diff --git a/.github/workflows/vetkeys-encrypted-notes-app-vetkd.yml b/.github/workflows/vetkeys-encrypted-notes-app-vetkd.yml
new file mode 100644
index 000000000..8751b25d9
--- /dev/null
+++ b/.github/workflows/vetkeys-encrypted-notes-app-vetkd.yml
@@ -0,0 +1,36 @@
+name: vetkeys-encrypted-notes-app-vetkd
+
+on:
+ push:
+ branches:
+ - master
+ pull_request:
+ paths:
+ - rust/vetkeys/encrypted_notes_app_vetkd/**
+ - .github/workflows/vetkeys-encrypted-notes-app-vetkd.yml
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ rust:
+ runs-on: ubuntu-24.04
+ container: ghcr.io/dfinity/icp-dev-env-rust:0.1.0
+ env:
+ ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ - name: Deploy Encrypted Notes App Vetkd Rust
+ working-directory: rust/vetkeys/encrypted_notes_app_vetkd/rust
+ run: icp network start -d && icp deploy
+ motoko:
+ runs-on: ubuntu-24.04
+ container: ghcr.io/dfinity/icp-dev-env-motoko:0.1.0
+ env:
+ ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ - name: Deploy Encrypted Notes App Vetkd Motoko
+ working-directory: rust/vetkeys/encrypted_notes_app_vetkd/motoko
+ run: icp network start -d && icp deploy
diff --git a/rust/vetkeys/encrypted_notes_dapp_vetkd/README.md b/rust/vetkeys/encrypted_notes_app_vetkd/README.md
similarity index 50%
rename from rust/vetkeys/encrypted_notes_dapp_vetkd/README.md
rename to rust/vetkeys/encrypted_notes_app_vetkd/README.md
index 01d63e3ea..0effa17d9 100644
--- a/rust/vetkeys/encrypted_notes_dapp_vetkd/README.md
+++ b/rust/vetkeys/encrypted_notes_app_vetkd/README.md
@@ -1,58 +1,82 @@
# Encrypted notes: vetKD
+
-Encrypted notes is an example dapp for authoring and storing confidential information on the Internet Computer (ICP) in the form of short pieces of text. Users can create and access their notes via any number of automatically synchronized devices authenticated via Internet Identity (II). Notes are stored confidentially using vetKeys. The end-to-end encryption is performed by the dapp’s frontend.
+Encrypted notes is an example dapp for authoring and storing confidential information on the Internet Computer (ICP) in the form of short pieces of text. Users can create and access their notes via any number of automatically synchronized devices authenticated via Internet Identity (II). Notes are stored confidentially using vetKeys. The end-to-end encryption is performed by the dapp's frontend.
In particular, the notes are encrypted with an AES key that is derived (directly in the browser) from a note-ID-specific vetKey obtained from the backend canister (in encrypted form, using an ephemeral transport key), which itself obtains it from the vetKD system API. This way, there is no need for any device management in the dapp, plus sharing of notes becomes possible.
-The vetKey used to encrypt and decrypt a note is note-ID-specific (and not, for example, principal-specific) to enable the sharing of notes between users. The derived AES keys are stored as non-extractable CryptoKeys in an IndexedDB in the browser for efficiency so that their respective vetKey only has to be fetched from the server once. To improve the security even further, the vetKeys' derivation information could be adapted to include a (numeric) epoch that advances each time the list of users with which the note is shared is changed.
+The vetKey used to encrypt and decrypt a note is note-ID-specific (and not, for example, principal-specific) to enable the sharing of notes between users. The derived AES keys are stored as non-extractable CryptoKeys in an IndexedDB in the browser for efficiency so that their respective vetKey only has to be fetched from the server once.
## Prerequisites
-This example requires an installation of:
-
-- [x] Install the [IC SDK](https://internetcomputer.org/docs/current/developer-docs/setup/install/index.mdx).
+- [x] Install the [ICP CLI](https://cli.internetcomputer.org).
- [x] Install [npm](https://www.npmjs.com/package/npm).
-### (Optionally) Choose a Different Master Key
+## Folder Structure
-This example uses `test_key_1` by default. To use a different [available master key](https://internetcomputer.org/docs/building-apps/network-features/vetkeys/api#available-master-keys), change the `"init_arg": "(\"test_key_1\")"` line in `dfx.json` to the desired key before running `dfx deploy` in the next step.
+This example provides both a **Rust** and a **Motoko** backend, sharing a common `frontend/`:
+
+```
+encrypted_notes_app_vetkd/
+├── frontend/ ← shared frontend (symlinked into rust/ and motoko/)
+├── motoko/ ← Motoko backend + icp.yaml
+└── rust/ ← Rust backend + icp.yaml
+```
## Deploy the Canisters Locally
-If you want to deploy this project locally with a Motoko backend, then run:
+Deploy with the **Motoko** backend:
+```bash
+cd motoko
+icp network start -d && icp deploy
+```
+
+Or deploy with the **Rust** backend:
```bash
-dfx start --background && dfx deploy
+cd rust
+icp network start -d && icp deploy
```
-from the `motoko` folder.
-To use the Rust backend instead of Motoko, run the same command in the rust folder.
+## Running the Frontend in Development Mode
+
+After deploying, run from the `frontend` folder:
+```bash
+cd frontend
+npm run dev:motoko # if you deployed the Motoko backend
+# or
+npm run dev:rust # if you deployed the Rust backend
+```
## Example Components
### Backend
-The backend consists of a canister that stores encrypted notes. It is automatically deployed with `dfx deploy`.
+The backend consists of a canister that stores encrypted notes. It is automatically deployed with `icp deploy`.
### Frontend
The frontend is a **Svelte** application providing a user-friendly interface for managing encrypted notes.
-To run the frontend in development mode with hot reloading (after running `dfx deploy`):
-
-```bash
-npm run dev
-```
-
## Limitations
This example dapp does not implement key rotation, which is strongly recommended in a production environment.
-Key rotation involves periodically changing encryption keys and re-encrypting data to enhance security.
-In a production dapp, key rotation would be useful to limit the impact of potential key compromise if a malicious party gains access to a key, or to limit access when users are added or removed from note sharing.
## Troubleshooting
-If you run into issues, clearing all the application-specific IndexedDBs in the browser (which are used to store Internet Identity information and the derived non-extractable AES keys) might help fix the issue. For example in Chrome, go to Inspect → Application → Local Storage → `http://localhost:3000/` → Clear All, and then reload.
+If you run into issues, clearing all the application-specific IndexedDBs in the browser might help. For example in Chrome, go to Inspect → Application → Local Storage → Clear All, and then reload.
+
+## API Level
+
+This example intentionally uses the **raw VetKD management canister API** (`encrypted_symmetric_key_for_note`, `symmetric_key_verification_key_for_note`) to demonstrate how VetKD works at the protocol level.
+
+For most applications, the higher-level [`EncryptedMaps`](https://github.com/dfinity/vetkeys/tree/main/frontend/ic_vetkeys/src/encrypted_maps) abstraction from `@icp-sdk/vetkeys` is the recommended approach — it handles key derivation, caching, and access control internally without requiring a custom crypto layer. See the [**VetKD Password Manager**](../password_manager/) and [**VetKD Password Manager with Metadata**](../password_manager_with_metadata/) examples for how `EncryptedMaps` is used in practice.
+
+## Additional Resources
+
+- **[What are VetKeys](https://docs.internetcomputer.org/concepts/vetkeys)** - For more information about VetKeys and VetKD.
diff --git a/rust/vetkeys/encrypted_notes_app_vetkd/frontend/.npmrc b/rust/vetkeys/encrypted_notes_app_vetkd/frontend/.npmrc
new file mode 100644
index 000000000..521a9f7c0
--- /dev/null
+++ b/rust/vetkeys/encrypted_notes_app_vetkd/frontend/.npmrc
@@ -0,0 +1 @@
+legacy-peer-deps=true
diff --git a/rust/vetkeys/encrypted_notes_dapp_vetkd/frontend/public/index.html b/rust/vetkeys/encrypted_notes_app_vetkd/frontend/index.html
similarity index 67%
rename from rust/vetkeys/encrypted_notes_dapp_vetkd/frontend/public/index.html
rename to rust/vetkeys/encrypted_notes_app_vetkd/frontend/index.html
index abc12ca3b..a494e91ea 100644
--- a/rust/vetkeys/encrypted_notes_dapp_vetkd/frontend/public/index.html
+++ b/rust/vetkeys/encrypted_notes_app_vetkd/frontend/index.html
@@ -3,14 +3,10 @@
-
Encrypted Notes
-
-
-
-
-
-
+
+
+