgreSQL as the
        database backend.

-2.  Modify `docker-compose.yml` as needed. For example, you may want to
-    change the paths for `consume`, `media`, and other directories to
-    use bind mounts.
+3.  Modify `docker-compose.yml` as needed. For example, you may want to change the paths to the
+    consumption, media etc. directories to use 'bind mounts'.
    Find the line that specifies where to mount the directory, e.g.:

    ```yaml
    - ./consume:/usr/src/paperless/consume
    ```

-    Replace the part _before_ the colon with your local directory:
+    Replace the part _before_ the colon with a local directory of your choice:

    ```yaml
    - /home/jonaswinkler/paperless-inbox:/usr/src/paperless/consume
@@ -104,15 +78,38 @@ credentials you provided during the installation script.
        - 8010:8000
    ```

-3.  Modify `docker-compose.env` with any configuration options you need.
+    **Rootless**
+
+    !!! warning
+
+        It is currently not possible to run the container rootless if additional languages are specified via `PAPERLESS_OCR_LANGUAGES`.
+
+    If you want to run Paperless as a rootless container, you will need
+    to do the following in your `docker-compose.yml`:
+
+    -   set the `user` running the container to map to the `paperless`
+        user in the container. This value (`user_id` below), should be
+        the same id that `USERMAP_UID` and `USERMAP_GID` are set to in
+        the next step. See `USERMAP_UID` and `USERMAP_GID`
+        [here](configuration.md#docker).
+
+    Your entry for Paperless should contain something like:
+
+    > ```
+    > webserver:
+    >   image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    >   user: <user_id>
+    > ```
+
+4.  Modify `docker-compose.env` with any configuration options you'd like.
    See the [configuration documentation](configuration.md) for all options.

    You may also need to set `USERMAP_UID` and `USERMAP_GID` to
-    the UID and GID of your user on the host system. Use `id -u` and
-    `id -g` to get these values. This ensures both the container and the
-    host user can write to the consumption directory. If your UID and
-    GID are `1000` (the default for the first normal user on many
-    systems), this usually works out of the box without
+    the uid and gid of your user on the host system. Use `id -u` and
+    `id -g` to get these. This ensures that both the container and the host
+    user have write access to the consumption directory. If your UID
+    and GID on the host system is 1000 (the default for the first normal
+    user on most systems), it will work out of the box without any
    modifications. Run `id "username"` to check.

    !!! note
@@ -121,62 +118,78 @@ credentials you provided during the installation script.
        appending `_FILE` to configuration values. For example [`PAPERLESS_DBUSER`](configuration.md#PAPERLESS_DBUSER)
        can be set using `PAPERLESS_DBUSER_FILE=/var/run/secrets/password.txt`.

-4.  Run `docker compose pull`. This pulls the image from the GitHub container registry
-    by default, but you can pull from Docker Hub by changing the `image`
+    !!! warning
+
+        Some file systems such as NFS network shares don't support file
+        system notifications with `inotify`. When storing the consumption
+        directory on such a file system, paperless will not pick up new
+        files with the default configuration. You will need to use
+        [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL), which will disable inotify.
+
+5.  Run `docker compose pull`. This will pull the image from the GitHub container registry
+    by default but you can change the image to pull from Docker Hub by changing the `image`
    line to `image: paperlessngx/paperless-ngx:latest`.

-5.  Run `docker compose up -d`. This will create and start the necessary containers.
+6.  Run `docker compose up -d`. This will create and start the necessary containers.

-#### After installation
+7.  Congratulations! Your Paperless-ngx instance should now be accessible at `http://127.0.0.1:8000`
+    (or similar, depending on your configuration). When you first access the web interface, you will be
+    prompted to create a superuser account.

-Your Paperless-ngx instance should now be accessible at
-`http://127.0.0.1:8000` (or similar, depending on your configuration).
-When you first access the web interface, you will be prompted to create
-a [superuser](usage.md#superusers) account.
+### Build the Docker image yourself {#docker_build}

-#### Optional Advanced Compose Configurations {#advanced_compose data-toc-label="Advanced Compose Configurations"}
+1.  Clone the entire repository of paperless:

-**Rootless**
+    ```shell-session
+    git clone https://github.com/paperless-ngx/paperless-ngx
+    ```

-!!! warning
+    The main branch always reflects the latest stable version.

-    It is currently not possible to run the container rootless if additional languages are specified via `PAPERLESS_OCR_LANGUAGES`.
+2.  Copy one of the `docker/compose/docker-compose.*.yml` to
+    `docker-compose.yml` in the root folder, depending on which database
+    backend you want to use. Copy `docker-compose.env` into the project
+    root as well.

-If you want to run Paperless as a rootless container, make this
-change in `docker-compose.yml`:
+3.  In the `docker-compose.yml` file, find the line that instructs
+    Docker Compose to pull the paperless image from Docker Hub:

-   Set the `user` running the container to map to the `paperless`
-    user in the container. This value (`user_id` below) should be
-    the same ID that `USERMAP_UID` and `USERMAP_GID` are set to in
-    `docker-compose.env`. See `USERMAP_UID` and `USERMAP_GID`
-    [here](configuration.md#docker).
+    ```yaml
+    webserver:
+        image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    ```

-Your entry for Paperless should contain something like:
+    and replace it with a line that instructs Docker Compose to build
+    the image from the current working directory instead:

-> ```
-> webserver:
->   image: ghcr.io/paperless-ngx/paperless-ngx:latest
->   user: <user_id>
-> ```
+    ```yaml
+    webserver:
+        build:
+            context: .
+    ```

-**File systems without inotify support (e.g. NFS)**
+4.  Follow the [Docker setup](#docker) above except when asked to run
+    `docker compose pull` to pull the image, run

-Some file systems, such as NFS network shares, don't support file system
-notifications with `inotify`. When the consumption directory is on such a
-file system, Paperless-ngx will not pick up new files with the default
-configuration. Use [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING)
-to enable polling and disable inotify. See [here](configuration.md#polling).
+    ```shell-session
+    docker compose build
+    ```

-## Bare Metal Install {#bare_metal}
+    instead to build the image.

-#### Prerequisites
+### Bare Metal Route {#bare_metal}

-   Paperless runs on Linux only, Windows is not supported.
-   Python 3 is required with versions 3.10 - 3.12 currently supported. Newer versions may work, but some dependencies may not be fully compatible.
+Paperless runs on linux only. The following procedure has been tested on
+a minimal installation of Debian/Buster, which is the current stable
+release at the time of writing. Windows is not and will never be
+supported.

-#### Installation
+Paperless requires Python 3. At this time, 3.10 - 3.12 are tested versions.
+Newer versions may work, but some dependencies may not fully support newer versions.
+Support for older Python versions may be dropped as they reach end of life or as newer versions
+are released, dependency support is confirmed, etc.

-1.  Install dependencies. Paperless requires the following packages:
+1.  Install dependencies. Paperless requires the following packages.

    -   `python3`
    -   `python3-pip`
@@ -240,8 +253,8 @@ to enable polling and disable inotify. See [here](configuration.md#polling).

 2.  Install `redis` >= 6.0 and configure it to start automatically.

-3.  Optional: Install `postgresql` and configure a database, user, and
-    password for Paperless-ngx. If you do not wish to use PostgreSQL,
+3.  Optional. Install `postgresql` and configure a database, user and
+    password for paperless. If you do not wish to use PostgreSQL,
    MariaDB and SQLite are available as well.

    !!! note
@@ -250,60 +263,61 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
        extension](https://code.djangoproject.com/wiki/JSON1Extension) is
        enabled. This is usually the case, but not always.

-4.  Create a system user with a new home folder in which you want
-    to run Paperless-ngx.
+4.  Create a system user with a new home folder under which you wish
+    to run paperless.

    ```shell-session
    adduser paperless --system --home /opt/paperless --group
    ```

-5.  Download a release archive from
-    <https://github.com/paperless-ngx/paperless-ngx/releases>. For example:
+5.  Get the release archive from
+    <https://github.com/paperless-ngx/paperless-ngx/releases> for example with

    ```shell-session
-    curl -O -L https://github.com/paperless-ngx/paperless-ngx/releases/download/vX.Y.Z/paperless-ngx-vX.Y.Z.tar.xz
+    curl -O -L https://github.com/paperless-ngx/paperless-ngx/releases/download/v1.10.2/paperless-ngx-v1.10.2.tar.xz
    ```

    Extract the archive with

    ```shell-session
-    tar -xf paperless-ngx-vX.Y.Z.tar.xz
+    tar -xf paperless-ngx-v1.10.2.tar.xz
    ```

-    and copy the contents to the home directory of the user you created
-    earlier (`/opt/paperless`).
+    and copy the contents to the
+    home folder of the user you created before (`/opt/paperless`).

-    Optional: If you cloned the Git repository, you will need to
-    compile the frontend yourself. See [here](development.md#front-end-development)
+    Optional: If you cloned the git repo, you will have to
+    compile the frontend yourself, see [here](development.md#front-end-development)
    and use the `build` step, not `serve`.

-6.  Configure Paperless-ngx. See [configuration](configuration.md) for details.
+6.  Configure paperless. See [configuration](configuration.md) for details.
    Edit the included `paperless.conf` and adjust the settings to your
-    needs. Required settings for getting Paperless-ngx running are:
+    needs. Required settings for getting
+    paperless running are:

-    -   [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) should point to your Redis server, such as
-        `redis://localhost:6379`.
-    -   [`PAPERLESS_DBENGINE`](configuration.md#PAPERLESS_DBENGINE) is optional, and should be one of `postgres`,
+    -   [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) should point to your redis server, such as
+        <redis://localhost:6379>.
+    -   [`PAPERLESS_DBENGINE`](configuration.md#PAPERLESS_DBENGINE) optional, and should be one of `postgres`,
        `mariadb`, or `sqlite`
    -   [`PAPERLESS_DBHOST`](configuration.md#PAPERLESS_DBHOST) should be the hostname on which your
        PostgreSQL server is running. Do not configure this to use
        SQLite instead. Also configure port, database name, user and
        password as necessary.
-    -   [`PAPERLESS_CONSUMPTION_DIR`](configuration.md#PAPERLESS_CONSUMPTION_DIR) should point to the folder
-        that Paperless-ngx should watch for incoming documents.
-        Likewise, [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) and
-        [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) define where Paperless-ngx stores its data.
-        If needed, these can point to the same directory.
+    -   [`PAPERLESS_CONSUMPTION_DIR`](configuration.md#PAPERLESS_CONSUMPTION_DIR) should point to a folder which
+        paperless should watch for documents. You might want to have
+        this somewhere else. Likewise, [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) and
+        [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) define where paperless stores its data.
+        If you like, you can point both to the same directory.
    -   [`PAPERLESS_SECRET_KEY`](configuration.md#PAPERLESS_SECRET_KEY) should be a random sequence of
        characters. It's used for authentication. Failure to do so
        allows third parties to forge authentication credentials.
-    -   Set [`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) if you are behind a reverse proxy. This should
+    -   [`PAPERLESS_URL`](configuration.md#PAPERLESS_URL) if you are behind a reverse proxy. This should
        point to your domain. Please see
        [configuration](configuration.md) for more
        information.

-    You can make many more adjustments, especially for OCR.
-    The following options are recommended for most users:
+    Many more adjustments can be made to paperless, especially the OCR
+    part. The following options are recommended for everyone:

    -   Set [`PAPERLESS_OCR_LANGUAGE`](configuration.md#PAPERLESS_OCR_LANGUAGE) to the language most of your
        documents are written in.
@@ -313,14 +327,15 @@ to enable polling and disable inotify. See [here](configuration.md#polling).

        Ensure your Redis instance [is secured](https://redis.io/docs/latest/operate/oss_and_stack/management/security/).

-7.  Create the following directories if they do not already exist:
+7.  Create the following directories if they are missing:

    -   `/opt/paperless/media`
    -   `/opt/paperless/data`
    -   `/opt/paperless/consume`

-    Adjust these paths if you configured different folders.
-    Then verify that the `paperless` user has write permissions:
+    Adjust as necessary if you configured different folders.
+    Ensure that the paperless user has write permissions for every one
+    of these folders with

    ```shell-session
    ls -l -d /opt/paperless/media
@@ -334,44 +349,45 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
    sudo chown paperless:paperless /opt/paperless/consume
    ```

-8.  Install Python dependencies from `requirements.txt`.
+8.  Install python requirements from the `requirements.txt` file.

    ```shell-session
    sudo -Hu paperless pip3 install -r requirements.txt
    ```

-    This will install all Python dependencies in the home directory of
+    This will install all python dependencies in the home directory of
    the new paperless user.

    !!! tip

-        You can use a virtual environment if you prefer. If you do,
-        you may need to adjust the example scripts for your virtual
-        environment paths.
+        It is up to you if you wish to use a virtual environment or not for the Python
+        dependencies.  This is an alternative to the above and may require adjusting
+        the example scripts to utilize the virtual environment paths

    !!! tip

        If you use modern Python tooling, such as `uv`, installation will not include
-        dependencies for PostgreSQL or MariaDB. You can select those
-        extras with `--extra <EXTRA>`, or install all extras with
-        `--all-extras`.
+        dependencies for Postgres or Mariadb.  You can select those extras with `--extra <EXTRA>`
+        or all with `--all-extras`

-9.  Go to `/opt/paperless/src` and execute the following command:
+9.  Go to `/opt/paperless/src`, and execute the following command:

    ```bash
    # This creates the database schema.
    sudo -Hu paperless python3 manage.py migrate
    ```

-10. Optional: Test that Paperless-ngx is working by running
+    When you first access the web interface you will be prompted to create a superuser account.
+
+10. Optional: Test that paperless is working by executing

    ```bash
    # Manually starts the webserver
    sudo -Hu paperless python3 manage.py runserver
    ```

-    Then point your browser to `http://localhost:8000` if
-    accessing from the same device on which Paperless-ngx is installed.
+    and pointing your browser to http://localhost:8000 if
+    accessing from the same devices on which paperless is installed.
    If accessing from another machine, set up systemd services. You may need
    to set `PAPERLESS_DEBUG=true` in order for the development server to work
    normally in your browser.
@@ -379,24 +395,23 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
    !!! warning

        This is a development server which should not be used in production.
-        It is not audited for security, and performance is inferior to
-        production-ready web servers.
+        It is not audited for security and performance is inferior to
+        production ready web servers.

    !!! tip

        This will not start the consumer. Paperless does this in a separate
        process.

-11. Set up systemd services to run Paperless-ngx automatically. You may use
+11. Setup systemd services to run paperless automatically. You may use
    the service definition files included in the `scripts` folder as a
    starting point.

-    Paperless needs:
-
-    -   The `webserver` script to run the webserver.
-    -   The `consumer` script to watch the input folder.
-    -   The `taskqueue` script for background workers (document consumption, etc.).
-    -   The `scheduler` script for periodic tasks such as email checking.
+    Paperless needs the `webserver` script to run the webserver, the
+    `consumer` script to watch the input folder, `taskqueue` for the
+    background workers used to handle things like document consumption
+    and the `scheduler` script to run tasks such as email checking at
+    certain times .

    !!! note

@@ -405,9 +420,9 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
        `Require=paperless-webserver.socket` in the `webserver` script
        and configure `granian` to listen on port 80 (set `GRANIAN_PORT`).

-    These services rely on Redis and optionally the database server, but
+    These services rely on redis and optionally the database server, but
    don't need to be started in any particular order. The example files
-    depend on Redis being started. If you use a database server, you
+    depend on redis being started. If you use a database server, you
    should add additional dependencies.

    !!! note
@@ -417,15 +432,18 @@ to enable polling and disable inotify. See [here](configuration.md#polling).

    !!! warning

-        If Celery won't start, check
+        If celery won't start (check with
        `sudo systemctl status paperless-task-queue.service` for
-        `paperless-task-queue.service` and `paperless-scheduler.service`.
-        You may need to change the path in the files. Example:
+        paperless-task-queue.service and paperless-scheduler.service
+        ) you need to change the path in the files. Example:
        `ExecStart=/opt/paperless/.local/bin/celery --app paperless worker --loglevel INFO`

-12. Configure ImageMagick to allow processing of PDF documents. Most
+12. Optional: Install a samba server and make the consumption folder
+    available as a network share.
+
+13. Configure ImageMagick to allow processing of PDF documents. Most
    distributions have this disabled by default, since PDF documents can
-    contain malware. If you don't do this, Paperless-ngx will fall back to
+    contain malware. If you don't do this, paperless will fall back to
    Ghostscript for certain steps such as thumbnail generation.

    Edit `/etc/ImageMagick-6/policy.xml` and adjust
@@ -440,38 +458,32 @@ to enable polling and disable inotify. See [here](configuration.md#polling).
    <policy domain="coder" rights="read|write" pattern="PDF" />
    ```

-**Optional: Install the [jbig2enc](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html) encoder.**
-This will reduce the size of generated PDF documents. You'll most likely need to compile this yourself, because this
-software has been patented until around 2017 and binary packages are not available for most distributions.
+14. Optional: Install the
+    [jbig2enc](https://ocrmypdf.readthedocs.io/en/latest/jbig2.html)
+    encoder. This will reduce the size of generated PDF documents.
+    You'll most likely need to compile this by yourself, because this
+    software has been patented until around 2017 and binary packages are
+    not available for most distributions.

-**Optional: download the NLTK data**
-If using the NLTK machine-learning processing (see [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) for details),
-download the NLTK data for the Snowball Stemmer, Stopwords and Punkt tokenizer to `/usr/share/nltk_data`. Refer to the [NLTK
-instructions](https://www.nltk.org/data.html) for details on how to download the data.
+15. Optional: If using the NLTK machine learning processing (see
+    [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) for details),
+    download the NLTK data for the Snowball
+    Stemmer, Stopwords and Punkt tokenizer to `/usr/share/nltk_data`. Refer to the [NLTK
+    instructions](https://www.nltk.org/data.html) for details on how to
+    download the data.

-#### After installation
+# Migrating to Paperless-ngx

-Your Paperless-ngx instance should now be accessible at `http://localhost:8000` (or similar, depending on your configuration).
-When you first access the web interface you will be prompted to create a [superuser](usage.md#superusers) account.
+Migration is possible both from Paperless-ng or directly from the
+'original' Paperless.

-## Build the Docker image yourself {#docker_build data-toc-label="Building the Docker image"}
+## Migrating from Paperless-ng

-Building the Docker image yourself is typically used for development, but it can also be used for production
-if you want to customize the image. See [Building the Docker image](development.md#docker_build) in the
-development documentation.
-
-## Migrating to Paperless-ngx
-
-You can migrate to Paperless-ngx from Paperless-ng or from the original
-Paperless project.
-
-<h3 id="migration_ng">Migrating from Paperless-ng</h3>
-
-Paperless-ngx is meant to be a drop-in replacement for Paperless-ng, and
-upgrading should be trivial for most users, especially when using
-Docker. However, as with any major change, it is recommended to take a
+Paperless-ngx is meant to be a drop-in replacement for Paperless-ng and
+thus upgrading should be trivial for most users, especially when using
+docker. However, as with any major change, it is recommended to take a
 full backup first. Once you are ready, simply change the docker image to
-point to the new source. For example, if using Docker Compose, edit
+point to the new source. E.g. if using Docker Compose, edit
 `docker-compose.yml` and change:

 ```
@@ -484,65 +496,66 @@ to
 image: ghcr.io/paperless-ngx/paperless-ngx:latest
 ```

-and then run `docker compose up -d`, which will pull the new image and
-recreate the container. That's it.
+and then run `docker compose up -d` which will pull the new image
+recreate the container. That's it!

 Users who installed with the bare-metal route should also update their
 Git clone to point to `https://github.com/paperless-ngx/paperless-ngx`,
-for example using:
+e.g. using the command
 `git remote set-url origin https://github.com/paperless-ngx/paperless-ngx`
 and then pull the latest version.

-<h3 id="migration_paperless">Migrating from Paperless</h3>
+## Migrating from Paperless

-At its core, Paperless-ngx is still Paperless and fully compatible.
+At its core, paperless-ngx is still paperless and fully compatible.
 However, some things have changed under the hood, so you need to adapt
-your setup depending on how you installed Paperless.
+your setup depending on how you installed paperless.

-This section describes how to update an existing Paperless Docker
-installation. Keep these points in mind:
+This setup describes how to update an existing paperless Docker
+installation. The important things to keep in mind are as follows:

 -   Read the [changelog](changelog.md) and
    take note of breaking changes.
-   Decide whether to stay on SQLite or migrate to PostgreSQL.
-    See [documentation](#sqlite_to_psql) for details on moving data
-    from SQLite to PostgreSQL. Both work fine with
-    Paperless. However, if you already have a database server running
-    for other services, you might as well use it for Paperless as well.
-   The task scheduler of Paperless, which is used to execute periodic
+-   You should decide if you want to stick with SQLite or want to
+    migrate your database to PostgreSQL. See [documentation](#sqlite_to_psql)
+    for details on
+    how to move your data from SQLite to PostgreSQL. Both work fine with
+    paperless. However, if you already have a database server running
+    for other services, you might as well use it for paperless as well.
+-   The task scheduler of paperless, which is used to execute periodic
    tasks such as email checking and maintenance, requires a
-    [Redis](https://redis.io/) message broker instance. The
+    [redis](https://redis.io/) message broker instance. The
    Docker Compose route takes care of that.
 -   The layout of the folder structure for your documents and data
-    remains the same, so you can plug your old Docker volumes into
+    remains the same, so you can just plug your old docker volumes into
    paperless-ngx and expect it to find everything where it should be.

-Migration to Paperless-ngx is then performed in a few simple steps:
+Migration to paperless-ngx is then performed in a few simple steps:

-1.  Stop Paperless.
+1.  Stop paperless.

    ```bash
    cd /path/to/current/paperless
    docker compose down
    ```

-2.  Create a backup for two reasons: if something goes wrong, you still
-    have your data; and if you don't like paperless-ngx, you can
-    switch back to Paperless.
+2.  Do a backup for two purposes: If something goes wrong, you still
+    have your data. Second, if you don't like paperless-ngx, you can
+    switch back to paperless.

-3.  Download the latest release of Paperless-ngx. You can either use
+3.  Download the latest release of paperless-ngx. You can either go with
    the Docker Compose files from
    [here](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)
    or clone the repository to build the image yourself (see
-    [development docs](development.md#docker_build)). You can either replace your current paperless
-    folder or put Paperless-ngx in
+    [above](#docker_build)). You can
+    either replace your current paperless folder or put paperless-ngx in
    a different location.

    !!! warning

        Paperless-ngx includes a `.env` file. This will set the project name
-        for Docker Compose to `paperless`, which will also define the
-        volume names created by Paperless-ngx. However, if you notice that
+        for docker compose to `paperless`, which will also define the name
+        of the volumes by paperless-ngx. However, if you experience that
        paperless-ngx is not using your old paperless volumes, verify the
        names of your volumes with

@@ -558,10 +571,10 @@ Migration to Paperless-ngx is then performed in a few simple steps:
    after you migrated your existing SQLite database.

 5.  Adjust `docker-compose.yml` and `docker-compose.env` to your needs.
-    See [Docker setup](#docker) for details on
-    which edits are recommended.
+    See [Docker setup](#docker) details on
+    which edits are advised.

-6.  Follow the update procedure in [Update paperless](administration.md#updating).
+6.  [Update paperless.](administration.md#updating)

 7.  In order to find your existing documents with the new search
    feature, you need to invoke a one-time operation that will create
@@ -572,99 +585,136 @@ Migration to Paperless-ngx is then performed in a few simple steps:
    ```

    This will migrate your database and create the search index. After
-    that, Paperless-ngx will maintain the index automatically.
+    that, paperless will take care of maintaining the index by itself.

-8.  Start Paperless-ngx.
+8.  Start paperless-ngx.

    ```bash
    docker compose up -d
    ```

-    This will run Paperless-ngx in the background and automatically start it
+    This will run paperless in the background and automatically start it
    on system boot.

-9.  Paperless may have installed a permanent redirect to `admin/` in your
+9.  Paperless installed a permanent redirect to `admin/` in your
    browser. This redirect is still in place and prevents access to the
-    new UI. Clear your browser cache to fix this.
+    new UI. Clear your browsing cache in order to fix this.

 10. Optionally, follow the instructions below to migrate your existing
    data to PostgreSQL.

-<h3 id="migration_lsio">Migrating from LinuxServer.io Docker Image</h3>
+## Migrating from LinuxServer.io Docker Image

-As with any upgrade or large change, it is highly recommended to
+As with any upgrades and large changes, it is highly recommended to
 create a backup before starting. This assumes the image was running
 using Docker Compose, but the instructions are translatable to Docker
 commands as well.

-1.  Stop and remove the Paperless container.
-2.  If using an external database, stop that container.
-3.  Update Redis configuration.
+1.  Stop and remove the paperless container
+2.  If using an external database, stop the container
+3.  Update Redis configuration

    1. If `REDIS_URL` is already set, change it to [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS)
       and continue to step 4.

-    1. Otherwise, add a new Redis service in `docker-compose.yml`,
-       following [the example compose
+    1. Otherwise, in the `docker-compose.yml` add a new service for
+       Redis, following [the example compose
       files](https://github.com/paperless-ngx/paperless-ngx/tree/main/docker/compose)

    1. Set the environment variable [`PAPERLESS_REDIS`](configuration.md#PAPERLESS_REDIS) so it points to
-       the new Redis container.
+       the new Redis container

-4.  Update user mapping.
+4.  Update user mapping

-    1. If set, change the environment variable `PUID` to `USERMAP_UID`.
+    1. If set, change the environment variable `PUID` to `USERMAP_UID`

-    1. If set, change the environment variable `PGID` to `USERMAP_GID`.
+    1. If set, change the environment variable `PGID` to `USERMAP_GID`

-5.  Update configuration paths.
+5.  Update configuration paths

-    1. Set the environment variable [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) to `/config`.
+    1. Set the environment variable [`PAPERLESS_DATA_DIR`](configuration.md#PAPERLESS_DATA_DIR) to `/config`

-6.  Update media paths.
+6.  Update media paths

    1. Set the environment variable [`PAPERLESS_MEDIA_ROOT`](configuration.md#PAPERLESS_MEDIA_ROOT) to
-       `/data/media`.
+       `/data/media`

-7.  Update timezone.
+7.  Update timezone

    1. Set the environment variable [`PAPERLESS_TIME_ZONE`](configuration.md#PAPERLESS_TIME_ZONE) to the same
-       value as `TZ`.
+       value as `TZ`

-8.  Modify `image:` to point to
+8.  Modify the `image:` to point to
    `ghcr.io/paperless-ngx/paperless-ngx:latest` or a specific version
    if preferred.
 9.  Start the containers as before, using `docker compose`.

-## Running Paperless-ngx on less powerful devices {#less-powerful-devices data-toc-label="Less Powerful Devices"}
+## Moving data from SQLite to PostgreSQL or MySQL/MariaDB {#sqlite_to_psql}

-Paperless runs on Raspberry Pi. Some tasks can be slow on lower-powered
-hardware, but a few settings can improve performance:
+The best way to migrate between database types is to perform an [export](administration.md#exporter) and then
+[import](administration.md#importer) into a clean installation of Paperless-ngx.
+
+## Moving back to Paperless
+
+Lets say you migrated to Paperless-ngx and used it for a while, but
+decided that you don't like it and want to move back (If you do, send
+me a mail about what part you didn't like!), you can totally do that
+with a few simple steps.
+
+Paperless-ngx modified the database schema slightly, however, these
+changes can be reverted while keeping your current data, so that your
+current data will be compatible with original Paperless. Thumbnails
+were also changed from PNG to WEBP format and will need to be
+re-generated.
+
+Execute this:
+
+```shell-session
+$ cd /path/to/paperless
+$ docker compose run --rm webserver migrate documents 0023
+```
+
+Or without docker:
+
+```shell-session
+$ cd /path/to/paperless/src
+$ python3 manage.py migrate documents 0023
+```
+
+After regenerating thumbnails, you'll need to clear your cookies
+(Paperless-ngx comes with updated dependencies that do cookie-processing
+differently) and probably your cache as well.
+
+# Considerations for less powerful devices {#less-powerful-devices}
+
+Paperless runs on Raspberry Pi. However, some things are rather slow on
+the Pi and configuring some options in paperless can help improve
+performance immensely:

 -   Stick with SQLite to save some resources. See [troubleshooting](troubleshooting.md#log-reports-creating-paperlesstask-failed)
    if you encounter issues with SQLite locking.
 -   If you do not need the filesystem-based consumer, consider disabling it
    entirely by setting [`PAPERLESS_CONSUMER_DISABLE`](configuration.md#PAPERLESS_CONSUMER_DISABLE) to `true`.
-   Consider setting [`PAPERLESS_OCR_PAGES`](configuration.md#PAPERLESS_OCR_PAGES) to 1, so that Paperless
-    OCRs only the first page of your documents. In most cases, this page
+-   Consider setting [`PAPERLESS_OCR_PAGES`](configuration.md#PAPERLESS_OCR_PAGES) to 1, so that paperless will
+    only OCR the first page of your documents. In most cases, this page
    contains enough information to be able to find it.
 -   [`PAPERLESS_TASK_WORKERS`](configuration.md#PAPERLESS_TASK_WORKERS) and [`PAPERLESS_THREADS_PER_WORKER`](configuration.md#PAPERLESS_THREADS_PER_WORKER) are
    configured to use all cores. The Raspberry Pi models 3 and up have 4
-    cores, meaning that Paperless will use 2 workers and 2 threads per
+    cores, meaning that paperless will use 2 workers and 2 threads per
    worker. This may result in sluggish response times during
    consumption, so you might want to lower these settings (example: 2
    workers and 1 thread to always have some computing power left for
    other tasks).
 -   Keep [`PAPERLESS_OCR_MODE`](configuration.md#PAPERLESS_OCR_MODE) at its default value `skip` and consider
-    OCRing your documents before feeding them into Paperless. Some
+    OCR'ing your documents before feeding them into paperless. Some
    scanners are able to do this!
 -   Set [`PAPERLESS_OCR_SKIP_ARCHIVE_FILE`](configuration.md#PAPERLESS_OCR_SKIP_ARCHIVE_FILE) to `with_text` to skip archive
-    file generation for already OCRed documents, or `always` to skip it
+    file generation for already ocr'ed documents, or `always` to skip it
    for all documents.
 -   If you want to perform OCR on the device, consider using
    `PAPERLESS_OCR_CLEAN=none`. This will speed up OCR times and use
    less memory at the expense of slightly worse OCR results.
-   If using Docker, consider setting [`PAPERLESS_WEBSERVER_WORKERS`](configuration.md#PAPERLESS_WEBSERVER_WORKERS) to 1. This will save some memory.
+-   If using docker, consider setting [`PAPERLESS_WEBSERVER_WORKERS`](configuration.md#PAPERLESS_WEBSERVER_WORKERS) to 1. This will save some memory.
 -   Consider setting [`PAPERLESS_ENABLE_NLTK`](configuration.md#PAPERLESS_ENABLE_NLTK) to false, to disable the
    more advanced language processing, which can take more memory and
    processing time.
@@ -676,19 +726,17 @@ For details, refer to [configuration](configuration.md).
    Updating the
    [automatic matching algorithm](advanced_usage.md#automatic-matching) takes quite a bit of time. However, the update mechanism
    checks if your data has changed before doing the heavy lifting. If you
-    experience the algorithm taking too much CPU time, consider changing the
+    experience the algorithm taking too much cpu time, consider changing the
    schedule in the admin interface to daily. You can also manually invoke
    the task by changing the date and time of the next run to today/now.

    The actual matching of the algorithm is fast and works on Raspberry Pi
    as well as on any other device.

-## Additional considerations
+# Using nginx as a reverse proxy {#nginx}

-**Using a reverse proxy with Paperless-ngx**
+Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-a-Reverse-Proxy-with-Paperless-ngx#nginx) for user-maintained documentation of using nginx with Paperless-ngx.

-Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-a-Reverse-Proxy-with-Paperless-ngx#nginx) for user-maintained documentation on using nginx with Paperless-ngx.
+# Enhancing security {#security}

-**Enhancing security**
-
-Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-Security-Tools-with-Paperless-ngx) for user-maintained documentation on configuring security tools like Fail2ban with Paperless-ngx.
+Please see [the wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Using-Security-Tools-with-Paperless-ngx) for user-maintained documentation of how to configure security tools like Fail2ban with Paperless-ngx.
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -46,9 +46,9 @@ run:
 If you notice that the consumer will only pickup files in the
 consumption directory at startup, but won't find any other files added
 later, you will need to enable filesystem polling with the configuration
-option [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING).
+option [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL).

-This will disable listening to filesystem changes with inotify and
+This will disable automatic listening for filesystem changes and
 paperless will manually check the consumption directory for changes
 instead.

@@ -234,47 +234,9 @@ FileNotFoundError: [Errno 2] No such file or directory: '/tmp/ocrmypdf.io.yhk3zb

 This probably indicates paperless tried to consume the same file twice.
 This can happen for a number of reasons, depending on how documents are
-placed into the consume folder. If paperless is using inotify (the
-default) to check for documents, try adjusting the
-[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
-[polling configuration](configuration.md#polling).
-
-## Consumer fails waiting for file to remain unmodified.
-
-You might find messages like these in your log files:
-
-```
-[ERROR] [paperless.management.consumer] Timeout while waiting on file /usr/src/paperless/src/../consume/SCN_0001.pdf to remain unmodified.
-```
-
-This indicates paperless timed out while waiting for the file to be
-completely written to the consume folder. Adjusting
-[polling configuration](configuration.md#polling) values should resolve the issue.
-
-!!! note
-
-    The user will need to manually move the file out of the consume folder
-    and back in, for the initial failing file to be consumed.
-
-## Consumer fails reporting "OS reports file as busy still".
-
-You might find messages like these in your log files:
-
-```
-[WARNING] [paperless.management.consumer] Not consuming file /usr/src/paperless/src/../consume/SCN_0001.pdf: OS reports file as busy still
-```
-
-This indicates paperless was unable to open the file, as the OS reported
-the file as still being in use. To prevent a crash, paperless did not
-try to consume the file. If paperless is using inotify (the default) to
-check for documents, try adjusting the
-[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
-[polling configuration](configuration.md#polling).
-
-!!! note
-
-    The user will need to manually move the file out of the consume folder
-    and back in, for the initial failing file to be consumed.
+placed into the consume folder, such as how a scanner may modify a file multiple times as it scans.
+Try adjusting the
+[file stability delay](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY) to a larger value.

 ## Log reports "Creating PaperlessTask failed".

--- a/docs/usage.md
+++ b/docs/usage.md
@@ -1,8 +1,4 @@
---
-title: Basic Usage
---
-
-# Usage
+# Usage Overview

 Paperless-ngx is an application that manages your personal documents. With
 the (optional) help of a document scanner (see [the scanners wiki](https://github.com/paperless-ngx/paperless-ngx/wiki/Scanner-&-Software-Recommendations)), Paperless-ngx transforms your unwieldy
@@ -282,6 +278,28 @@ Once setup, navigating to the email settings page in Paperless-ngx will allow yo
 You can also submit a document using the REST API, see [POSTing documents](api.md#file-uploads)
 for details.

+## Document Suggestions
+
+Paperless-ngx can suggest tags, correspondents, document types and storage paths for documents based on the content of the document. This is done using a (non-LLM) machine learning model that is trained on the documents in your database. The suggestions are shown in the document detail page and can be accepted or rejected by the user.
+
+## AI Features
+
+Paperless-ngx includes several features that use AI to enhance the document management experience. These features are optional and can be enabled or disabled in the settings. If you are using the AI features, you may want to also enable the "LLM index" feature, which supports Retrieval-Augmented Generation (RAG) designed to improve the quality of AI responses. The LLM index feature is not enabled by default and requires additional configuration.
+
+!!! warning
+
+    Remember that Paperless-ngx will send document content to the AI provider you have configured, so consider the privacy implications of using these features, especially if using a remote model (e.g. OpenAI), instead of the default local model.
+
+The AI features work by creating an embedding of the text content and metadata of documents, which is then used for various tasks such as similarity search and question answering. This uses the FAISS vector store.
+
+### AI-Enhanced Suggestions
+
+If enabled, Paperless-ngx can use an AI LLM model to suggest document titles, dates, tags, correspondents and document types for documents. This feature will always be "opt-in" and does not disable the existing classifier-based suggestion system. Currently, both remote (via the OpenAI API) and local (via Ollama) models are supported, see [configuration](configuration.md#ai) for details.
+
+### Document Chat
+
+Paperless-ngx can use an AI LLM model to answer questions about a document or across multiple documents. Again, this feature works best when RAG is enabled. The chat feature is available in the upper app toolbar and will switch between chatting across multiple documents or a single document based on the current view.
+
 ## Sharing documents from Paperless-ngx

 Paperless-ngx supports sharing documents with other users by assigning them [permissions](#object-permissions)
@@ -348,11 +366,6 @@ permissions can be granted to limit access to certain parts of the UI (and corre

 Superusers can access all parts of the front and backend application as well as any and all objects. Superuser status can only be granted by another superuser.

-!!! tip
-
-    Because superuser accounts can see all objects and documents, you may want to use a regular account for day-to-day use. Additional superuser accounts can
-    be created via [cli](administration.md#create-superuser) or granted superuser status from an existing superuser account.
-
 #### Admin Status

 Admin status (Django 'staff status') grants access to viewing the paperless logs and the system status dialog
@@ -552,7 +565,7 @@ This allows for complex logic to be used to generate the title, including [logic
 and [filters](https://jinja.palletsprojects.com/en/3.1.x/templates/#id11).
 The template is provided as a string.

-Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#Date-Localization) in the title.
+Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#date-localization) in the title.

 The available inputs differ depending on the type of workflow trigger.
 This is because at the time of consumption (when the text is to be set), no automatic tags etc. have been
@@ -584,6 +597,7 @@ The following placeholders are only available for "added" or "updated" triggers
 -   `{{created_day}}`: created day
 -   `{{created_time}}`: created time in HH:MM format
 -   `{{doc_url}}`: URL to the document in the web UI. Requires the `PAPERLESS_URL` setting to be set.
+-   `{{doc_id}}`: Document ID

 ##### Examples

@@ -910,6 +924,21 @@ how regularly you intend to scan documents and use paperless.
    performed the task associated with the document, move it to the
    inbox.

+## Remote OCR
+
+!!! important
+
+    This feature is disabled by default and will always remain strictly "opt-in".
+
+Paperless-ngx supports performing OCR on documents using remote services. At the moment, this is limited to
+[Microsoft's Azure "Document Intelligence" service](https://azure.microsoft.com/en-us/products/ai-services/ai-document-intelligence).
+This is of course a paid service (with a free tier) which requires an Azure account and subscription. Azure AI is not affiliated with
+Paperless-ngx in any way. When enabled, Paperless-ngx will automatically send appropriate documents to Azure for OCR processing, bypassing
+the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details.
+
+Additionally, when using a commercial service with this feature, consider both potential costs as well as any associated file size
+or page limitations (e.g. with a free tier).
+
 ## Architecture

 Paperless-ngx consists of the following components:
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -0,0 +1,87 @@
+site_name: Paperless-ngx
+theme:
+  name: material
+  logo: assets/logo.svg
+  font:
+    text: Roboto
+    code: Roboto Mono
+  palette:
+    # Palette toggle for automatic mode
+    - media: "(prefers-color-scheme)"
+      toggle:
+        icon: material/brightness-auto
+        name: Switch to light mode
+    # Palette toggle for light mode
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      toggle:
+        icon: material/brightness-7
+        name: Switch to dark mode
+    # Palette toggle for dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      toggle:
+        icon: material/brightness-4
+        name: Switch to system preference
+  features:
+    - navigation.tabs
+    - navigation.top
+    - toc.integrate
+    - content.code.annotate
+  icon:
+    repo: fontawesome/brands/github
+  favicon: assets/favicon.png
+repo_url: https://github.com/paperless-ngx/paperless-ngx
+repo_name: paperless-ngx/paperless-ngx
+edit_uri: blob/main/docs/
+extra_css:
+  - assets/extra.css
+markdown_extensions:
+  - attr_list
+  - md_in_html
+  - def_list
+  - admonition
+  - tables
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.superfences
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.tilde
+  - footnotes
+  - pymdownx.superfences:
+      custom_fences:
+        - name: mermaid
+          class: mermaid
+          format: !!python/name:pymdownx.superfences.fence_code_format
+  - pymdownx.emoji:
+      emoji_index: !!python/name:material.extensions.emoji.twemoji
+      emoji_generator: !!python/name:material.extensions.emoji.to_svg
+strict: true
+nav:
+  - index.md
+  - setup.md
+  - 'Basic Usage': usage.md
+  - configuration.md
+  - administration.md
+  - advanced_usage.md
+  - 'REST API': api.md
+  - development.md
+  - 'FAQs': faq.md
+  - troubleshooting.md
+  - 'Migration to v3': migration.md
+  - changelog.md
+copyright: Copyright &copy; 2016 - 2026 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
+extra:
+  social:
+    - icon: fontawesome/brands/github
+      link: https://github.com/paperless-ngx/paperless-ngx
+    - icon: fontawesome/brands/docker
+      link: https://hub.docker.com/r/paperlessngx/paperless-ngx
+    - icon: material/chat
+      link: https://matrix.to/#/#paperless:matrix.org
+plugins:
+  - search
+  - glightbox:
+      skip_classes:
+        - no-lightbox
--- a/paperless.conf.example
+++ b/paperless.conf.example
@@ -55,10 +55,10 @@
 #PAPERLESS_TASK_WORKERS=1
 #PAPERLESS_THREADS_PER_WORKER=1
 #PAPERLESS_TIME_ZONE=UTC
-#PAPERLESS_CONSUMER_POLLING=10
+#PAPERLESS_CONSUMER_POLLING_INTERVAL=10
 #PAPERLESS_CONSUMER_DELETE_DUPLICATES=false
 #PAPERLESS_CONSUMER_RECURSIVE=false
-#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]
+#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[]  # Defaults are built in; add filename regexes, e.g. ["^\\.DS_Store$", "^desktop\\.ini$"]
 #PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=false
 #PAPERLESS_CONSUMER_ENABLE_BARCODES=false
 #PAPERLESS_CONSUMER_BARCODE_STRING=PATCHT
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "2.20.9"
+version = "2.20.5"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,6 +16,7 @@ classifiers = [
 # This will allow testing to not install a webserver, mysql, etc

 dependencies = [
+  "azure-ai-documentintelligence>=1.0.2",
  "babel>=2.17",
  "bleach~=6.3.0",
  "celery[redis]~=5.5.1",
@@ -26,8 +27,8 @@ dependencies = [
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.5",
-  "django-allauth[mfa,socialaccount]~=65.12.1",
-  "django-auditlog~=3.3.0",
+  "django-allauth[mfa,socialaccount]~=65.13.1",
+  "django-auditlog~=3.4.1",
  "django-cachalot~=2.8.0",
  "django-celery-results~=2.6.0",
  "django-compression-middleware~=0.5.0",
@@ -43,16 +44,23 @@ dependencies = [
  "drf-spectacular~=0.28",
  "drf-spectacular-sidecar~=2025.10.1",
  "drf-writable-nested~=0.7.1",
+  "faiss-cpu>=1.10",
  "filelock~=3.20.0",
  "flower~=2.0.1",
-  "gotenberg-client~=0.12.0",
+  "gotenberg-client~=0.13.1",
  "httpx-oauth~=0.16",
  "imap-tools~=1.11.0",
-  "inotifyrecursive~=0.3",
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
+  "llama-index-core>=0.14.12",
+  "llama-index-embeddings-huggingface>=0.6.1",
+  "llama-index-embeddings-openai>=0.5.1",
+  "llama-index-llms-ollama>=0.9.1",
+  "llama-index-llms-openai>=0.6.13",
+  "llama-index-vector-stores-faiss>=0.5.2",
  "nltk~=3.9.1",
-  "ocrmypdf~=16.12.0",
+  "ocrmypdf~=16.13.0",
+  "openai>=1.76",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
@@ -65,10 +73,12 @@ dependencies = [
  "redis[hiredis]~=5.2.1",
  "regex>=2025.9.18",
  "scikit-learn~=1.7.0",
+  "sentence-transformers>=4.1",
  "setproctitle~=1.3.4",
  "tika-client~=0.10.0",
+  "torch~=2.9.1",
  "tqdm~=4.67.1",
-  "watchdog~=6.0",
+  "watchfiles>=1.1.1",
  "whitenoise~=6.9",
  "whoosh-reloaded>=2.7.5",
  "zxing-cpp~=2.3.0",
@@ -81,7 +91,7 @@ optional-dependencies.postgres = [
  "psycopg[c,pool]==3.2.12",
  # Direct dependency for proper resolution of the pre-built wheels
  "psycopg-c==3.2.12",
-  "psycopg-pool==3.2.7",
+  "psycopg-pool==3.3",
 ]
 optional-dependencies.webserver = [
  "granian[uvloop]~=2.5.1",
@@ -96,7 +106,8 @@ dev = [
 ]

 docs = [
-  "zensical>=0.0.21",
+  "mkdocs-glightbox~=0.5.1",
+  "mkdocs-material~=9.7.0",
 ]

 testing = [
@@ -115,7 +126,7 @@ testing = [
 ]

 lint = [
-  "pre-commit~=4.4.0",
+  "pre-commit~=4.5.1",
  "pre-commit-uv~=4.2.0",
  "ruff~=0.14.0",
 ]
@@ -158,6 +169,15 @@ zxing-cpp = [
  { url = "https://github.com/paperless-ngx/builder/releases/download/zxing-2.3.0/zxing_cpp-2.3.0-cp312-cp312-linux_aarch64.whl", marker = "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.12'" },
 ]

+torch = [
+  { index = "pytorch-cpu" },
+]
+
+[[tool.uv.index]]
+name = "pytorch-cpu"
+url = "https://download.pytorch.org/whl/cpu"
+explicit = true
+
 [tool.ruff]
 target-version = "py310"
 line-length = 88
@@ -252,6 +272,8 @@ testpaths = [
  "src/paperless_tesseract/tests/",
  "src/paperless_tika/tests",
  "src/paperless_text/tests/",
+  "src/paperless_remote/tests/",
+  "src/paperless_ai/tests",
 ]
 addopts = [
  "--pythonwarnings=all",
--- a/src-ui/angular.json
+++ b/src-ui/angular.json
@@ -31,6 +31,7 @@
          "fi-FI": "src/locale/messages.fi_FI.xlf",
          "fr-FR": "src/locale/messages.fr_FR.xlf",
          "hu-HU": "src/locale/messages.hu_HU.xlf",
+          "id-ID": "src/locale/messages.id_ID.xlf",
          "it-IT": "src/locale/messages.it_IT.xlf",
          "ja-JP": "src/locale/messages.ja_JP.xlf",
          "lb-LU": "src/locale/messages.lb_LU.xlf",
@@ -155,16 +156,7 @@
          "builder": "@angular-builders/jest:run",
          "options": {
            "tsConfig": "tsconfig.spec.json",
-            "assets": [
-              "src/favicon.ico",
-              "src/apple-touch-icon.png",
-              "src/assets",
-              "src/manifest.webmanifest"
-            ],
-            "styles": [
-              "src/styles.scss"
-            ],
-            "scripts": []
+            "zoneless": false
          }
        },
        "lint": {
--- a/src-ui/jest.config.js
+++ b/src-ui/jest.config.js
@@ -1,5 +1,23 @@
+const { createEsmPreset } = require('jest-preset-angular/presets')
+
+const esmPreset = createEsmPreset({
+  tsconfig: '<rootDir>/tsconfig.spec.json',
+  stringifyContentPathRegex: '\\.(html|svg)$',
+})
+
 module.exports = {
-  preset: 'jest-preset-angular',
+  ...esmPreset,
+  transform: {
+    ...esmPreset.transform,
+    '^.+\\.(ts|js|mjs|html|svg)$': [
+      'jest-preset-angular',
+      {
+        tsconfig: '<rootDir>/tsconfig.spec.json',
+        stringifyContentPathRegex: '\\.(html|svg)$',
+        useESM: true,
+      },
+    ],
+  },
  setupFilesAfterEnv: ['<rootDir>/setup-jest.ts'],
  testPathIgnorePatterns: [
    '/node_modules/',
@@ -8,9 +26,10 @@ module.exports = {
    'abstract-paperless-service',
  ],
  transformIgnorePatterns: [
-    `<rootDir>/node_modules/.pnpm/(?!.*\\.mjs$|lodash-es|@angular\\+common.*locales)`,
+    'node_modules/(?!.*(\\.mjs$|tslib|lodash-es|@angular/common/locales/.*\\.js$))',
  ],
  moduleNameMapper: {
+    ...esmPreset.moduleNameMapper,
    '^src/(.*)': '<rootDir>/src/$1',
  },
  workerIdleMemoryLimit: '512MB',
--- a/src-ui/messages.xlf
+++ b/src-ui/messages.xlf
--- a/src-ui/package.json
+++ b/src-ui/package.json
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "2.20.9",
+  "version": "2.20.5",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -11,17 +11,17 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^20.2.13",
-    "@angular/common": "~20.3.15",
-    "@angular/compiler": "~20.3.15",
-    "@angular/core": "~20.3.15",
-    "@angular/forms": "~20.3.15",
-    "@angular/localize": "~20.3.15",
-    "@angular/platform-browser": "~20.3.15",
-    "@angular/platform-browser-dynamic": "~20.3.15",
-    "@angular/router": "~20.3.15",
-    "@ng-bootstrap/ng-bootstrap": "^19.0.1",
-    "@ng-select/ng-select": "^20.7.0",
+    "@angular/cdk": "^21.0.6",
+    "@angular/common": "~21.0.8",
+    "@angular/compiler": "~21.0.8",
+    "@angular/core": "~21.0.8",
+    "@angular/forms": "~21.0.8",
+    "@angular/localize": "~21.0.8",
+    "@angular/platform-browser": "~21.0.8",
+    "@angular/platform-browser-dynamic": "~21.0.8",
+    "@angular/router": "~21.0.8",
+    "@ng-bootstrap/ng-bootstrap": "^20.0.0",
+    "@ng-select/ng-select": "^21.1.4",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -30,8 +30,8 @@
    "ng2-pdf-viewer": "^10.4.0",
    "ngx-bootstrap-icons": "^1.9.3",
    "ngx-color": "^10.1.0",
-    "ngx-cookie-service": "^20.1.1",
-    "ngx-device-detector": "^10.1.0",
+    "ngx-cookie-service": "^21.1.0",
+    "ngx-device-detector": "^11.0.0",
    "ngx-ui-tour-ng-bootstrap": "^17.0.1",
    "rxjs": "^7.8.2",
    "tslib": "^2.8.1",
@@ -40,18 +40,18 @@
    "zone.js": "^0.15.1"
  },
  "devDependencies": {
-    "@angular-builders/custom-webpack": "^20.0.0",
-    "@angular-builders/jest": "^20.0.0",
-    "@angular-devkit/core": "^20.3.13",
-    "@angular-devkit/schematics": "^20.3.13",
-    "@angular-eslint/builder": "20.6.0",
-    "@angular-eslint/eslint-plugin": "20.6.0",
-    "@angular-eslint/eslint-plugin-template": "20.6.0",
-    "@angular-eslint/schematics": "20.6.0",
-    "@angular-eslint/template-parser": "20.6.0",
-    "@angular/build": "^20.3.13",
-    "@angular/cli": "~20.3.13",
-    "@angular/compiler-cli": "~20.3.15",
+    "@angular-builders/custom-webpack": "^21.0.0-beta.1",
+    "@angular-builders/jest": "^21.0.0-beta.1",
+    "@angular-devkit/core": "^21.0.5",
+    "@angular-devkit/schematics": "^21.0.5",
+    "@angular-eslint/builder": "21.1.0",
+    "@angular-eslint/eslint-plugin": "21.1.0",
+    "@angular-eslint/eslint-plugin-template": "21.1.0",
+    "@angular-eslint/schematics": "21.1.0",
+    "@angular-eslint/template-parser": "21.1.0",
+    "@angular/build": "^21.0.5",
+    "@angular/cli": "~21.0.5",
+    "@angular/compiler-cli": "~21.0.8",
    "@codecov/webpack-plugin": "^1.9.1",
    "@playwright/test": "^1.57.0",
    "@types/jest": "^30.0.0",
@@ -63,11 +63,11 @@
    "jest": "30.2.0",
    "jest-environment-jsdom": "^30.2.0",
    "jest-junit": "^16.0.0",
-    "jest-preset-angular": "^15.0.3",
+    "jest-preset-angular": "^16.0.0",
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
-    "typescript": "^5.8.3",
+    "typescript": "^5.9.3",
    "webpack": "^5.103.0"
  },
  "packageManager": "pnpm@10.17.1",
--- a/src-ui/pnpm-lock.yaml
+++ b/src-ui/pnpm-lock.yaml
--- a/src-ui/setup-jest.ts
+++ b/src-ui/setup-jest.ts
@@ -28,6 +28,7 @@ import localeFa from '@angular/common/locales/fa'
 import localeFi from '@angular/common/locales/fi'
 import localeFr from '@angular/common/locales/fr'
 import localeHu from '@angular/common/locales/hu'
+import localeId from '@angular/common/locales/id'
 import localeIt from '@angular/common/locales/it'
 import localeJa from '@angular/common/locales/ja'
 import localeKo from '@angular/common/locales/ko'
@@ -63,6 +64,7 @@ registerLocaleData(localeFa)
 registerLocaleData(localeFi)
 registerLocaleData(localeFr)
 registerLocaleData(localeHu)
+registerLocaleData(localeId)
 registerLocaleData(localeIt)
 registerLocaleData(localeJa)
 registerLocaleData(localeKo)
--- a/src-ui/src/app/components/admin/config/config.component.html
+++ b/src-ui/src/app/components/admin/config/config.component.html
@@ -19,18 +19,13 @@
                                <div class="col">
                                    <div class="card bg-light">
                                        <div class="card-body">
-                                            <div class="card-title d-flex align-items-center">
-                                                <h6 class="mb-0">
-                                                  {{option.title}}
+                                            <div class="card-title">
+                                                <h6>
+                                                    {{option.title}}
+                                                    <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
+                                                        <i-bs  name="info-circle"></i-bs>
+                                                    </a>
                                                </h6>
-                                                <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
-                                                    <i-bs name="info-circle"></i-bs>
-                                                </a>
-                                                @if (isSet(option.key)) {
-                                                  <button type="button" class="btn btn-sm btn-link text-danger ms-auto pe-0" title="Reset" i18n-title (click)="resetOption(option.key)">
-                                                      <i-bs class="me-1" name="x"></i-bs><ng-container i18n>Reset</ng-container>
-                                                  </button>
-                                                }
                                            </div>
                                            <div class="mb-n3">
                                                @switch (option.type) {
@@ -40,8 +35,12 @@
                                                    @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                    @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                    @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
+                                                    @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
                                                }
                                            </div>
+                                            @if (option.note) {
+                                                <div class="form-text fst-italic">{{option.note}}</div>
+                                            }
                                        </div>
                                    </div>
                                </div>
--- a/src-ui/src/app/components/admin/config/config.component.spec.ts
+++ b/src-ui/src/app/components/admin/config/config.component.spec.ts
@@ -144,18 +144,4 @@ describe('ConfigComponent', () => {
    component.uploadFile(new File([], 'test.png'), 'app_logo')
    expect(initSpy).toHaveBeenCalled()
  })
-
-  it('should reset option to null', () => {
-    component.configForm.patchValue({ output_type: OutputTypeConfig.PDF_A })
-    expect(component.isSet('output_type')).toBeTruthy()
-    component.resetOption('output_type')
-    expect(component.configForm.get('output_type').value).toBeNull()
-    expect(component.isSet('output_type')).toBeFalsy()
-    component.configForm.patchValue({ app_title: 'Test Title' })
-    component.resetOption('app_title')
-    expect(component.configForm.get('app_title').value).toBeNull()
-    component.configForm.patchValue({ barcodes_enabled: true })
-    component.resetOption('barcodes_enabled')
-    expect(component.configForm.get('barcodes_enabled').value).toBeNull()
-  })
 })
--- a/src-ui/src/app/components/admin/config/config.component.ts
+++ b/src-ui/src/app/components/admin/config/config.component.ts
@@ -29,6 +29,7 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { FileComponent } from '../../common/input/file/file.component'
 import { NumberComponent } from '../../common/input/number/number.component'
+import { PasswordComponent } from '../../common/input/password/password.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { SwitchComponent } from '../../common/input/switch/switch.component'
 import { TextComponent } from '../../common/input/text/text.component'
@@ -46,6 +47,7 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    TextComponent,
    NumberComponent,
    FileComponent,
+    PasswordComponent,
    AsyncPipe,
    NgbNavModule,
    FormsModule,
@@ -208,12 +210,4 @@ export class ConfigComponent
        },
      })
  }
-
-  public isSet(key: string): boolean {
-    return this.configForm.get(key).value != null
-  }
-
-  public resetOption(key: string) {
-    this.configForm.get(key).setValue(null)
-  }
 }
--- a/src-ui/src/app/components/admin/settings/settings.component.spec.ts
+++ b/src-ui/src/app/components/admin/settings/settings.component.spec.ts
@@ -91,6 +91,9 @@ const status: SystemStatus = {
    sanity_check_status: SystemStatusItemStatus.ERROR,
    sanity_check_last_run: new Date().toISOString(),
    sanity_check_error: 'Error running sanity check.',
+    llmindex_status: SystemStatusItemStatus.DISABLED,
+    llmindex_last_modified: new Date().toISOString(),
+    llmindex_error: null,
  },
 }

--- a/src-ui/src/app/components/app-frame/app-frame.component.html
+++ b/src-ui/src/app/components/app-frame/app-frame.component.html
@@ -30,6 +30,9 @@
    </div>
  </div>
  <ul ngbNav class="order-sm-3">
+    @if (aiEnabled) {
+      <pngx-chat></pngx-chat>
+    }
    <pngx-toasts-dropdown></pngx-toasts-dropdown>
    <li ngbDropdown class="nav-item dropdown">
      <button class="btn ps-1 border-0" id="userDropdown" ngbDropdownToggle>
--- a/src-ui/src/app/components/app-frame/app-frame.component.scss
+++ b/src-ui/src/app/components/app-frame/app-frame.component.scss
@@ -281,7 +281,7 @@ main {
 .navbar .dropdown-menu {
  font-size: 0.875rem; // body size

-  a i-bs, button i-bs {
+  a i-bs {
    opacity: 0.6;
  }
 }
--- a/src-ui/src/app/components/app-frame/app-frame.component.ts
+++ b/src-ui/src/app/components/app-frame/app-frame.component.ts
@@ -44,6 +44,7 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { TasksService } from 'src/app/services/tasks.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { environment } from 'src/environments/environment'
+import { ChatComponent } from '../chat/chat/chat.component'
 import { ProfileEditDialogComponent } from '../common/profile-edit-dialog/profile-edit-dialog.component'
 import { DocumentDetailComponent } from '../document-detail/document-detail.component'
 import { ComponentWithPermissions } from '../with-permissions/with-permissions.component'
@@ -59,6 +60,7 @@ import { ToastsDropdownComponent } from './toasts-dropdown/toasts-dropdown.compo
    DocumentTitlePipe,
    IfPermissionsDirective,
    ToastsDropdownComponent,
+    ChatComponent,
    RouterModule,
    NgClass,
    NgbDropdownModule,
@@ -184,6 +186,10 @@ export class AppFrameComponent
      })
  }

+  get aiEnabled(): boolean {
+    return this.settingsService.get(SETTINGS_KEYS.AI_ENABLED)
+  }
+
  closeMenu() {
    this.isMenuCollapsed = true
  }
--- a/src-ui/src/app/components/app-frame/toasts-dropdown/toasts-dropdown.component.html
+++ b/src-ui/src/app/components/app-frame/toasts-dropdown/toasts-dropdown.component.html
@@ -1,5 +1,5 @@

-<li ngbDropdown class="nav-item" (openChange)="onOpenChange($event)">
+<li ngbDropdown class="nav-item mx-1" (openChange)="onOpenChange($event)">
  @if (toasts.length) {
    <span class="badge rounded-pill z-3 pe-none bg-secondary me-2 position-absolute top-0 left-0">{{ toasts.length }}</span>
  }
--- a/src-ui/src/app/components/chat/chat/chat.component.html
+++ b/src-ui/src/app/components/chat/chat/chat.component.html
@@ -0,0 +1,35 @@
+
+<li ngbDropdown class="nav-item me-n2" (openChange)="onOpenChange($event)">
+  <button class="btn border-0" id="chatDropdown" ngbDropdownToggle>
+    <i-bs width="1.3em" height="1.3em" name="chatSquareDots"></i-bs>
+  </button>
+  <div ngbDropdownMenu class="dropdown-menu-end shadow p-3" aria-labelledby="chatDropdown">
+    <div class="chat-container bg-light p-2">
+      <div class="chat-messages font-monospace small">
+        @for (message of messages; track message) {
+          <div class="message d-flex flex-row small" [class.justify-content-end]="message.role === 'user'">
+            <span class="p-2 m-2" [class.bg-dark]="message.role === 'user'">
+              {{ message.content }}
+              @if (message.isStreaming) { <span class="blinking-cursor">|</span> }
+            </span>
+          </div>
+        }
+        <div #scrollAnchor></div>
+      </div>
+
+      <form class="chat-input">
+        <div class="input-group">
+          <input
+            #chatInput
+            class="form-control form-control-sm" name="chatInput" type="text"
+            [placeholder]="placeholder"
+            [disabled]="loading"
+            [(ngModel)]="input"
+            (keydown)="searchInputKeyDown($event)"
+            />
+          <button class="btn btn-sm btn-secondary" type="button" (click)="sendMessage()" [disabled]="loading">Send</button>
+        </div>
+      </form>
+    </div>
+  </div>
+</li>
--- a/src-ui/src/app/components/chat/chat/chat.component.scss
+++ b/src-ui/src/app/components/chat/chat/chat.component.scss
@@ -0,0 +1,37 @@
+.dropdown-menu {
+  width: var(--pngx-toast-max-width);
+}
+
+.chat-messages {
+  max-height: 350px;
+  overflow-y: auto;
+}
+
+.dropdown-toggle::after {
+  display: none;
+}
+
+.dropdown-item {
+  white-space: initial;
+}
+
+@media screen and (max-width: 400px) {
+  :host ::ng-deep .dropdown-menu-end {
+    right: -3rem;
+  }
+}
+
+.blinking-cursor {
+  font-weight: bold;
+  font-size: 1.2em;
+  animation: blink 1s step-end infinite;
+}
+
+@keyframes blink {
+  from, to {
+    opacity: 0;
+  }
+  50% {
+    opacity: 1;
+  }
+}
--- a/src-ui/src/app/components/chat/chat/chat.component.spec.ts
+++ b/src-ui/src/app/components/chat/chat/chat.component.spec.ts
@@ -0,0 +1,132 @@
+import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
+import { provideHttpClientTesting } from '@angular/common/http/testing'
+import { ElementRef } from '@angular/core'
+import { ComponentFixture, TestBed } from '@angular/core/testing'
+import { NavigationEnd, Router } from '@angular/router'
+import { allIcons, NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { Subject } from 'rxjs'
+import { ChatService } from 'src/app/services/chat.service'
+import { ChatComponent } from './chat.component'
+
+describe('ChatComponent', () => {
+  let component: ChatComponent
+  let fixture: ComponentFixture<ChatComponent>
+  let chatService: ChatService
+  let router: Router
+  let routerEvents$: Subject<NavigationEnd>
+  let mockStream$: Subject<string>
+
+  beforeEach(async () => {
+    TestBed.configureTestingModule({
+      imports: [NgxBootstrapIconsModule.pick(allIcons), ChatComponent],
+      providers: [
+        provideHttpClient(withInterceptorsFromDi()),
+        provideHttpClientTesting(),
+      ],
+    }).compileComponents()
+
+    fixture = TestBed.createComponent(ChatComponent)
+    router = TestBed.inject(Router)
+    routerEvents$ = new Subject<any>()
+    jest
+      .spyOn(router, 'events', 'get')
+      .mockReturnValue(routerEvents$.asObservable())
+    chatService = TestBed.inject(ChatService)
+    mockStream$ = new Subject<string>()
+    jest
+      .spyOn(chatService, 'streamChat')
+      .mockReturnValue(mockStream$.asObservable())
+    component = fixture.componentInstance
+
+    jest.useFakeTimers()
+
+    fixture.detectChanges()
+
+    component.scrollAnchor.nativeElement.scrollIntoView = jest.fn()
+  })
+
+  it('should update documentId on initialization', () => {
+    jest.spyOn(router, 'url', 'get').mockReturnValue('/documents/123')
+    component.ngOnInit()
+    expect(component.documentId).toBe(123)
+  })
+
+  it('should update documentId on navigation', () => {
+    component.ngOnInit()
+    routerEvents$.next(new NavigationEnd(1, '/documents/456', '/documents/456'))
+    expect(component.documentId).toBe(456)
+  })
+
+  it('should return correct placeholder based on documentId', () => {
+    component.documentId = 123
+    expect(component.placeholder).toBe('Ask a question about this document...')
+    component.documentId = undefined
+    expect(component.placeholder).toBe('Ask a question about a document...')
+  })
+
+  it('should send a message and handle streaming response', () => {
+    component.input = 'Hello'
+    component.sendMessage()
+
+    expect(component.messages.length).toBe(2)
+    expect(component.messages[0].content).toBe('Hello')
+    expect(component.loading).toBe(true)
+
+    mockStream$.next('Hi')
+    expect(component.messages[1].content).toBe('H')
+    mockStream$.next('Hi there')
+    // advance time to process the typewriter effect
+    jest.advanceTimersByTime(1000)
+    expect(component.messages[1].content).toBe('Hi there')
+
+    mockStream$.complete()
+    expect(component.loading).toBe(false)
+    expect(component.messages[1].isStreaming).toBe(false)
+  })
+
+  it('should handle errors during streaming', () => {
+    component.input = 'Hello'
+    component.sendMessage()
+
+    mockStream$.error('Error')
+    expect(component.messages[1].content).toContain(
+      '⚠️ Error receiving response.'
+    )
+    expect(component.loading).toBe(false)
+  })
+
+  it('should enqueue typewriter chunks correctly', () => {
+    const message = { content: '', role: 'assistant', isStreaming: true }
+    component.enqueueTypewriter(null, message as any) // coverage for null
+    component.enqueueTypewriter('Hello', message as any)
+    expect(component['typewriterBuffer'].length).toBe(4)
+  })
+
+  it('should scroll to bottom after sending a message', () => {
+    const scrollSpy = jest.spyOn(
+      ChatComponent.prototype as any,
+      'scrollToBottom'
+    )
+    component.input = 'Test'
+    component.sendMessage()
+    expect(scrollSpy).toHaveBeenCalled()
+  })
+
+  it('should focus chat input when dropdown is opened', () => {
+    const focus = jest.fn()
+    component.chatInput = {
+      nativeElement: { focus: focus },
+    } as unknown as ElementRef<HTMLInputElement>
+
+    component.onOpenChange(true)
+    jest.advanceTimersByTime(15)
+    expect(focus).toHaveBeenCalled()
+  })
+
+  it('should send message on Enter key press', () => {
+    jest.spyOn(component, 'sendMessage')
+    const event = new KeyboardEvent('keydown', { key: 'Enter' })
+    component.searchInputKeyDown(event)
+    expect(component.sendMessage).toHaveBeenCalled()
+  })
+})
--- a/src-ui/src/app/components/chat/chat/chat.component.ts
+++ b/src-ui/src/app/components/chat/chat/chat.component.ts
@@ -0,0 +1,140 @@
+import { Component, ElementRef, inject, OnInit, ViewChild } from '@angular/core'
+import { FormsModule, ReactiveFormsModule } from '@angular/forms'
+import { NavigationEnd, Router } from '@angular/router'
+import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
+import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { filter, map } from 'rxjs'
+import { ChatMessage, ChatService } from 'src/app/services/chat.service'
+
+@Component({
+  selector: 'pngx-chat',
+  imports: [
+    FormsModule,
+    ReactiveFormsModule,
+    NgxBootstrapIconsModule,
+    NgbDropdownModule,
+  ],
+  templateUrl: './chat.component.html',
+  styleUrl: './chat.component.scss',
+})
+export class ChatComponent implements OnInit {
+  public messages: ChatMessage[] = []
+  public loading = false
+  public input: string = ''
+  public documentId!: number
+
+  private chatService: ChatService = inject(ChatService)
+  private router: Router = inject(Router)
+
+  @ViewChild('scrollAnchor') scrollAnchor!: ElementRef<HTMLDivElement>
+  @ViewChild('chatInput') chatInput!: ElementRef<HTMLInputElement>
+
+  private typewriterBuffer: string[] = []
+  private typewriterActive = false
+
+  public get placeholder(): string {
+    return this.documentId
+      ? $localize`Ask a question about this document...`
+      : $localize`Ask a question about a document...`
+  }
+
+  ngOnInit(): void {
+    this.updateDocumentId(this.router.url)
+    this.router.events
+      .pipe(
+        filter((event) => event instanceof NavigationEnd),
+        map((event) => (event as NavigationEnd).url)
+      )
+      .subscribe((url) => {
+        this.updateDocumentId(url)
+      })
+  }
+
+  private updateDocumentId(url: string): void {
+    const docIdRe = url.match(/^\/documents\/(\d+)/)
+    this.documentId = docIdRe ? +docIdRe[1] : undefined
+  }
+
+  sendMessage(): void {
+    if (!this.input.trim()) return
+
+    const userMessage: ChatMessage = { role: 'user', content: this.input }
+    this.messages.push(userMessage)
+    this.scrollToBottom()
+
+    const assistantMessage: ChatMessage = {
+      role: 'assistant',
+      content: '',
+      isStreaming: true,
+    }
+    this.messages.push(assistantMessage)
+    this.loading = true
+
+    let lastPartialLength = 0
+
+    this.chatService.streamChat(this.documentId, this.input).subscribe({
+      next: (chunk) => {
+        const delta = chunk.substring(lastPartialLength)
+        lastPartialLength = chunk.length
+        this.enqueueTypewriter(delta, assistantMessage)
+      },
+      error: () => {
+        assistantMessage.content += '\n\n⚠️ Error receiving response.'
+        assistantMessage.isStreaming = false
+        this.loading = false
+      },
+      complete: () => {
+        assistantMessage.isStreaming = false
+        this.loading = false
+        this.scrollToBottom()
+      },
+    })
+
+    this.input = ''
+  }
+
+  enqueueTypewriter(chunk: string, message: ChatMessage): void {
+    if (!chunk) return
+
+    this.typewriterBuffer.push(...chunk.split(''))
+
+    if (!this.typewriterActive) {
+      this.typewriterActive = true
+      this.playTypewriter(message)
+    }
+  }
+
+  playTypewriter(message: ChatMessage): void {
+    if (this.typewriterBuffer.length === 0) {
+      this.typewriterActive = false
+      return
+    }
+
+    const nextChar = this.typewriterBuffer.shift()
+    message.content += nextChar
+    this.scrollToBottom()
+
+    setTimeout(() => this.playTypewriter(message), 10) // 10ms per character
+  }
+
+  private scrollToBottom(): void {
+    setTimeout(() => {
+      this.scrollAnchor?.nativeElement?.scrollIntoView({ behavior: 'smooth' })
+    }, 50)
+  }
+
+  public onOpenChange(open: boolean): void {
+    if (open) {
+      setTimeout(() => {
+        this.chatInput.nativeElement.focus()
+      }, 10)
+    }
+  }
+
+  public searchInputKeyDown(event: KeyboardEvent) {
+    if (event.key === 'Enter') {
+      event.preventDefault()
+      this.sendMessage()
+    }
+  }
+}
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.html
@@ -0,0 +1,75 @@
+<div class="modal-header">
+  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
+  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()">
+  </button>
+</div>
+<div class="modal-body">
+  @if (message) {
+    <p class="mb-3" [innerHTML]="message"></p>
+  }
+  <div class="btn-group mb-3" role="group">
+    <input
+      type="radio"
+      class="btn-check"
+      name="passwordRemoveMode"
+      id="removeReplace"
+      [(ngModel)]="updateDocument"
+      [value]="true"
+      (ngModelChange)="onUpdateDocumentChange($event)"
+    />
+    <label class="btn btn-outline-primary btn-sm" for="removeReplace">
+      <i-bs name="pencil"></i-bs>
+      <span class="ms-2" i18n>Replace current document</span>
+    </label>
+    <input
+      type="radio"
+      class="btn-check"
+      name="passwordRemoveMode"
+      id="removeCreate"
+      [(ngModel)]="updateDocument"
+      [value]="false"
+      (ngModelChange)="onUpdateDocumentChange($event)"
+    />
+    <label class="btn btn-outline-primary btn-sm" for="removeCreate">
+      <i-bs name="plus"></i-bs>
+      <span class="ms-2" i18n>Create new document</span>
+    </label>
+  </div>
+  @if (!updateDocument) {
+    <div class="d-flex flex-column flex-md-row w-100 gap-3 align-items-center">
+      <div class="form-group d-flex">
+        <div class="form-check">
+          <input class="form-check-input" type="checkbox" id="copyMetaRemove" [(ngModel)]="includeMetadata" />
+          <label class="form-check-label" for="copyMetaRemove" i18n> Copy metadata
+          </label>
+        </div>
+        <div class="form-check ms-3">
+          <input class="form-check-input" type="checkbox" id="deleteOriginalRemove" [(ngModel)]="deleteOriginal" />
+          <label class="form-check-label" for="deleteOriginalRemove" i18n> Delete original</label>
+        </div>
+      </div>
+    </div>
+  }
+</div>
+<div class="modal-footer flex-nowrap gap-2">
+  <button
+    type="button"
+    class="btn"
+    [class]="cancelBtnClass"
+    (click)="cancel()"
+    [disabled]="!buttonsEnabled"
+  >
+    <span class="d-inline-block" style="padding-bottom: 1px;">
+      {{cancelBtnCaption}}
+    </span>
+  </button>
+  <button
+    type="button"
+    class="btn"
+    [class]="btnClass"
+    (click)="confirm()"
+    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
+  >
+    {{btnCaption}}
+  </button>
+</div>
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.scss
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.spec.ts
@@ -0,0 +1,53 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing'
+import { By } from '@angular/platform-browser'
+import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
+import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
+import { PasswordRemovalConfirmDialogComponent } from './password-removal-confirm-dialog.component'
+
+describe('PasswordRemovalConfirmDialogComponent', () => {
+  let component: PasswordRemovalConfirmDialogComponent
+  let fixture: ComponentFixture<PasswordRemovalConfirmDialogComponent>
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      providers: [NgbActiveModal],
+      imports: [
+        NgxBootstrapIconsModule.pick(allIcons),
+        PasswordRemovalConfirmDialogComponent,
+      ],
+    }).compileComponents()
+
+    fixture = TestBed.createComponent(PasswordRemovalConfirmDialogComponent)
+    component = fixture.componentInstance
+    fixture.detectChanges()
+  })
+
+  it('should default to replacing the document', () => {
+    expect(component.updateDocument).toBe(true)
+    expect(
+      fixture.debugElement.query(By.css('#removeReplace')).nativeElement.checked
+    ).toBe(true)
+  })
+
+  it('should allow creating a new document with metadata and delete toggle', () => {
+    component.onUpdateDocumentChange(false)
+    fixture.detectChanges()
+
+    expect(component.updateDocument).toBe(false)
+    expect(fixture.debugElement.query(By.css('#copyMetaRemove'))).not.toBeNull()
+
+    component.includeMetadata = false
+    component.deleteOriginal = true
+    component.onUpdateDocumentChange(true)
+    expect(component.updateDocument).toBe(true)
+    expect(component.includeMetadata).toBe(true)
+    expect(component.deleteOriginal).toBe(false)
+  })
+
+  it('should emit confirm when confirmed', () => {
+    let confirmed = false
+    component.confirmClicked.subscribe(() => (confirmed = true))
+    component.confirm()
+    expect(confirmed).toBe(true)
+  })
+})
--- a/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
+++ b/src-ui/src/app/components/common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component.ts
@@ -0,0 +1,38 @@
+import { Component, Input } from '@angular/core'
+import { FormsModule } from '@angular/forms'
+import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { ConfirmDialogComponent } from '../confirm-dialog.component'
+
+@Component({
+  selector: 'pngx-password-removal-confirm-dialog',
+  templateUrl: './password-removal-confirm-dialog.component.html',
+  styleUrls: ['./password-removal-confirm-dialog.component.scss'],
+  imports: [FormsModule, NgxBootstrapIconsModule],
+})
+export class PasswordRemovalConfirmDialogComponent extends ConfirmDialogComponent {
+  updateDocument: boolean = true
+  includeMetadata: boolean = true
+  deleteOriginal: boolean = false
+
+  @Input()
+  override title = $localize`Remove password protection`
+
+  @Input()
+  override message =
+    $localize`Create an unprotected copy or replace the existing file.`
+
+  @Input()
+  override btnCaption = $localize`Start`
+
+  constructor() {
+    super()
+  }
+
+  onUpdateDocumentChange(updateDocument: boolean) {
+    this.updateDocument = updateDocument
+    if (this.updateDocument) {
+      this.deleteOriginal = false
+      this.includeMetadata = true
+    }
+  }
+}
--- a/src-ui/src/app/components/common/custom-fields-dropdown/custom-fields-dropdown.component.html
+++ b/src-ui/src/app/components/common/custom-fields-dropdown/custom-fields-dropdown.component.html
@@ -1,7 +1,7 @@
-<div ngbDropdown #fieldDropdown="ngbDropdown" (openChange)="onOpenClose($event)" [popperOptions]="popperOptions" placement="bottom-end">
-    <button class="btn btn-sm btn-outline-primary" id="customFieldsDropdown" [disabled]="disabled" ngbDropdownToggle>
+<div ngbDropdown #fieldDropdown="ngbDropdown" (openChange)="onOpenClose($event)" [popperOptions]="popperOptions">
+    <button type="button" class="btn btn-sm btn-outline-primary" id="customFieldsDropdown" [disabled]="disabled" ngbDropdownToggle>
      <i-bs name="ui-radios"></i-bs>
-      <div class="d-none d-sm-inline">&nbsp;<ng-container i18n>Custom Fields</ng-container></div>
+      <div class="d-none d-lg-inline">&nbsp;<ng-container i18n>Custom Fields</ng-container></div>
    </button>
    <div ngbDropdownMenu aria-labelledby="customFieldsDropdown" class="shadow custom-fields-dropdown">
        <div class="list-group list-group-flush" (keydown)="listKeyDown($event)">
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts
@@ -412,6 +412,9 @@ describe('WorkflowEditDialogComponent', () => {
      return newFilter
    }

+    const correspondentAny = addFilterOfType(TriggerFilterType.CorrespondentAny)
+    correspondentAny.get('values').setValue([11])
+
    const correspondentIs = addFilterOfType(TriggerFilterType.CorrespondentIs)
    correspondentIs.get('values').setValue(1)

@@ -421,12 +424,18 @@ describe('WorkflowEditDialogComponent', () => {
    const documentTypeIs = addFilterOfType(TriggerFilterType.DocumentTypeIs)
    documentTypeIs.get('values').setValue(1)

+    const documentTypeAny = addFilterOfType(TriggerFilterType.DocumentTypeAny)
+    documentTypeAny.get('values').setValue([12])
+
    const documentTypeNot = addFilterOfType(TriggerFilterType.DocumentTypeNot)
    documentTypeNot.get('values').setValue([1])

    const storagePathIs = addFilterOfType(TriggerFilterType.StoragePathIs)
    storagePathIs.get('values').setValue(1)

+    const storagePathAny = addFilterOfType(TriggerFilterType.StoragePathAny)
+    storagePathAny.get('values').setValue([13])
+
    const storagePathNot = addFilterOfType(TriggerFilterType.StoragePathNot)
    storagePathNot.get('values').setValue([1])

@@ -441,10 +450,13 @@ describe('WorkflowEditDialogComponent', () => {
    expect(formValues.triggers[0].filter_has_tags).toEqual([1])
    expect(formValues.triggers[0].filter_has_all_tags).toEqual([2, 3])
    expect(formValues.triggers[0].filter_has_not_tags).toEqual([4])
+    expect(formValues.triggers[0].filter_has_any_correspondents).toEqual([11])
    expect(formValues.triggers[0].filter_has_correspondent).toEqual(1)
    expect(formValues.triggers[0].filter_has_not_correspondents).toEqual([1])
+    expect(formValues.triggers[0].filter_has_any_document_types).toEqual([12])
    expect(formValues.triggers[0].filter_has_document_type).toEqual(1)
    expect(formValues.triggers[0].filter_has_not_document_types).toEqual([1])
+    expect(formValues.triggers[0].filter_has_any_storage_paths).toEqual([13])
    expect(formValues.triggers[0].filter_has_storage_path).toEqual(1)
    expect(formValues.triggers[0].filter_has_not_storage_paths).toEqual([1])
    expect(formValues.triggers[0].filter_custom_field_query).toEqual(
@@ -507,16 +519,22 @@ describe('WorkflowEditDialogComponent', () => {

    setFilter(TriggerFilterType.TagsAll, 11)
    setFilter(TriggerFilterType.TagsNone, 12)
+    setFilter(TriggerFilterType.CorrespondentAny, 16)
    setFilter(TriggerFilterType.CorrespondentNot, 13)
+    setFilter(TriggerFilterType.DocumentTypeAny, 17)
    setFilter(TriggerFilterType.DocumentTypeNot, 14)
+    setFilter(TriggerFilterType.StoragePathAny, 18)
    setFilter(TriggerFilterType.StoragePathNot, 15)

    const formValues = component['getFormValues']()

    expect(formValues.triggers[0].filter_has_all_tags).toEqual([11])
    expect(formValues.triggers[0].filter_has_not_tags).toEqual([12])
+    expect(formValues.triggers[0].filter_has_any_correspondents).toEqual([16])
    expect(formValues.triggers[0].filter_has_not_correspondents).toEqual([13])
+    expect(formValues.triggers[0].filter_has_any_document_types).toEqual([17])
    expect(formValues.triggers[0].filter_has_not_document_types).toEqual([14])
+    expect(formValues.triggers[0].filter_has_any_storage_paths).toEqual([18])
    expect(formValues.triggers[0].filter_has_not_storage_paths).toEqual([15])
  })

@@ -640,8 +658,11 @@ describe('WorkflowEditDialogComponent', () => {
      filter_has_tags: [],
      filter_has_all_tags: [],
      filter_has_not_tags: [],
+      filter_has_any_correspondents: [],
      filter_has_not_correspondents: [],
+      filter_has_any_document_types: [],
      filter_has_not_document_types: [],
+      filter_has_any_storage_paths: [],
      filter_has_not_storage_paths: [],
      filter_has_correspondent: null,
      filter_has_document_type: null,
@@ -699,11 +720,14 @@ describe('WorkflowEditDialogComponent', () => {
    trigger.filter_has_tags = [1]
    trigger.filter_has_all_tags = [2, 3]
    trigger.filter_has_not_tags = [4]
+    trigger.filter_has_any_correspondents = [10] as any
    trigger.filter_has_correspondent = 5 as any
    trigger.filter_has_not_correspondents = [6] as any
    trigger.filter_has_document_type = 7 as any
+    trigger.filter_has_any_document_types = [11] as any
    trigger.filter_has_not_document_types = [8] as any
    trigger.filter_has_storage_path = 9 as any
+    trigger.filter_has_any_storage_paths = [12] as any
    trigger.filter_has_not_storage_paths = [10] as any
    trigger.filter_custom_field_query = JSON.stringify([
      'AND',
@@ -714,8 +738,8 @@ describe('WorkflowEditDialogComponent', () => {
    component.ngOnInit()
    const triggerGroup = component.triggerFields.at(0) as FormGroup
    const filters = component.getFiltersFormArray(triggerGroup)
-    expect(filters.length).toBe(10)
-    const customFieldFilter = filters.at(9) as FormGroup
+    expect(filters.length).toBe(13)
+    const customFieldFilter = filters.at(12) as FormGroup
    expect(customFieldFilter.get('type').value).toBe(
      TriggerFilterType.CustomFieldQuery
    )
@@ -724,12 +748,27 @@ describe('WorkflowEditDialogComponent', () => {
  })

  it('should expose select metadata helpers', () => {
+    expect(component.isSelectMultiple(TriggerFilterType.CorrespondentAny)).toBe(
+      true
+    )
    expect(component.isSelectMultiple(TriggerFilterType.CorrespondentNot)).toBe(
      true
    )
    expect(component.isSelectMultiple(TriggerFilterType.CorrespondentIs)).toBe(
      false
    )
+    expect(component.isSelectMultiple(TriggerFilterType.DocumentTypeAny)).toBe(
+      true
+    )
+    expect(component.isSelectMultiple(TriggerFilterType.DocumentTypeIs)).toBe(
+      false
+    )
+    expect(component.isSelectMultiple(TriggerFilterType.StoragePathAny)).toBe(
+      true
+    )
+    expect(component.isSelectMultiple(TriggerFilterType.StoragePathIs)).toBe(
+      false
+    )

    component.correspondents = [{ id: 1, name: 'C1' } as any]
    component.documentTypes = [{ id: 2, name: 'DT' } as any]
@@ -741,9 +780,15 @@ describe('WorkflowEditDialogComponent', () => {
    expect(
      component.getFilterSelectItems(TriggerFilterType.DocumentTypeIs)
    ).toEqual(component.documentTypes)
+    expect(
+      component.getFilterSelectItems(TriggerFilterType.DocumentTypeAny)
+    ).toEqual(component.documentTypes)
    expect(
      component.getFilterSelectItems(TriggerFilterType.StoragePathIs)
    ).toEqual(component.storagePaths)
+    expect(
+      component.getFilterSelectItems(TriggerFilterType.StoragePathAny)
+    ).toEqual(component.storagePaths)
    expect(component.getFilterSelectItems(TriggerFilterType.TagsAll)).toEqual(
      []
    )
--- a/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts
+++ b/src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts
@@ -145,10 +145,13 @@ export enum TriggerFilterType {
  TagsAny = 'tags_any',
  TagsAll = 'tags_all',
  TagsNone = 'tags_none',
+  CorrespondentAny = 'correspondent_any',
  CorrespondentIs = 'correspondent_is',
  CorrespondentNot = 'correspondent_not',
+  DocumentTypeAny = 'document_type_any',
  DocumentTypeIs = 'document_type_is',
  DocumentTypeNot = 'document_type_not',
+  StoragePathAny = 'storage_path_any',
  StoragePathIs = 'storage_path_is',
  StoragePathNot = 'storage_path_not',
  CustomFieldQuery = 'custom_field_query',
@@ -172,8 +175,11 @@ type TriggerFilterAggregate = {
  filter_has_tags: number[]
  filter_has_all_tags: number[]
  filter_has_not_tags: number[]
+  filter_has_any_correspondents: number[]
  filter_has_not_correspondents: number[]
+  filter_has_any_document_types: number[]
  filter_has_not_document_types: number[]
+  filter_has_any_storage_paths: number[]
  filter_has_not_storage_paths: number[]
  filter_has_correspondent: number | null
  filter_has_document_type: number | null
@@ -219,6 +225,14 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
    allowMultipleEntries: false,
    allowMultipleValues: true,
  },
+  {
+    id: TriggerFilterType.CorrespondentAny,
+    name: $localize`Has any of these correspondents`,
+    inputType: 'select',
+    allowMultipleEntries: false,
+    allowMultipleValues: true,
+    selectItems: 'correspondents',
+  },
  {
    id: TriggerFilterType.CorrespondentIs,
    name: $localize`Has correspondent`,
@@ -243,6 +257,14 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
    allowMultipleValues: false,
    selectItems: 'documentTypes',
  },
+  {
+    id: TriggerFilterType.DocumentTypeAny,
+    name: $localize`Has any of these document types`,
+    inputType: 'select',
+    allowMultipleEntries: false,
+    allowMultipleValues: true,
+    selectItems: 'documentTypes',
+  },
  {
    id: TriggerFilterType.DocumentTypeNot,
    name: $localize`Does not have document types`,
@@ -259,6 +281,14 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
    allowMultipleValues: false,
    selectItems: 'storagePaths',
  },
+  {
+    id: TriggerFilterType.StoragePathAny,
+    name: $localize`Has any of these storage paths`,
+    inputType: 'select',
+    allowMultipleEntries: false,
+    allowMultipleValues: true,
+    selectItems: 'storagePaths',
+  },
  {
    id: TriggerFilterType.StoragePathNot,
    name: $localize`Does not have storage paths`,
@@ -306,6 +336,15 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
    extract: (trigger) => trigger.filter_has_not_tags,
    hasValue: (value) => Array.isArray(value) && value.length > 0,
  },
+  [TriggerFilterType.CorrespondentAny]: {
+    apply: (aggregate, values) => {
+      aggregate.filter_has_any_correspondents = Array.isArray(values)
+        ? [...values]
+        : [values]
+    },
+    extract: (trigger) => trigger.filter_has_any_correspondents,
+    hasValue: (value) => Array.isArray(value) && value.length > 0,
+  },
  [TriggerFilterType.CorrespondentIs]: {
    apply: (aggregate, values) => {
      aggregate.filter_has_correspondent = Array.isArray(values)
@@ -333,6 +372,15 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
    extract: (trigger) => trigger.filter_has_document_type,
    hasValue: (value) => value !== null && value !== undefined,
  },
+  [TriggerFilterType.DocumentTypeAny]: {
+    apply: (aggregate, values) => {
+      aggregate.filter_has_any_document_types = Array.isArray(values)
+        ? [...values]
+        : [values]
+    },
+    extract: (trigger) => trigger.filter_has_any_document_types,
+    hasValue: (value) => Array.isArray(value) && value.length > 0,
+  },
  [TriggerFilterType.DocumentTypeNot]: {
    apply: (aggregate, values) => {
      aggregate.filter_has_not_document_types = Array.isArray(values)
@@ -351,6 +399,15 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
    extract: (trigger) => trigger.filter_has_storage_path,
    hasValue: (value) => value !== null && value !== undefined,
  },
+  [TriggerFilterType.StoragePathAny]: {
+    apply: (aggregate, values) => {
+      aggregate.filter_has_any_storage_paths = Array.isArray(values)
+        ? [...values]
+        : [values]
+    },
+    extract: (trigger) => trigger.filter_has_any_storage_paths,
+    hasValue: (value) => Array.isArray(value) && value.length > 0,
+  },
  [TriggerFilterType.StoragePathNot]: {
    apply: (aggregate, values) => {
      aggregate.filter_has_not_storage_paths = Array.isArray(values)
@@ -642,8 +699,11 @@ export class WorkflowEditDialogComponent
            filter_has_tags: [],
            filter_has_all_tags: [],
            filter_has_not_tags: [],
+            filter_has_any_correspondents: [],
            filter_has_not_correspondents: [],
+            filter_has_any_document_types: [],
            filter_has_not_document_types: [],
+            filter_has_any_storage_paths: [],
            filter_has_not_storage_paths: [],
            filter_has_correspondent: null,
            filter_has_document_type: null,
@@ -670,10 +730,16 @@ export class WorkflowEditDialogComponent
          trigger.filter_has_tags = aggregate.filter_has_tags
          trigger.filter_has_all_tags = aggregate.filter_has_all_tags
          trigger.filter_has_not_tags = aggregate.filter_has_not_tags
+          trigger.filter_has_any_correspondents =
+            aggregate.filter_has_any_correspondents
          trigger.filter_has_not_correspondents =
            aggregate.filter_has_not_correspondents
+          trigger.filter_has_any_document_types =
+            aggregate.filter_has_any_document_types
          trigger.filter_has_not_document_types =
            aggregate.filter_has_not_document_types
+          trigger.filter_has_any_storage_paths =
+            aggregate.filter_has_any_storage_paths
          trigger.filter_has_not_storage_paths =
            aggregate.filter_has_not_storage_paths
          trigger.filter_has_correspondent =
@@ -856,8 +922,11 @@ export class WorkflowEditDialogComponent
      case TriggerFilterType.TagsAny:
      case TriggerFilterType.TagsAll:
      case TriggerFilterType.TagsNone:
+      case TriggerFilterType.CorrespondentAny:
      case TriggerFilterType.CorrespondentNot:
+      case TriggerFilterType.DocumentTypeAny:
      case TriggerFilterType.DocumentTypeNot:
+      case TriggerFilterType.StoragePathAny:
      case TriggerFilterType.StoragePathNot:
        return true
      default:
@@ -1179,8 +1248,11 @@ export class WorkflowEditDialogComponent
      filter_has_tags: [],
      filter_has_all_tags: [],
      filter_has_not_tags: [],
+      filter_has_any_correspondents: [],
      filter_has_not_correspondents: [],
+      filter_has_any_document_types: [],
      filter_has_not_document_types: [],
+      filter_has_any_storage_paths: [],
      filter_has_not_storage_paths: [],
      filter_custom_field_query: null,
      filter_has_correspondent: null,
--- a/src-ui/src/app/components/common/input/password/password.component.html
+++ b/src-ui/src/app/components/common/input/password/password.component.html
@@ -1,17 +1,24 @@
-<div class="mb-3">
-  <label class="form-label" [for]="inputId">{{title}}</label>
-  <div class="input-group" [class.is-invalid]="error">
-    <input #inputField [type]="showReveal && textVisible ? 'text' : 'password'" class="form-control" [class.is-invalid]="error" [id]="inputId" [(ngModel)]="value" (focus)="onFocus()" (focusout)="onFocusOut()" (change)="onChange(value)" [disabled]="disabled" [autocomplete]="autocomplete">
-    @if (showReveal) {
-      <button type="button" class="btn btn-outline-secondary" (click)="toggleVisibility()" i18n-title title="Show password" [disabled]="disabled || disableRevealToggle">
-        <i-bs name="eye"></i-bs>
-      </button>
+<div class="mb-3" [class.pb-3]="error">
+  <div class="row">
+    <div class="d-flex align-items-center position-relative hidden-button-container" [class.col-md-3]="horizontal">
+      @if (title) {
+        <label class="form-label" [class.mb-md-0]="horizontal" [for]="inputId">{{title}}</label>
+      }
+    </div>
+  <div class="position-relative" [class.col-md-9]="horizontal">
+    <div class="input-group" [class.is-invalid]="error">
+      <input #inputField [type]="showReveal && textVisible ? 'text' : 'password'" class="form-control" [class.is-invalid]="error" [id]="inputId" [(ngModel)]="value" (focus)="onFocus()" (focusout)="onFocusOut()" (change)="onChange(value)" [disabled]="disabled" [autocomplete]="autocomplete">
+      @if (showReveal) {
+        <button type="button" class="btn btn-outline-secondary" (click)="toggleVisibility()" i18n-title title="Show password" [disabled]="disabled || disableRevealToggle">
+          <i-bs name="eye"></i-bs>
+        </button>
+      }
+    </div>
+    <div class="invalid-feedback">
+      {{error}}
+    </div>
+    @if (hint) {
+      <small class="form-text text-muted" [innerHTML]="hint"></small>
    }
  </div>
-  <div class="invalid-feedback">
-    {{error}}
-  </div>
-  @if (hint) {
-    <small class="form-text text-muted" [innerHTML]="hint"></small>
-  }
 </div>
--- a/src-ui/src/app/components/common/input/text/text.component.html
+++ b/src-ui/src/app/components/common/input/text/text.component.html
@@ -15,6 +15,12 @@
        @if (hint) {
          <small class="form-text text-muted" [innerHTML]="hint"></small>
        }
+        @if (getSuggestion()?.length > 0) {
+          <small>
+            <span i18n>Suggestion:</span>&nbsp;
+            <a (click)="applySuggestion(s)" [routerLink]="[]">{{getSuggestion()}}</a>&nbsp;
+          </small>
+        }
        <div class="invalid-feedback position-absolute top-100">
          {{error}}
        </div>
--- a/src-ui/src/app/components/common/input/text/text.component.spec.ts
+++ b/src-ui/src/app/components/common/input/text/text.component.spec.ts
@@ -26,10 +26,20 @@ describe('TextComponent', () => {

  it('should support use of input field', () => {
    expect(component.value).toBeUndefined()
-    // TODO: why doesn't this work?
-    // input.value = 'foo'
-    // input.dispatchEvent(new Event('change'))
-    // fixture.detectChanges()
-    // expect(component.value).toEqual('foo')
+    input.value = 'foo'
+    input.dispatchEvent(new Event('input'))
+    fixture.detectChanges()
+    expect(component.value).toBe('foo')
+  })
+
+  it('should support suggestion', () => {
+    component.value = 'foo'
+    component.suggestion = 'foo'
+    expect(component.getSuggestion()).toBe('')
+    component.value = 'bar'
+    expect(component.getSuggestion()).toBe('foo')
+    component.applySuggestion()
+    fixture.detectChanges()
+    expect(component.value).toBe('foo')
  })
 })
--- a/src-ui/src/app/components/common/input/text/text.component.ts
+++ b/src-ui/src/app/components/common/input/text/text.component.ts
@@ -4,6 +4,7 @@ import {
  NG_VALUE_ACCESSOR,
  ReactiveFormsModule,
 } from '@angular/forms'
+import { RouterLink } from '@angular/router'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { AbstractInputComponent } from '../abstract-input'

@@ -18,7 +19,12 @@ import { AbstractInputComponent } from '../abstract-input'
  selector: 'pngx-input-text',
  templateUrl: './text.component.html',
  styleUrls: ['./text.component.scss'],
-  imports: [FormsModule, ReactiveFormsModule, NgxBootstrapIconsModule],
+  imports: [
+    FormsModule,
+    ReactiveFormsModule,
+    NgxBootstrapIconsModule,
+    RouterLink,
+  ],
 })
 export class TextComponent extends AbstractInputComponent<string> {
  @Input()
@@ -27,7 +33,19 @@ export class TextComponent extends AbstractInputComponent<string> {
  @Input()
  placeholder: string = ''

+  @Input()
+  suggestion: string = ''
+
  constructor() {
    super()
  }
+
+  getSuggestion() {
+    return this.value !== this.suggestion ? this.suggestion : ''
+  }
+
+  applySuggestion() {
+    this.value = this.suggestion
+    this.onChange(this.value)
+  }
 }
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.html
@@ -14,7 +14,7 @@
        @if (previewText) {
          <div class="bg-light p-3 overflow-auto whitespace-preserve" width="100%">{{previewText}}</div>
        } @else {
-          <object [data]="previewURL | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
+          <object [data]="previewUrl | safeUrl" width="100%" class="bg-light" [class.p-2]="!isPdf"></object>
        }
      } @else {
        @if (requiresPassword) {
@@ -24,7 +24,7 @@
        }
        @if (!requiresPassword) {
          <pdf-viewer
-            [src]="previewURL"
+            [src]="previewUrl"
            [original-size]="false"
            [show-borders]="false"
            [show-all]="true"
--- a/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
+++ b/src-ui/src/app/components/common/preview-popup/preview-popup.component.ts
@@ -71,7 +71,7 @@ export class PreviewPopupComponent implements OnDestroy {
    return (this.isPdf && this.useNativePdfViewer) || !this.isPdf
  }

-  get previewURL() {
+  get previewUrl() {
    return this.documentService.getPreviewUrl(this.document.id)
  }

@@ -93,7 +93,7 @@ export class PreviewPopupComponent implements OnDestroy {
  init() {
    if (this.document.mime_type?.includes('text')) {
      this.http
-        .get(this.previewURL, { responseType: 'text' })
+        .get(this.previewUrl, { responseType: 'text' })
        .pipe(first(), takeUntil(this.unsubscribeNotifier))
        .subscribe({
          next: (res) => {
@@ -126,10 +126,6 @@ export class PreviewPopupComponent implements OnDestroy {
    }
  }

-  get previewUrl() {
-    return this.documentService.getPreviewUrl(this.document.id)
-  }
-
  mouseEnterPreview() {
    this.mouseOnPreview = true
    if (!this.popover.isOpen()) {
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html
@@ -0,0 +1,49 @@
+<div class="btn-group">
+  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="loading || (suggestions && !aiEnabled)">
+    @if (loading) {
+      <div class="spinner-border spinner-border-sm" role="status"></div>
+    } @else {
+      <i-bs width="1.2em" height="1.2em" name="stars"></i-bs>
+    }
+    <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
+    @if (totalSuggestions > 0) {
+      <span class="badge bg-primary ms-2">{{ totalSuggestions }}</span>
+    }
+  </button>
+
+  @if (aiEnabled) {
+    <div class="btn-group" ngbDropdown #dropdown="ngbDropdown" [popperOptions]="popperOptions">
+      <button type="button" class="btn btn-sm btn-outline-primary" ngbDropdownToggle [disabled]="loading || !suggestions" aria-expanded="false" aria-controls="suggestionsDropdown" aria-label="Suggestions dropdown">
+        <span class="visually-hidden" i18n>Show suggestions</span>
+      </button>
+
+      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
+        <div class="list-group list-group-flush small pb-0">
+          @if (!suggestions?.suggested_tags && !suggestions?.suggested_document_types && !suggestions?.suggested_correspondents) {
+            <div class="list-group-item text-muted fst-italic">
+              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
+            </div>
+          }
+          @if (suggestions?.suggested_tags.length > 0) {
+            <small class="list-group-item text-uppercase text-muted small">Tags</small>
+            @for (tag of suggestions.suggested_tags; track tag) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addTag.emit(tag)" i18n>{{ tag }}</button>
+            }
+          }
+          @if (suggestions?.suggested_document_types.length > 0) {
+            <div class="list-group-item text-uppercase text-muted small">Document Types</div>
+            @for (type of suggestions.suggested_document_types; track type) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addDocumentType.emit(type)" i18n>{{ type }}</button>
+            }
+          }
+          @if (suggestions?.suggested_correspondents.length > 0) {
+            <div class="list-group-item text-uppercase text-muted small">Correspondents</div>
+            @for (correspondent of suggestions.suggested_correspondents; track correspondent) {
+              <button type="button" class="list-group-item list-group-item-action bg-light" (click)="addCorrespondent.emit(correspondent)" i18n>{{ correspondent }}</button>
+            }
+          }
+        </div>
+      </div>
+    </div>
+  }
+</div>
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.scss
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.scss
@@ -0,0 +1,3 @@
+.suggestions-dropdown {
+  min-width: 250px;
+}
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.spec.ts
@@ -0,0 +1,51 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing'
+import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
+import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
+import { SuggestionsDropdownComponent } from './suggestions-dropdown.component'
+
+describe('SuggestionsDropdownComponent', () => {
+  let component: SuggestionsDropdownComponent
+  let fixture: ComponentFixture<SuggestionsDropdownComponent>
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [
+        NgbDropdownModule,
+        NgxBootstrapIconsModule.pick(allIcons),
+        SuggestionsDropdownComponent,
+      ],
+      providers: [],
+    })
+    fixture = TestBed.createComponent(SuggestionsDropdownComponent)
+    component = fixture.componentInstance
+    fixture.detectChanges()
+  })
+
+  it('should calculate totalSuggestions', () => {
+    component.suggestions = {
+      suggested_correspondents: ['John Doe'],
+      suggested_tags: ['Tag1', 'Tag2'],
+      suggested_document_types: ['Type1'],
+    }
+    expect(component.totalSuggestions).toBe(4)
+  })
+
+  it('should emit getSuggestions when clickSuggest is called and suggestions are null', () => {
+    jest.spyOn(component.getSuggestions, 'emit')
+    component.suggestions = null
+    component.clickSuggest()
+    expect(component.getSuggestions.emit).toHaveBeenCalled()
+  })
+
+  it('should toggle dropdown when clickSuggest is called and suggestions are not null', () => {
+    component.aiEnabled = true
+    fixture.detectChanges()
+    component.suggestions = {
+      suggested_correspondents: [],
+      suggested_tags: [],
+      suggested_document_types: [],
+    }
+    component.clickSuggest()
+    expect(component.dropdown.open).toBeTruthy()
+  })
+})
--- a/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts
+++ b/src-ui/src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.ts
@@ -0,0 +1,64 @@
+import {
+  Component,
+  EventEmitter,
+  Input,
+  Output,
+  ViewChild,
+} from '@angular/core'
+import { NgbDropdown, NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
+import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
+import { DocumentSuggestions } from 'src/app/data/document-suggestions'
+import { pngxPopperOptions } from 'src/app/utils/popper-options'
+
+@Component({
+  selector: 'pngx-suggestions-dropdown',
+  imports: [NgbDropdownModule, NgxBootstrapIconsModule],
+  templateUrl: './suggestions-dropdown.component.html',
+  styleUrl: './suggestions-dropdown.component.scss',
+})
+export class SuggestionsDropdownComponent {
+  public popperOptions = pngxPopperOptions
+
+  @ViewChild('dropdown') dropdown: NgbDropdown
+
+  @Input()
+  suggestions: DocumentSuggestions = null
+
+  @Input()
+  aiEnabled: boolean = false
+
+  @Input()
+  loading: boolean = false
+
+  @Input()
+  disabled: boolean = false
+
+  @Output()
+  getSuggestions: EventEmitter<SuggestionsDropdownComponent> =
+    new EventEmitter()
+
+  @Output()
+  addTag: EventEmitter<string> = new EventEmitter()
+
+  @Output()
+  addDocumentType: EventEmitter<string> = new EventEmitter()
+
+  @Output()
+  addCorrespondent: EventEmitter<string> = new EventEmitter()
+
+  public clickSuggest(): void {
+    if (!this.suggestions) {
+      this.getSuggestions.emit(this)
+    } else {
+      this.dropdown?.toggle()
+    }
+  }
+
+  get totalSuggestions(): number {
+    return (
+      this.suggestions?.suggested_correspondents?.length +
+        this.suggestions?.suggested_tags?.length +
+        this.suggestions?.suggested_document_types?.length || 0
+    )
+  }
+}
--- a/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.html
+++ b/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.html
@@ -266,6 +266,43 @@
                  }
                </span>
              </dd>
+              @if (aiEnabled) {
+                <dt i18n>AI Index</dt>
+                <dd class="d-flex align-items-center">
+                  <button class="btn btn-sm d-flex align-items-center btn-dark text-uppercase small" [ngbPopover]="llmIndexStatus" triggers="click mouseenter:mouseleave">
+                    {{status.tasks.llmindex_status}}
+                    @if (status.tasks.llmindex_status === 'OK') {
+                      @if (isStale(status.tasks.llmindex_last_modified)) {
+                        <i-bs name="exclamation-triangle-fill" class="text-warning ms-2 lh-1"></i-bs>
+                      } @else {
+                        <i-bs name="check-circle-fill" class="text-primary ms-2 lh-1"></i-bs>
+                      }
+                    } @else {
+                      <i-bs name="exclamation-triangle-fill" class="ms-2 lh-1"
+                      [class.text-danger]="status.tasks.llmindex_status === SystemStatusItemStatus.ERROR"
+                      [class.text-warning]="status.tasks.llmindex_status === SystemStatusItemStatus.WARNING"
+                      [class.text-muted]="status.tasks.llmindex_status === SystemStatusItemStatus.DISABLED"></i-bs>
+                    }
+                  </button>
+                  @if (currentUserIsSuperUser) {
+                    @if (isRunning(PaperlessTaskName.LLMIndexUpdate)) {
+                      <div class="spinner-border spinner-border-sm ms-2" role="status"></div>
+                    } @else {
+                      <button class="btn btn-sm d-flex align-items-center btn-dark small ms-2" (click)="runTask(PaperlessTaskName.LLMIndexUpdate)">
+                        <i-bs name="play-fill"></i-bs>&nbsp;
+                        <ng-container i18n>Run Task</ng-container>
+                      </button>
+                    }
+                  }
+                </dd>
+                <ng-template #llmIndexStatus>
+                  @if (status.tasks.llmindex_status === 'OK') {
+                    <h6><ng-container i18n>Last Run</ng-container>:</h6> <span class="font-monospace small">{{status.tasks.llmindex_last_modified | customDate:'medium'}}</span>
+                  } @else {
+                    <h6><ng-container i18n>Error</ng-container>:</h6> <span class="font-monospace small">{{status.tasks.llmindex_error}}</span>
+                  }
+                </ng-template>
+              }
            </dl>
          </div>
        </div>
--- a/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.spec.ts
+++ b/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.spec.ts
@@ -68,6 +68,9 @@ const status: SystemStatus = {
    sanity_check_status: SystemStatusItemStatus.OK,
    sanity_check_last_run: new Date().toISOString(),
    sanity_check_error: null,
+    llmindex_status: SystemStatusItemStatus.OK,
+    llmindex_last_modified: new Date().toISOString(),
+    llmindex_error: null,
  },
 }

--- a/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.ts
+++ b/src-ui/src/app/components/common/system-status-dialog/system-status-dialog.component.ts
@@ -13,9 +13,11 @@ import {
  SystemStatus,
  SystemStatusItemStatus,
 } from 'src/app/data/system-status'
+import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { FileSizePipe } from 'src/app/pipes/file-size.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
+import { SettingsService } from 'src/app/services/settings.service'
 import { SystemStatusService } from 'src/app/services/system-status.service'
 import { TasksService } from 'src/app/services/tasks.service'
 import { ToastService } from 'src/app/services/toast.service'
@@ -44,6 +46,7 @@ export class SystemStatusDialogComponent implements OnInit, OnDestroy {
  private toastService = inject(ToastService)
  private permissionsService = inject(PermissionsService)
  private websocketStatusService = inject(WebsocketStatusService)
+  private settingsService = inject(SettingsService)

  public SystemStatusItemStatus = SystemStatusItemStatus
  public PaperlessTaskName = PaperlessTaskName
@@ -60,6 +63,10 @@ export class SystemStatusDialogComponent implements OnInit, OnDestroy {
    return this.permissionsService.isSuperUser()
  }

+  get aiEnabled(): boolean {
+    return this.settingsService.get(SETTINGS_KEYS.AI_ENABLED)
+  }
+
  public ngOnInit() {
    this.versionMismatch =
      environment.production &&
--- a/src-ui/src/app/components/document-detail/document-detail.component.html
+++ b/src-ui/src/app/components/document-detail/document-detail.component.html
@@ -65,19 +65,15 @@
      <button ngbDropdownItem (click)="editPdf()" [disabled]="!userIsOwner || !userCanEdit || originalContentRenderType !== ContentRenderType.PDF">
        <i-bs name="pencil"></i-bs>&nbsp;<ng-container i18n>PDF Editor</ng-container>
      </button>
+
+      @if (userIsOwner && (requiresPassword || password)) {
+        <button ngbDropdownItem (click)="removePassword()" [disabled]="!password">
+          <i-bs name="unlock"></i-bs>&nbsp;<ng-container i18n>Remove Password</ng-container>
+        </button>
+      }
    </div>
  </div>

-  <pngx-custom-fields-dropdown
-    *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.CustomField }"
-    [documentId]="documentId"
-    [disabled]="!userCanEdit"
-    [existingFields]="document?.custom_fields"
-    (created)="refreshCustomFields()"
-    (added)="addField($event)">
-  </pngx-custom-fields-dropdown>
-
-
  <div class="ms-auto" ngbDropdown>
    <button class="btn btn-sm btn-outline-primary" id="sendDropdown" ngbDropdownToggle>
      <i-bs name="send"></i-bs>
@@ -98,7 +94,7 @@
 </pngx-page-header>

 <div class="row">
-  <div class="col-md-6 col-xl-4 mb-4">
+  <div class="col-md-6 col-xl-5 mb-4">

    <form [formGroup]='documentForm' (ngSubmit)="save()">

@@ -115,6 +111,32 @@
          </button>
        </div>

+        <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
+          <div class="btn-group pb-3 ms-auto">
+            <pngx-suggestions-dropdown *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }"
+              [disabled]="!userCanEdit || suggestionsLoading"
+              [loading]="suggestionsLoading"
+              [suggestions]="suggestions"
+              [aiEnabled]="aiEnabled"
+              (getSuggestions)="getSuggestions()"
+              (addTag)="createTag($event)"
+              (addDocumentType)="createDocumentType($event)"
+              (addCorrespondent)="createCorrespondent($event)">
+            </pngx-suggestions-dropdown>
+          </div>
+
+          <div class="btn-group pb-3 ms-2">
+            <pngx-custom-fields-dropdown
+              *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.CustomField }"
+              [documentId]="documentId"
+              [disabled]="!userCanEdit"
+              [existingFields]="document?.custom_fields"
+              (created)="refreshCustomFields()"
+              (added)="addField($event)">
+            </pngx-custom-fields-dropdown>
+          </div>
+        </ng-container>
+
        <ng-container *ngTemplateOutlet="saveButtons"></ng-container>
      </div>

@@ -123,7 +145,7 @@
          <a ngbNavLink i18n>Details</a>
          <ng-template ngbNavContent>
            <div>
-              <pngx-input-text #inputTitle i18n-title title="Title" formControlName="title" [horizontal]="true" (keyup)="titleKeyUp($event)" [error]="error?.title"></pngx-input-text>
+              <pngx-input-text #inputTitle i18n-title title="Title" formControlName="title" [horizontal]="true" [suggestion]="suggestions?.title" (keyup)="titleKeyUp($event)" [error]="error?.title"></pngx-input-text>
              <pngx-input-number i18n-title title="Archive serial number" [error]="error?.archive_serial_number" [horizontal]="true" formControlName='archive_serial_number'></pngx-input-number>
              <pngx-input-date i18n-title title="Date created" formControlName="created" [suggestions]="suggestions?.dates" [showFilter]="true" [horizontal]="true" (filterDocuments)="filterDocuments($event)"
              [error]="error?.created"></pngx-input-date>
@@ -133,7 +155,7 @@
              (createNew)="createDocumentType($event)" [hideAddButton]="createDisabled(DataType.DocumentType)" [suggestions]="suggestions?.document_types" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.DocumentType }"></pngx-input-select>
              <pngx-input-select [items]="storagePaths" i18n-title title="Storage path" formControlName="storage_path" [allowNull]="true" [showFilter]="true" [horizontal]="true" (filterDocuments)="filterDocuments($event, DataType.StoragePath)"
              (createNew)="createStoragePath($event)" [hideAddButton]="createDisabled(DataType.StoragePath)" [suggestions]="suggestions?.storage_paths" i18n-placeholder placeholder="Default" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.StoragePath }"></pngx-input-select>
-              <pngx-input-tags formControlName="tags" [suggestions]="suggestions?.tags" [showFilter]="true" [horizontal]="true" (filterDocuments)="filterDocuments($event, DataType.Tag)" [hideAddButton]="createDisabled(DataType.Tag)" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Tag }"></pngx-input-tags>
+              <pngx-input-tags #tagsInput formControlName="tags" [suggestions]="suggestions?.tags" [showFilter]="true" [horizontal]="true" (filterDocuments)="filterDocuments($event, DataType.Tag)" [hideAddButton]="createDisabled(DataType.Tag)" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Tag }"></pngx-input-tags>
              @for (fieldInstance of document?.custom_fields; track fieldInstance.field; let i = $index) {
                <div [formGroup]="customFieldFormFields.controls[i]">
                  @switch (getCustomFieldFromInstance(fieldInstance)?.data_type) {
@@ -355,14 +377,14 @@
    </form>
  </div>

-  <div class="col-md-6 col-xl-8 mb-3 d-none d-md-block position-relative" #pdfPreview>
+  <div class="col-md-6 col-xl-7 mb-3 d-none d-md-block position-relative" #pdfPreview>
    <ng-container *ngTemplateOutlet="previewContent"></ng-container>
  </div>

 </div>

 <ng-template #saveButtons>
-  <div class="btn-group pb-3 ms-auto">
+  <div class="btn-group pb-3 ms-4">
    <ng-container *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Document }">
      <button type="submit" class="order-3 btn btn-sm btn-primary" i18n [disabled]="!userCanEdit || networkActive || (isDirty$ | async) !== true">Save</button>
      @if (hasNext()) {
@@ -379,7 +401,7 @@
 <ng-template #previewContent>
  <div class="thumb-preview position-absolute pe-none text-center" [class.fade]="previewLoaded">
    @if (showThumbnailOverlay) {
-      <img [src]="thumbUrl | safeUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
+      <img [src]="thumbUrl" class="mx-auto" [attr.width]="previewZoomScale === 'page-fit' ? 'auto' : '100%'" [attr.height]="previewZoomScale === 'page-fit' ? '100%' : 'auto'" alt="Document loading..." i18n-alt />
    }
    <div class="position-absolute top-0 start-0 m-2 p-2 d-flex align-items-center justify-content-center">
      <div>
@@ -414,7 +436,7 @@
      }
      @case (ContentRenderType.Image) {
        <div class="preview-sticky">
-          <img [src]="previewUrl | safeUrl" width="100%" height="100%" alt="{{title}}" />
+          <img [src]="previewUrl" width="100%" height="100%" alt="{{title}}" />
        </div>
      }
      @case (ContentRenderType.TIFF) {
--- a/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
@@ -66,6 +66,7 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { environment } from 'src/environments/environment'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
+import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import {
  DocumentDetailComponent,
@@ -156,6 +157,16 @@ describe('DocumentDetailComponent', () => {
        {
          provide: TagService,
          useValue: {
+            getCachedMany: (ids: number[]) =>
+              of(
+                ids.map((id) => ({
+                  id,
+                  name: `Tag${id}`,
+                  is_inbox_tag: true,
+                  color: '#ff0000',
+                  text_color: '#000000',
+                }))
+              ),
            listAll: () =>
              of({
                count: 3,
@@ -382,8 +393,32 @@ describe('DocumentDetailComponent', () => {
    currentUserCan = true
  })

-  it('should support creating document type', () => {
+  it('should support creating tag, remove from suggestions', () => {
    initNormally()
+    component.suggestions = {
+      suggested_tags: ['Tag1', 'NewTag12'],
+    }
+    let openModal: NgbModalRef
+    modalService.activeInstances.subscribe((modal) => (openModal = modal[0]))
+    const modalSpy = jest.spyOn(modalService, 'open')
+    component.createTag('NewTag12')
+    expect(modalSpy).toHaveBeenCalled()
+    openModal.componentInstance.succeeded.next({
+      id: 12,
+      name: 'NewTag12',
+      is_inbox_tag: true,
+      color: '#ff0000',
+      text_color: '#000000',
+    })
+    expect(component.tagsInput.value).toContain(12)
+    expect(component.suggestions.suggested_tags).not.toContain('NewTag12')
+  })
+
+  it('should support creating document type, remove from suggestions', () => {
+    initNormally()
+    component.suggestions = {
+      suggested_document_types: ['DocumentType1', 'NewDocType2'],
+    }
    let openModal: NgbModalRef
    modalService.activeInstances.subscribe((modal) => (openModal = modal[0]))
    const modalSpy = jest.spyOn(modalService, 'open')
@@ -391,10 +426,16 @@ describe('DocumentDetailComponent', () => {
    expect(modalSpy).toHaveBeenCalled()
    openModal.componentInstance.succeeded.next({ id: 12, name: 'NewDocType12' })
    expect(component.documentForm.get('document_type').value).toEqual(12)
+    expect(component.suggestions.suggested_document_types).not.toContain(
+      'NewDocType2'
+    )
  })

-  it('should support creating correspondent', () => {
+  it('should support creating correspondent, remove from suggestions', () => {
    initNormally()
+    component.suggestions = {
+      suggested_correspondents: ['Correspondent1', 'NewCorrrespondent12'],
+    }
    let openModal: NgbModalRef
    modalService.activeInstances.subscribe((modal) => (openModal = modal[0]))
    const modalSpy = jest.spyOn(modalService, 'open')
@@ -405,6 +446,9 @@ describe('DocumentDetailComponent', () => {
      name: 'NewCorrrespondent12',
    })
    expect(component.documentForm.get('correspondent').value).toEqual(12)
+    expect(component.suggestions.suggested_correspondents).not.toContain(
+      'NewCorrrespondent12'
+    )
  })

  it('should support creating storage path', () => {
@@ -995,7 +1039,7 @@ describe('DocumentDetailComponent', () => {
    expect(component.document.custom_fields).toHaveLength(initialLength - 1)
    expect(component.customFieldFormFields).toHaveLength(initialLength - 1)
    expect(
-      fixture.debugElement.query(By.css('form')).nativeElement.textContent
+      fixture.debugElement.query(By.css('form ul')).nativeElement.textContent
    ).not.toContain('Field 1')
    const patchSpy = jest.spyOn(documentService, 'patch')
    component.save(true)
@@ -1086,10 +1130,22 @@ describe('DocumentDetailComponent', () => {

  it('should get suggestions', () => {
    const suggestionsSpy = jest.spyOn(documentService, 'getSuggestions')
-    suggestionsSpy.mockReturnValue(of({ tags: [42, 43] }))
+    suggestionsSpy.mockReturnValue(
+      of({
+        tags: [42, 43],
+        suggested_tags: [],
+        suggested_document_types: [],
+        suggested_correspondents: [],
+      })
+    )
    initNormally()
    expect(suggestionsSpy).toHaveBeenCalled()
-    expect(component.suggestions).toEqual({ tags: [42, 43] })
+    expect(component.suggestions).toEqual({
+      tags: [42, 43],
+      suggested_tags: [],
+      suggested_document_types: [],
+      suggested_correspondents: [],
+    })
  })

  it('should show error if needed for get suggestions', () => {
@@ -1209,6 +1265,88 @@ describe('DocumentDetailComponent', () => {
    expect(closeSpy).toHaveBeenCalled()
  })

+  it('should support removing password protection from pdfs', () => {
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((m) => (modal = m[0]))
+    initNormally()
+    component.password = 'secret'
+    component.removePassword()
+    const dialog =
+      modal.componentInstance as PasswordRemovalConfirmDialogComponent
+    dialog.updateDocument = false
+    dialog.includeMetadata = false
+    dialog.deleteOriginal = true
+    dialog.confirm()
+    const req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}documents/bulk_edit/`
+    )
+    expect(req.request.body).toEqual({
+      documents: [doc.id],
+      method: 'remove_password',
+      parameters: {
+        password: 'secret',
+        update_document: false,
+        include_metadata: false,
+        delete_original: true,
+      },
+    })
+    req.flush(true)
+  })
+
+  it('should require the current password before removing it', () => {
+    initNormally()
+    const errorSpy = jest.spyOn(toastService, 'showError')
+    component.requiresPassword = true
+    component.password = ''
+
+    component.removePassword()
+
+    expect(errorSpy).toHaveBeenCalled()
+    httpTestingController.expectNone(
+      `${environment.apiBaseUrl}documents/bulk_edit/`
+    )
+  })
+
+  it('should handle failures when removing password protection', () => {
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((m) => (modal = m[0]))
+    initNormally()
+    const errorSpy = jest.spyOn(toastService, 'showError')
+    component.password = 'secret'
+
+    component.removePassword()
+    const dialog =
+      modal.componentInstance as PasswordRemovalConfirmDialogComponent
+    dialog.confirm()
+    const req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}documents/bulk_edit/`
+    )
+    req.error(new ErrorEvent('failed'))
+
+    expect(errorSpy).toHaveBeenCalled()
+    expect(component.networkActive).toBe(false)
+    expect(dialog.buttonsEnabled).toBe(true)
+  })
+
+  it('should refresh the document when removing password in update mode', () => {
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((m) => (modal = m[0]))
+    const refreshSpy = jest.spyOn(openDocumentsService, 'refreshDocument')
+    initNormally()
+    component.password = 'secret'
+
+    component.removePassword()
+    const dialog =
+      modal.componentInstance as PasswordRemovalConfirmDialogComponent
+    dialog.confirm()
+    const req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}documents/bulk_edit/`
+    )
+    req.flush(true)
+
+    expect(refreshSpy).toHaveBeenCalledWith(doc.id)
+  })
+
  it('should support keyboard shortcuts', () => {
    initNormally()

--- a/src-ui/src/app/components/document-detail/document-detail.component.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.ts
@@ -31,6 +31,7 @@ import {
  map,
  switchMap,
  takeUntil,
+  tap,
 } from 'rxjs/operators'
 import { Correspondent } from 'src/app/data/correspondent'
 import { CustomField, CustomFieldDataType } from 'src/app/data/custom-field'
@@ -76,6 +77,7 @@ import { DocumentTypeService } from 'src/app/services/rest/document-type.service
 import { DocumentService } from 'src/app/services/rest/document.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
+import { TagService } from 'src/app/services/rest/tag.service'
 import { UserService } from 'src/app/services/rest/user.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
@@ -83,11 +85,13 @@ import { getFilenameFromContentDisposition } from 'src/app/utils/http'
 import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
 import * as UTIF from 'utif'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
+import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import { CorrespondentEditDialogComponent } from '../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
 import { DocumentTypeEditDialogComponent } from '../common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component'
 import { EditDialogMode } from '../common/edit-dialog/edit-dialog.component'
 import { StoragePathEditDialogComponent } from '../common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component'
+import { TagEditDialogComponent } from '../common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component'
 import { EmailDocumentDialogComponent } from '../common/email-document-dialog/email-document-dialog.component'
 import { CheckComponent } from '../common/input/check/check.component'
 import { DateComponent } from '../common/input/date/date.component'
@@ -106,6 +110,7 @@ import {
  PdfEditorEditMode,
 } from '../common/pdf-editor/pdf-editor.component'
 import { ShareLinksDialogComponent } from '../common/share-links-dialog/share-links-dialog.component'
+import { SuggestionsDropdownComponent } from '../common/suggestions-dropdown/suggestions-dropdown.component'
 import { DocumentHistoryComponent } from '../document-history/document-history.component'
 import { DocumentNotesComponent } from '../document-notes/document-notes.component'
 import { ComponentWithPermissions } from '../with-permissions/with-permissions.component'
@@ -162,6 +167,7 @@ export enum ZoomSetting {
    NumberComponent,
    MonetaryComponent,
    UrlComponent,
+    SuggestionsDropdownComponent,
    CustomDatePipe,
    FileSizePipe,
    IfPermissionsDirective,
@@ -183,6 +189,7 @@ export class DocumentDetailComponent
 {
  private documentsService = inject(DocumentService)
  private route = inject(ActivatedRoute)
+  private tagService = inject(TagService)
  private correspondentService = inject(CorrespondentService)
  private documentTypeService = inject(DocumentTypeService)
  private router = inject(Router)
@@ -205,6 +212,8 @@ export class DocumentDetailComponent
  @ViewChild('inputTitle')
  titleInput: TextComponent

+  @ViewChild('tagsInput') tagsInput: TagsComponent
+
  expandOriginalMetadata = false
  expandArchivedMetadata = false

@@ -216,6 +225,7 @@ export class DocumentDetailComponent
  document: Document
  metadata: DocumentMetadata
  suggestions: DocumentSuggestions
+  suggestionsLoading: boolean = false
  users: User[]

  title: string
@@ -275,10 +285,10 @@ export class DocumentDetailComponent
    if (
      element &&
      element.nativeElement.offsetParent !== null &&
-      this.nav?.activeId == 4
+      this.nav?.activeId == DocumentDetailNavIDs.Preview
    ) {
      // its visible
-      setTimeout(() => this.nav?.select(1))
+      setTimeout(() => this.nav?.select(DocumentDetailNavIDs.Details))
    }
  }

@@ -297,6 +307,10 @@ export class DocumentDetailComponent
    return this.deviceDetectorService.isMobile()
  }

+  get aiEnabled(): boolean {
+    return this.settings.get(SETTINGS_KEYS.AI_ENABLED)
+  }
+
  get archiveContentRenderType(): ContentRenderType {
    return this.document?.archived_file_name
      ? this.getRenderType('application/pdf')
@@ -681,25 +695,12 @@ export class DocumentDetailComponent
        PermissionType.Document
      )
    ) {
-      this.documentsService
-        .getSuggestions(doc.id)
-        .pipe(
-          first(),
-          takeUntil(this.unsubscribeNotifier),
-          takeUntil(this.docChangeNotifier)
-        )
-        .subscribe({
-          next: (result) => {
-            this.suggestions = result
-          },
-          error: (error) => {
-            this.suggestions = null
-            this.toastService.showError(
-              $localize`Error retrieving suggestions.`,
-              error
-            )
-          },
-        })
+      this.tagService.getCachedMany(doc.tags).subscribe((tags) => {
+        // only show suggestions if document has inbox tags
+        if (tags.some((tag) => tag.is_inbox_tag)) {
+          this.getSuggestions()
+        }
+      })
    }
    this.title = this.documentTitlePipe.transform(doc.title)
    this.prepareForm(doc)
@@ -709,6 +710,63 @@ export class DocumentDetailComponent
    return this.documentForm.get('custom_fields') as FormArray
  }

+  getSuggestions() {
+    this.suggestionsLoading = true
+    this.documentsService
+      .getSuggestions(this.documentId)
+      .pipe(
+        first(),
+        takeUntil(this.unsubscribeNotifier),
+        takeUntil(this.docChangeNotifier)
+      )
+      .subscribe({
+        next: (result) => {
+          this.suggestions = result
+          this.suggestionsLoading = false
+        },
+        error: (error) => {
+          this.suggestions = null
+          this.suggestionsLoading = false
+          this.toastService.showError(
+            $localize`Error retrieving suggestions.`,
+            error
+          )
+        },
+      })
+  }
+
+  createTag(newName: string) {
+    var modal = this.modalService.open(TagEditDialogComponent, {
+      backdrop: 'static',
+    })
+    modal.componentInstance.dialogMode = EditDialogMode.CREATE
+    if (newName) modal.componentInstance.object = { name: newName }
+    modal.componentInstance.succeeded
+      .pipe(
+        tap((newTag: Tag) => {
+          // remove from suggestions if present
+          if (this.suggestions) {
+            this.suggestions = {
+              ...this.suggestions,
+              suggested_tags: this.suggestions.suggested_tags.filter(
+                (tag) => tag !== newTag.name
+              ),
+            }
+          }
+        }),
+        switchMap((newTag: Tag) => {
+          return this.tagService
+            .listAll()
+            .pipe(map((tags) => ({ newTag, tags })))
+        }),
+        takeUntil(this.unsubscribeNotifier)
+      )
+      .subscribe(({ newTag, tags }) => {
+        this.tagsInput.tags = tags.results
+        this.tagsInput.addTag(newTag.id)
+      })
+  }
+
  createDocumentType(newName: string) {
    var modal = this.modalService.open(DocumentTypeEditDialogComponent, {
      backdrop: 'static',
@@ -728,6 +786,12 @@ export class DocumentDetailComponent
        this.documentTypes = documentTypes.results
        this.documentForm.get('document_type').setValue(newDocumentType.id)
        this.documentForm.get('document_type').markAsDirty()
+        if (this.suggestions) {
+          this.suggestions.suggested_document_types =
+            this.suggestions.suggested_document_types.filter(
+              (dt) => dt !== newName
+            )
+        }
      })
  }

@@ -752,6 +816,12 @@ export class DocumentDetailComponent
        this.correspondents = correspondents.results
        this.documentForm.get('correspondent').setValue(newCorrespondent.id)
        this.documentForm.get('correspondent').markAsDirty()
+        if (this.suggestions) {
+          this.suggestions.suggested_correspondents =
+            this.suggestions.suggested_correspondents.filter(
+              (c) => c !== newName
+            )
+        }
      })
  }

@@ -1428,6 +1498,63 @@ export class DocumentDetailComponent
      })
  }

+  removePassword() {
+    if (this.requiresPassword || !this.password) {
+      this.toastService.showError(
+        $localize`Please enter the current password before attempting to remove it.`
+      )
+      return
+    }
+    const modal = this.modalService.open(
+      PasswordRemovalConfirmDialogComponent,
+      {
+        backdrop: 'static',
+      }
+    )
+    modal.componentInstance.title = $localize`Remove password protection`
+    modal.componentInstance.message = $localize`Create an unprotected copy or replace the existing file.`
+    modal.componentInstance.btnCaption = $localize`Start`
+
+    modal.componentInstance.confirmClicked
+      .pipe(takeUntil(this.unsubscribeNotifier))
+      .subscribe(() => {
+        const dialog =
+          modal.componentInstance as PasswordRemovalConfirmDialogComponent
+        dialog.buttonsEnabled = false
+        this.networkActive = true
+        this.documentsService
+          .bulkEdit([this.document.id], 'remove_password', {
+            password: this.password,
+            update_document: dialog.updateDocument,
+            include_metadata: dialog.includeMetadata,
+            delete_original: dialog.deleteOriginal,
+          })
+          .pipe(first(), takeUntil(this.unsubscribeNotifier))
+          .subscribe({
+            next: () => {
+              this.toastService.showInfo(
+                $localize`Password removal operation for "${this.document.title}" will begin in the background.`
+              )
+              this.networkActive = false
+              modal.close()
+              if (!dialog.updateDocument && dialog.deleteOriginal) {
+                this.openDocumentService.closeDocument(this.document)
+              } else if (dialog.updateDocument) {
+                this.openDocumentService.refreshDocument(this.documentId)
+              }
+            },
+            error: (error) => {
+              dialog.buttonsEnabled = true
+              this.networkActive = false
+              this.toastService.showError(
+                $localize`Error executing password removal operation`,
+                error
+              )
+            },
+          })
+      })
+  }
+
  printDocument() {
    const printUrl = this.documentsService.getDownloadUrl(
      this.document.id,
--- a/src-ui/src/app/components/file-drop/file-drop.component.ts
+++ b/src-ui/src/app/components/file-drop/file-drop.component.ts
@@ -150,12 +150,11 @@ export class FileDropComponent {
    this.onDragLeave(event, true)
  }

-  @HostListener('window:blur', ['$event']) public onWindowBlur() {
+  @HostListener('window:blur') public onWindowBlur() {
    if (this.fileIsOver) this.onDragLeave(null)
  }

-  @HostListener('document:visibilitychange', ['$event'])
-  public onVisibilityChange() {
+  @HostListener('document:visibilitychange') public onVisibilityChange() {
    if (document.hidden && this.fileIsOver) this.onDragLeave(null)
  }
 }
--- a/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts
+++ b/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts
@@ -1,6 +1,7 @@
 import { NgClass, NgTemplateOutlet, TitleCasePipe } from '@angular/common'
 import { Component, inject } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
+import { RouterModule } from '@angular/router'
 import {
  NgbDropdownModule,
  NgbPaginationModule,
@@ -29,6 +30,7 @@ import { ManagementListComponent } from '../management-list/management-list.comp
    TitleCasePipe,
    FormsModule,
    ReactiveFormsModule,
+    RouterModule,
    NgClass,
    NgTemplateOutlet,
    NgbDropdownModule,
--- a/src-ui/src/app/components/manage/custom-fields/custom-fields.component.html
+++ b/src-ui/src/app/components/manage/custom-fields/custom-fields.component.html
@@ -42,7 +42,13 @@
                <button (click)="editField(field)" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.CustomField }" ngbDropdownItem i18n>Edit</button>
                <button class="text-danger" (click)="deleteField(field)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.CustomField }" ngbDropdownItem i18n>Delete</button>
                @if (field.document_count > 0) {
-                  <button (click)="filterDocuments(field)" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }" ngbDropdownItem i18n>Filter Documents ({{ field.document_count }})</button>
+                  <a
+                    *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }"
+                    ngbDropdownItem
+                    [routerLink]="getDocumentFilterUrl(field)"
+                    i18n
+                    >Filter Documents ({{ field.document_count }})</a
+                  >
                }
              </div>
            </div>
@@ -57,9 +63,13 @@
          </div>
          @if (field.document_count > 0) {
            <div class="btn-group d-none d-sm-inline-block ms-2">
-              <button class="btn btn-sm btn-outline-secondary" type="button" (click)="filterDocuments(field)">
-                <i-bs width="1em" height="1em" name="filter"></i-bs>&nbsp;<ng-container i18n>Documents</ng-container><span class="badge bg-light text-secondary ms-2">{{ field.document_count }}</span>
-              </button>
+              <a
+                class="btn btn-sm btn-outline-secondary"
+                [routerLink]="getDocumentFilterUrl(field)"
+              >
+                <i-bs width="1em" height="1em" name="filter"></i-bs>&nbsp;<ng-container i18n>Documents</ng-container
+                ><span class="badge bg-light text-secondary ms-2">{{ field.document_count }}</span>
+              </a>
            </div>
          }
        </div>
--- a/src-ui/src/app/components/manage/custom-fields/custom-fields.component.spec.ts
+++ b/src-ui/src/app/components/manage/custom-fields/custom-fields.component.spec.ts
@@ -4,6 +4,7 @@ import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
 import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { By } from '@angular/platform-browser'
+import { RouterTestingModule } from '@angular/router/testing'
 import {
  NgbModal,
  NgbModalModule,
@@ -61,6 +62,7 @@ describe('CustomFieldsComponent', () => {
        NgbModalModule,
        NgbPopoverModule,
        NgxBootstrapIconsModule.pick(allIcons),
+        RouterTestingModule,
        CustomFieldsComponent,
        IfPermissionsDirective,
        PageHeaderComponent,
@@ -108,7 +110,9 @@ describe('CustomFieldsComponent', () => {
    const toastInfoSpy = jest.spyOn(toastService, 'showInfo')
    const reloadSpy = jest.spyOn(component, 'reload')

-    const createButton = fixture.debugElement.queryAll(By.css('button'))[1]
+    const createButton = fixture.debugElement
+      .queryAll(By.css('button'))
+      .find((btn) => btn.nativeElement.textContent.trim().includes('Add Field'))
    createButton.triggerEventHandler('click')

    expect(modal).not.toBeUndefined()
@@ -133,7 +137,11 @@ describe('CustomFieldsComponent', () => {
    const toastInfoSpy = jest.spyOn(toastService, 'showInfo')
    const reloadSpy = jest.spyOn(component, 'reload')

-    const editButton = fixture.debugElement.queryAll(By.css('button'))[2]
+    const editButton = fixture.debugElement
+      .queryAll(By.css('button'))
+      .find((btn) =>
+        btn.nativeElement.textContent.trim().includes(fields[0].name)
+      )
    editButton.triggerEventHandler('click')

    expect(modal).not.toBeUndefined()
@@ -158,7 +166,9 @@ describe('CustomFieldsComponent', () => {
    const deleteSpy = jest.spyOn(customFieldsService, 'delete')
    const reloadSpy = jest.spyOn(component, 'reload')

-    const deleteButton = fixture.debugElement.queryAll(By.css('button'))[5]
+    const deleteButton = fixture.debugElement
+      .queryAll(By.css('button'))
+      .find((btn) => btn.nativeElement.textContent.trim().includes('Delete'))
    deleteButton.triggerEventHandler('click')

    expect(modal).not.toBeUndefined()
@@ -176,10 +186,10 @@ describe('CustomFieldsComponent', () => {
    expect(reloadSpy).toHaveBeenCalled()
  })

-  it('should support filter documents', () => {
-    const filterSpy = jest.spyOn(listViewService, 'quickFilter')
-    component.filterDocuments(fields[0])
-    expect(filterSpy).toHaveBeenCalledWith([
+  it('should provide document filter url', () => {
+    const urlSpy = jest.spyOn(listViewService, 'getQuickFilterUrl')
+    component.getDocumentFilterUrl(fields[0])
+    expect(urlSpy).toHaveBeenCalledWith([
      {
        rule_type: FILTER_CUSTOM_FIELDS_QUERY,
        value: JSON.stringify([
--- a/src-ui/src/app/components/manage/custom-fields/custom-fields.component.ts
+++ b/src-ui/src/app/components/manage/custom-fields/custom-fields.component.ts
@@ -1,4 +1,5 @@
 import { Component, OnInit, inject } from '@angular/core'
+import { RouterModule } from '@angular/router'
 import {
  NgbDropdownModule,
  NgbModal,
@@ -36,6 +37,7 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    NgbDropdownModule,
    NgbPaginationModule,
    NgxBootstrapIconsModule,
+    RouterModule,
  ],
 })
 export class CustomFieldsComponent
@@ -130,8 +132,8 @@ export class CustomFieldsComponent
    return DATA_TYPE_LABELS.find((l) => l.id === field.data_type).name
  }

-  filterDocuments(field: CustomField) {
-    this.documentListViewService.quickFilter([
+  getDocumentFilterUrl(field: CustomField) {
+    return this.documentListViewService.getQuickFilterUrl([
      {
        rule_type: FILTER_CUSTOM_FIELDS_QUERY,
        value: JSON.stringify([
--- a/src-ui/src/app/components/manage/document-type-list/document-type-list.component.ts
+++ b/src-ui/src/app/components/manage/document-type-list/document-type-list.component.ts
@@ -1,6 +1,7 @@
 import { NgClass, NgTemplateOutlet, TitleCasePipe } from '@angular/common'
 import { Component, inject } from '@angular/core'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
+import { RouterModule } from '@angular/router'
 import {
  NgbDropdownModule,
  NgbPaginationModule,
@@ -27,6 +28,7 @@ import { ManagementListComponent } from '../management-list/management-list.comp
    IfPermissionsDirective,
    FormsModule,
    ReactiveFormsModule,
+    RouterModule,
    NgClass,
    NgTemplateOutlet,
    NgbDropdownModule,
--- a/src-ui/src/app/components/manage/management-list/management-list.component.html
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.html
@@ -62,9 +62,9 @@

@if (!loading) {
  <div class="d-flex mb-2">
-    @if (displayCollectionSize > 0) {
+    @if (collectionSize > 0) {
      <div>
-        <ng-container i18n>{displayCollectionSize, plural, =1 {One {{typeName}}} other {{{displayCollectionSize || 0}} total {{typeNamePlural}}}}</ng-container>
+        <ng-container i18n>{collectionSize, plural, =1 {One {{typeName}}} other {{{collectionSize || 0}} total {{typeNamePlural}}}}</ng-container>
        @if (selectedObjects.size > 0) {
          &nbsp;({{selectedObjects.size}} selected)
        }
@@ -120,7 +120,14 @@
              <button (click)="openEditDialog(object)" *pngxIfPermissions="{ action: PermissionAction.Change, type: permissionType }" ngbDropdownItem i18n>Edit</button>
              <button class="text-danger" (click)="openDeleteDialog(object)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: permissionType }" ngbDropdownItem i18n>Delete</button>
              @if (getDocumentCount(object) > 0) {
-                <button (click)="filterDocuments(object)" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }" ngbDropdownItem i18n>Filter Documents ({{ getDocumentCount(object) }})</button>
+                  <a
+                    *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }"
+                    ngbDropdownItem
+                    [routerLink]="getDocumentFilterUrl(object)"
+                    (click)="$event?.stopPropagation()"
+                    i18n
+                    >Filter Documents ({{ getDocumentCount(object) }})</a
+                  >
              }
            </div>
          </div>
@@ -135,9 +142,15 @@
        </div>
        @if (getDocumentCount(object) > 0) {
          <div class="btn-group d-none d-sm-inline-block">
-            <button class="btn btn-sm btn-outline-secondary" (click)="filterDocuments(object); $event.stopPropagation();" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }">
-              <i-bs width="1em" height="1em" name="filter"></i-bs>&nbsp;<ng-container i18n>Documents</ng-container><span class="badge bg-light text-secondary ms-2">{{ getDocumentCount(object) }}</span>
-            </button>
+            <a
+              class="btn btn-sm btn-outline-secondary"
+              *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }"
+              [routerLink]="getDocumentFilterUrl(object)"
+              (click)="$event?.stopPropagation()"
+            >
+              <i-bs width="1em" height="1em" name="filter"></i-bs>&nbsp;<ng-container i18n>Documents</ng-container
+              ><span class="badge bg-light text-secondary ms-2">{{ getDocumentCount(object) }}</span>
+            </a>
          </div>
        }
      </div>
--- a/src-ui/src/app/components/manage/management-list/management-list.component.spec.ts
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.spec.ts
@@ -13,6 +13,7 @@ import {
 } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { By } from '@angular/platform-browser'
+import { RouterLinkWithHref } from '@angular/router'
 import { RouterTestingModule } from '@angular/router/testing'
 import {
  NgbModal,
@@ -229,29 +230,16 @@ describe('ManagementListComponent', () => {
    expect(reloadSpy).toHaveBeenCalled()
  })

-  it('should use API count for pagination and all ids for displayed total', fakeAsync(() => {
-    jest.spyOn(tagService, 'listFiltered').mockReturnValueOnce(
-      of({
-        count: 1,
-        all: [1, 2, 3],
-        results: tags.slice(0, 1),
-      })
-    )
-
-    component.reloadData()
-    tick(100)
-
-    expect(component.collectionSize).toBe(1)
-    expect(component.displayCollectionSize).toBe(3)
-  }))
-
  it('should support quick filter for objects', () => {
-    const qfSpy = jest.spyOn(documentListViewService, 'quickFilter')
-    const filterButton = fixture.debugElement.queryAll(By.css('button'))[9]
-    filterButton.triggerEventHandler('click')
-    expect(qfSpy).toHaveBeenCalledWith([
+    const expectedUrl = documentListViewService.getQuickFilterUrl([
      { rule_type: FILTER_HAS_TAGS_ALL, value: tags[0].id.toString() },
-    ]) // subclasses set the filter rule type
+    ])
+    const filterLink = fixture.debugElement.query(
+      By.css('a.btn-outline-secondary')
+    )
+    expect(filterLink).toBeTruthy()
+    const routerLink = filterLink.injector.get(RouterLinkWithHref)
+    expect(routerLink.urlTree).toEqual(expectedUrl)
  })

  it('should reload on sort', () => {
--- a/src-ui/src/app/components/manage/management-list/management-list.component.ts
+++ b/src-ui/src/app/components/manage/management-list/management-list.component.ts
@@ -23,7 +23,6 @@ import {
  MatchingModel,
 } from 'src/app/data/matching-model'
 import { ObjectWithPermissions } from 'src/app/data/object-with-permissions'
-import { Results } from 'src/app/data/results'
 import {
  SortableDirective,
  SortEvent,
@@ -89,7 +88,6 @@ export abstract class ManagementListComponent<T extends MatchingModel>
  public page = 1

  public collectionSize = 0
-  public displayCollectionSize = 0

  public sortField: string
  public sortReverse: boolean
@@ -143,14 +141,6 @@ export abstract class ManagementListComponent<T extends MatchingModel>
    return data
  }

-  protected getCollectionSize(results: Results<T>): number {
-    return results.all?.length ?? results.count
-  }
-
-  protected getDisplayCollectionSize(results: Results<T>): number {
-    return this.getCollectionSize(results)
-  }
-
  getDocumentCount(object: MatchingModel): number {
    return (
      object.document_count ??
@@ -181,8 +171,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
        tap((c) => {
          this.unfilteredData = c.results
          this.data = this.filterData(c.results)
-          this.collectionSize = this.getCollectionSize(c)
-          this.displayCollectionSize = this.getDisplayCollectionSize(c)
+          this.collectionSize = c.count
        }),
        delay(100)
      )
@@ -241,8 +230,8 @@ export abstract class ManagementListComponent<T extends MatchingModel>

  abstract getDeleteMessage(object: T)

-  filterDocuments(object: MatchingModel) {
-    this.documentListViewService.quickFilter([
+  getDocumentFilterUrl(object: MatchingModel) {
+    return this.documentListViewService.getQuickFilterUrl([
      { rule_type: this.filterRuleType, value: object.id.toString() },
    ])
  }
@@ -375,7 +364,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
      backdrop: 'static',
    })
    modal.componentInstance.title = $localize`Confirm delete`
-    modal.componentInstance.messageBold = $localize`This operation will permanently delete the selected ${this.typeNamePlural}.`
+    modal.componentInstance.messageBold = $localize`This operation will permanently delete all objects.`
    modal.componentInstance.message = $localize`This operation cannot be undone.`
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
--- a/Show More
+++ b/Show More