diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..820af48
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,76 @@
+name: CI
+
+on:
+  push:
+    branches: [stage]
+  pull_request:
+    branches: [stage]
+
+env:
+  API_ENDPOINT_SERVER: "http://localhost:1443"
+  API_ENDPOINT_TRUSTAUTH_TO_SERVER: "https://localhost:1444"
+  API_ENDPOINT_TRUSTAUTH: "http://localhost:2443"
+  API_ENDPOINT_SERVER_TO_TRUSTAUTH: "https://localhost:2444"
+
+jobs:
+  frontend:
+    name: Frontend tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Generate mTLS certificates
+        working-directory: mtls
+        run: bash mkcerts.sh dev
+
+      - name: Build backend binaries
+        run: cargo build --bin rustsystem-server --bin rustsystem-trustauth
+
+      - name: Start backend services
+        run: |
+          ./target/debug/rustsystem-server &
+          ./target/debug/rustsystem-trustauth &
+
+      - name: Wait for services to be ready
+        run: |
+          until nc -z localhost 1443 2>/dev/null; do sleep 1; done
+          until nc -z localhost 2443 2>/dev/null; do sleep 1; done
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Run tests
+        working-directory: frontend
+        run: pnpm test
+
+  backend:
+    name: Backend tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Generate mTLS certificates
+        working-directory: mtls
+        run: bash mkcerts.sh dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Run tests
+        run: cargo test
diff --git a/CONTRIBUTE.md b/CONTRIBUTE.md
new file mode 100644
index 0000000..5c77e41
--- /dev/null
+++ b/CONTRIBUTE.md
@@ -0,0 +1,204 @@
+# Contributing Guide
+
+This document explains how to contribute to Rustsystem: the branch structure, development workflow, and how releases are versioned and documented.
+
+---
+
+## Branch Structure
+
+Development flows through two long-lived branches (`stage` and `main`) and short-lived feature branches:
+
+```mermaid
+gitGraph
+   commit id: "main (stable)"
+   branch stage
+   checkout stage
+   commit id: "stage (testing)"
+   branch add-deletion-endpoint
+   checkout add-deletion-endpoint
+   commit id: "feature work"
+   commit id: "more work"
+   checkout stage
+   merge add-deletion-endpoint id: "PR: feature → stage"
+   commit id: "2.1.0-beta tag"
+   commit id: "bug fix"
+   commit id: "2.1.1-beta tag"
+   checkout main
+   merge stage id: "PR: stage → main (2.1.1 full release)"
+```
+
+| Branch         | Purpose                                                                                          |
+| -------------- | ------------------------------------------------------------------------------------------------ |
+| `main`         | Stable, production-ready code. Only updated when a beta is promoted to a full release.           |
+| `stage`        | Integration and testing branch. Receives feature PRs; beta tags are created here.                |
+| `<issue-name>` | Short-lived branch named after the issue being worked on. Branched from and merged into `stage`. |
+
+### Workflow
+
+1. **Create a branch off `stage`** named after the issue or feature (e.g. `add-deletion-endpoint`, `fix-sse-reconnect`).
+2. **Develop and commit** on your feature branch.
+3. **Open a PR from `<issue-name>` → `stage`** when the work is ready for testing.
+4. **Test on `stage`**. Beta tags (`x.y.z-beta`) are created here. Fix bugs on `stage` directly or via follow-up PRs.
+5. **Open a PR from `stage` → `main`** once a beta passes testing. `main` only ever receives full releases — beta tags remain on `stage`.
+
+```mermaid
+flowchart LR
+    A["&lt;issue-name&gt;\n(feature branch)"] -->|PR| B["stage\n(testing, beta tags)"]
+    B -->|bugs found| B
+    B -->|beta passes PR| C["main\n(full releases only)"]
+```
+
+---
+
+## Versioning
+
+Versions follow **MAJOR.MINOR.PATCH**, optionally suffixed with `-beta` for pre-releases.
+
+MAJOR and MINOR versions are **milestone-based**: each number corresponds to a defined project milestone. PATCH versions are used for incremental development updates made while working towards the next milestone.
+
+| Component | When to increment                                                                                                                                                                                                                              |
+| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **MAJOR** | Reaching a top-level milestone that represents a new generation of the project — e.g. a complete rewrite, a fundamental protocol change, or a shift in overall project direction so significant that it warrants a new major milestone series. |
+| **MINOR** | Reaching a planned minor milestone — a defined set of features, goals, or deliverables that has been completed. What constitutes a milestone should be agreed upon before development begins (tracked on github milestones).                   |
+| **PATCH** | Development updates made while working towards the next milestone — bug fixes, partial feature progress, documentation changes, small visual tweaks, or any change that does not yet complete a milestone.                                     |
+
+### Beta Pre-releases
+
+Every release that increments **MAJOR or MINOR must first be released as a `-beta` pre-release** and pass testing before it is promoted to a full release.
+
+The promotion process works as follows:
+
+```mermaid
+flowchart LR
+    A["x.y.0-beta\n(pre-release)"] --> B{Testing}
+    B -- bugs found --> C["x.y.1-beta\n(fix)"]
+    C --> D{Testing}
+    D -- bugs found --> E["x.y.2-beta\n(fix) ..."]
+    D -- passed --> F["x.y.1\n(full release)"]
+    E --> G{Testing}
+    G -- passed --> H["x.y.2\n(full release)"]
+```
+
+**The full release tag is placed at the same commit as the accepted pre-release on `stage`, and that commit is then merged into `main` via PR.** No code changes are made between the last `-beta` tag and the full release tag. Beta tags only ever exist on `stage` — `main` only receives full releases.
+
+> **Example:** `10.11.0-beta` is released on `stage`. Bugs are found and fixed in `10.11.1-beta`, `10.11.2-beta`, `10.11.3-beta`. Once `10.11.3-beta` passes testing, it is tagged `10.11.3` on `stage` and merged into `main`.
+
+PATCH releases do not require a `-beta` pre-release and may be released directly as a full version.
+
+---
+
+## Release Notes
+
+All release notes **must** follow this structure.
+
+### 1. Title
+
+```
+# Release Notes — v<version>
+```
+
+### 2. Preamble
+
+A short block (blockquote) immediately below the title containing:
+
+- **Date** of release.
+- **Built upon** — which version this release is built on top of.
+- **Status** — either `pre-release` (with a note on what remains before promotion) or `stable`.
+
+Example:
+
+```markdown
+> Release date: 2026-04-01
+> Built on top of v2.0.3-beta.
+> **Status: stable.**
+```
+
+```markdown
+> Pre-release date: 2026-04-01
+> Built on top of v2.0.0-beta.
+> **Status: pre-release — requires stress testing before production use.**
+```
+
+---
+
+### 3. Overview
+
+A prose summary of the release followed by a **bullet point list** of every problem addressed or change made. The summary should communicate:
+
+- How large the release is (patch-level tweak, significant feature addition, major overhaul, etc.).
+- The motivation — what prompted the changes.
+
+The bullet list gives a reader a complete picture at a glance before they read the detail sections.
+
+Example:
+
+```markdown
+## Overview
+
+v2.1.0-beta is a significant feature release ...
+
+- New meeting deletion endpoint
+- Vote state endpoints added
+- Lock ordering corrected in README
+```
+
+---
+
+### 4. Changes
+
+One subsection per item from the overview bullet list. Each subsection:
+
+- Explains the change in depth — what was changed, why, and what impact it has.
+- Uses **tables** to compare before/after states, list endpoints, or summarise options where that aids clarity.
+- Uses **Mermaid diagrams** to illustrate flows, architecture, or sequences where a diagram communicates more than prose.
+- Is separated from the next section by a horizontal rule (`---`).
+
+Example structure:
+
+```markdown
+## Changes
+
+### New Meeting Deletion Endpoint
+
+...explanation...
+
+---
+
+### Vote State Endpoints
+
+...explanation, possibly with a table of endpoints...
+
+---
+
+### README: Lock Ordering Correction
+
+...explanation...
+```
+
+#### When to use tables
+
+Use a table when comparing multiple items across consistent attributes — e.g. a list of endpoints and their roles, a before/after comparison, or a summary of test coverage areas.
+
+#### When to use Mermaid diagrams
+
+Use a Mermaid diagram when the relationship between steps, services, or states is easier to understand visually than as prose. Preferred diagram types:
+
+| Situation                        | Diagram type      |
+| -------------------------------- | ----------------- |
+| Multi-step flows or processes    | `flowchart`       |
+| Service-to-service communication | `sequenceDiagram` |
+| State machines                   | `stateDiagram-v2` |
+| Version/branching timelines      | `gitGraph`        |
+
+---
+
+## Checklist Before Publishing a Release
+
+- [ ] Version number follows MAJOR.MINOR.PATCH rules above (MAJOR/MINOR = milestone reached, PATCH = development update).
+- [ ] If MINOR or MAJOR changed, this is a `-beta` pre-release.
+- [ ] The PR from `stage` → `main` has been reviewed and testing passed.
+- [ ] Preamble includes date, base version, and status.
+- [ ] Overview contains a prose summary and a bullet list of all changes.
+- [ ] Each bullet point has a corresponding Changes subsection.
+- [ ] Tables or Mermaid diagrams are used where they add clarity.
+- [ ] Each Changes subsection is separated by a horizontal rule.
diff --git a/Cargo.lock b/Cargo.lock
index 0939cd5..88ba989 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,6 +39,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -636,6 +642,20 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "dashmap"
+version = "6.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "data-url"
 version = "0.3.2"
@@ -867,6 +887,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "fontconfig-parser"
 version = "0.5.8"
@@ -899,6 +925,16 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "forwarded-header-value"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
+dependencies = [
+ "nonempty",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "fs-err"
 version = "3.3.0"
@@ -992,6 +1028,12 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
+[[package]]
+name = "futures-timer"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+
 [[package]]
 name = "futures-util"
 version = "0.3.32"
@@ -1098,6 +1140,29 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "governor"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
+dependencies = [
+ "cfg-if",
+ "dashmap",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.2",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -1148,13 +1213,19 @@ dependencies = [
  "ahash",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -1162,6 +1233,11 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "heck"
@@ -1283,6 +1359,19 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -1764,6 +1853,18 @@ dependencies = [
  "pxfm",
 ]
 
+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1879,6 +1980,26 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
 
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -1925,6 +2046,12 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
 [[package]]
 name = "potential_utf"
 version = "0.1.4"
@@ -2011,6 +2138,21 @@ dependencies = [
  "image 0.25.9",
 ]
 
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quick-error"
 version = "2.0.1"
@@ -2153,6 +2295,15 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
 [[package]]
 name = "rayon"
 version = "1.11.0"
@@ -2459,6 +2610,7 @@ dependencies = [
  "tokio-stream",
  "tower",
  "tower-http",
+ "tower_governor",
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
@@ -2490,6 +2642,7 @@ dependencies = [
  "tokio",
  "tower",
  "tower-http",
+ "tower_governor",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -2764,6 +2917,15 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -3068,6 +3230,35 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tonic"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -3076,9 +3267,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -3124,6 +3318,23 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
+[[package]]
+name = "tower_governor"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44de9b94d849d3c46e06a883d72d408c2de6403367b39df2b1c9d9e7b6736fe6"
+dependencies = [
+ "axum",
+ "forwarded-header-value",
+ "governor",
+ "http",
+ "pin-project",
+ "thiserror 2.0.18",
+ "tonic",
+ "tower",
+ "tracing",
+]
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -3529,6 +3740,22 @@ version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -3538,6 +3765,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
diff --git a/TODO.md b/TODO.md
deleted file mode 100644
index 6cc021f..0000000
--- a/TODO.md
+++ /dev/null
@@ -1,22 +0,0 @@
-## Needs to be done by November 16th
-
-### Server Side (and wasm)
-
-- [x] member list
-- [x] delete members
-- [ ] Fix warnings...
-- [ ] Doc tests for proof
-- [x] Fix UUID
-- [x] Host Universal Auth Token
-- [x] Meeting agenda update as we go
-
-### Client Side
-
-- [x] Host/Voter Page
-- [x] Start Page
-- [x] Invite Voter/Host
-- [x] Agenda Viewer
-- [ ] Click to enlarge qr code
-- [ ] Allow voters to refresh page during voting
-- [ ] Format links and nested lists in agenda viewer
-- [ ] Tabs in textarea
diff --git a/frontend/src/components/Navbar/Navbar.tsx b/frontend/src/components/Navbar/Navbar.tsx
index 7dc4ffa..fae5192 100644
--- a/frontend/src/components/Navbar/Navbar.tsx
+++ b/frontend/src/components/Navbar/Navbar.tsx
@@ -25,7 +25,7 @@ export function Navbar() {
         Rustsystem
       </a>
 
-      <div className="flex items-center gap-6 ml-8">
+      <div className="hidden sm:flex items-center gap-6 ml-8">
         {NAV_LINKS.map(({ to, label }) => (
           <Link
             key={to}
diff --git a/frontend/src/routes/admin.tsx b/frontend/src/routes/admin.tsx
index 7dc7e36..24152c7 100644
--- a/frontend/src/routes/admin.tsx
+++ b/frontend/src/routes/admin.tsx
@@ -10,11 +10,13 @@ import { Badge } from "@/components/Badge/Badge";
 import { Panel } from "@/components/Panel/Panel";
 import { VotePanel, type VoteState } from "@/components/VotePanel/VotePanel";
 import {
+  apiFetch,
   apiUrl,
   startVoteRound,
   tally as tallyVote,
   getTally,
   endVoteRound,
+  getSessionIds,
   type TallyResult,
 } from "@/signatures/voteSession";
 import {
@@ -179,10 +181,6 @@ function QRPanel({
       }
     >
       <div className="flex flex-col gap-4">
-        <Alert size="sm" color="secondary">
-          Waiting for {result.voterName} to scan the QR code…
-        </Alert>
-
         {/* QR code — white background ensures readability regardless of theme */}
         <div className="flex justify-center">
           <div
@@ -228,12 +226,14 @@ function QRPanel({
 function VoterListPanel({
   voters,
   loading,
+  selfUuuid,
   onRemove,
   onRemoveAll,
   onReload,
 }: {
   voters: VoterInfo[];
   loading: boolean;
+  selfUuuid: string | null;
   onRemove: (uuid: string) => Promise<void>;
   onRemoveAll: () => Promise<void>;
   onReload: () => void;
@@ -369,7 +369,7 @@ function VoterListPanel({
                 </Badge>
               )}
 
-              {!v.is_host && (
+              {v.uuid !== selfUuuid && (
                 <button
                   type="button"
                   onClick={() => handleRemove(v.uuid)}
@@ -926,6 +926,8 @@ function HostVoteRoundPanel({
 
 // ─── Admin page ───────────────────────────────────────────────────────────────
 
+const SESSION_POLL_MS = 10_000;
+
 function Admin() {
   const navigate = useNavigate();
   const [voters, setVoters] = useState<VoterInfo[]>([]);
@@ -945,13 +947,10 @@ function Admin() {
   const [tallyDownloadError, setTallyDownloadError] = useState<string | null>(
     null,
   );
-  // Ref so the SSE closure always reads the current qrInfo without re-subscribing.
-  const qrInfoRef = useRef(qrInfo);
   const [loadError, setLoadError] = useState<string | null>(null);
-
-  useEffect(() => {
-    qrInfoRef.current = qrInfo;
-  }, [qrInfo]);
+  const [selfUuuid, setSelfUuuid] = useState<string | null>(null);
+  // null = still checking, true = in meeting, false = removed/not logged in
+  const [sessionValid, setSessionValid] = useState<boolean | null>(null);
 
   const reloadVoters = useCallback(async () => {
     try {
@@ -962,23 +961,46 @@ function Admin() {
     }
   }, []);
 
+  const refreshSession = useCallback(async () => {
+    let res: Response;
+    try {
+      res = await apiFetch("/api/common/vote-progress");
+    } catch {
+      return; // network error — don't invalidate session
+    }
+    if (res.status === 401) {
+      setSessionValid(false);
+      return;
+    }
+    if (!res.ok) return; // other server error — keep current session state
+    setSessionValid(true);
+  }, []);
+
   // ── Initial load ────────────────────────────────────────────────────────────
   useEffect(() => {
     async function init() {
       try {
-        const [voterList, progress] = await Promise.all([
+        const [voterList, progress, sessionIds] = await Promise.all([
           fetchVoterList(),
           fetchVoteProgress(),
+          getSessionIds(),
         ]);
         setVoters(voterList);
+        setSelfUuuid(sessionIds.uuuid);
         setVoteProgress(progress);
         const state = deriveVoteState(progress);
         setVoteState(state);
+        setSessionValid(true);
         if (state === "Tally") {
           getTally().then(setTallyResult).catch(console.error);
         }
       } catch (err) {
-        setLoadError(String(err));
+        if (err instanceof Error && err.message.includes("401")) {
+          setSessionValid(false);
+        } else {
+          setSessionValid(true);
+          setLoadError(String(err));
+        }
       } finally {
         setVotersLoading(false);
       }
@@ -1050,18 +1072,20 @@ function Admin() {
       withCredentials: true,
     });
     es.onmessage = (e) => {
-      const raw = (e.data as string).replace(/^"|"$/g, "");
-      if (raw === "Ready") {
-        const name = qrInfoRef.current?.voterName ?? null;
-        setQrInfo(null);
-        setJoinedVoterName(name);
-        reloadVoters();
-      }
+      const name = e.data as string;
+      setJoinedVoterName(name);
+      reloadVoters();
     };
     es.onerror = () => console.warn("invite-watch SSE disconnected");
     return () => es.close();
   }, [reloadVoters]);
 
+  // ── Periodic session check ───────────────────────────────────────────────────
+  useEffect(() => {
+    const timer = setInterval(refreshSession, SESSION_POLL_MS);
+    return () => clearInterval(timer);
+  }, [refreshSession]);
+
   // ── Handlers ────────────────────────────────────────────────────────────────
 
   async function handleStartVote(
@@ -1139,6 +1163,28 @@ function Admin() {
 
   // ── Render ──────────────────────────────────────────────────────────────────
 
+  if (sessionValid === null) {
+    return (
+      <div className="flex items-center justify-center py-32">
+        <Spinner size="l" color="primary" />
+      </div>
+    );
+  }
+
+  if (!sessionValid) {
+    return (
+      <div className="max-w-md mx-auto px-6 py-10">
+        <Panel title="Not an administrator">
+          <p className="text-sm" style={{ color: "var(--textSecondary)" }}>
+            You are not currently an administrator in a meeting. You may have
+            been removed or your session may have expired. If you believe this
+            is a mistake, please contact your meeting administrator.
+          </p>
+        </Panel>
+      </div>
+    );
+  }
+
   if (loadError) {
     return (
       <div className="max-w-xl mx-auto p-8">
@@ -1283,7 +1329,7 @@ function Admin() {
         <div className="flex flex-col gap-6">
           <AddVoterPanel onAdded={handleVoterAdded} voteState={voteState} />
 
-          {joinedVoterName && !qrInfo && (
+          {joinedVoterName && (
             <Alert
               size="m"
               color="primary"
@@ -1301,6 +1347,7 @@ function Admin() {
           <VoterListPanel
             voters={voters}
             loading={votersLoading}
+            selfUuuid={selfUuuid}
             onRemove={removeVoter}
             onRemoveAll={removeAllVoters}
             onReload={reloadVoters}
diff --git a/frontend/src/routes/index.tsx b/frontend/src/routes/index.tsx
index c71c141..29105ba 100644
--- a/frontend/src/routes/index.tsx
+++ b/frontend/src/routes/index.tsx
@@ -413,33 +413,11 @@ function Hero() {
             <FeaturePill key={f} label={f} />
           ))}
         </div>
-
-        <div
-          className="flex items-center gap-1 flex-wrap justify-center text-sm"
-          style={{ color: "var(--textSecondary)" }}
-        >
-          <span>Learn more:</span>
-          <Link
-            to="/guide"
-            style={{ color: "var(--primary)" }}
-            className="font-medium hover:underline"
-          >
-            Guide
-          </Link>
-          <span>·</span>
-          <Link
-            to="/encryption"
-            style={{ color: "var(--primary)" }}
-            className="font-medium hover:underline"
-          >
-            Cryptography
-          </Link>
-        </div>
       </div>
 
       {/* Scroll cue */}
       <div
-        className="absolute bottom-8 left-1/2 -translate-x-1/2 flex flex-col items-center gap-2"
+        className="absolute bottom-8 left-1/2 -translate-x-1/2 hidden sm:flex flex-col items-center gap-2"
         style={{
           opacity: mounted ? 0.5 : 0,
           transition: "opacity 1.2s ease 1s",
diff --git a/frontend/src/signatures/e2e-tests/load.test.ts b/frontend/src/signatures/e2e-tests/load.test.ts
new file mode 100644
index 0000000..4265ed1
--- /dev/null
+++ b/frontend/src/signatures/e2e-tests/load.test.ts
@@ -0,0 +1,632 @@
+/**
+ * @vitest-environment node
+ *
+ * Load / concurrency tests for the full voting system.
+ *
+ * Three scenarios:
+ *
+ *   1. Concurrent host invites (N_MEETINGS × VOTERS_PER_MEETING)
+ *      Multiple meetings are created simultaneously, then every host
+ *      concurrently adds all its voters in a single Promise.all wave.
+ *      Verifies there are no lock-ordering bugs or races in the host
+ *      invite path when meetings are written in parallel.
+ *
+ *   2. 50 simultaneous registrations
+ *      One meeting, 50 logged-in voters, all fire POST /api/register at the
+ *      same time. Checks that trustauth's duplicate-prevention guard and the
+ *      shared RoundState lock hold up under concurrent load.
+ *
+ *   3. 200-voter end-to-end flow
+ *      Full protocol at scale: create meeting → add 200 voters → log in all
+ *      200 (batched) → start vote → all 200 register simultaneously → all
+ *      200 get vote data and submit simultaneously → tally → verify counts.
+ *
+ * Why ConcurrentClient instead of TestClient?
+ *   TestClient.withSession() patches globalThis.fetch to inject cookies and
+ *   rewrite relative URLs. That design is safe when only one client is active
+ *   at a time, but breaks under concurrency: two clients racing on withSession()
+ *   will overwrite each other's global fetch. ConcurrentClient avoids the
+ *   global patch entirely — it calls fetch directly with explicit absolute URLs
+ *   and keeps its own per-instance cookie jar.
+ *
+ * Requires both services running:
+ *   cargo run --bin rustsystem-server
+ *   cargo run --bin rustsystem-trustauth
+ *   pnpm test src/signatures/e2e-tests/load.test.ts
+ */
+
+import { generateToken, buildBallot, uuidToBytes } from "../signatures";
+import type { BallotMetaData } from "../signatures";
+import { BASE_URL, TRUSTAUTH_URL, DEFAULT_METADATA } from "./helpers";
+import type { TallyResult, VoteData } from "../voteSession";
+
+// ── Service reachability ───────────────────────────────────────────────────────
+
+const servicesReachable: boolean = await Promise.all([
+  fetch(`${BASE_URL}/`)
+    .then(() => true)
+    .catch(() => false),
+  fetch(`${TRUSTAUTH_URL}/api/is-registered`)
+    .then(() => true)
+    .catch(() => false),
+]).then(([s, t]) => s && t);
+
+// ── ConcurrentClient ──────────────────────────────────────────────────────────
+
+/**
+ * A self-contained, concurrency-safe HTTP client with its own cookie jar.
+ *
+ * Unlike TestClient it does NOT patch globalThis.fetch. Every method calls
+ * the native fetch directly using explicit absolute URLs, so many
+ * ConcurrentClient instances can run in parallel without interfering.
+ */
+class ConcurrentClient {
+  private cookieJar = "";
+
+  private storeCookies(headers: Headers): void {
+    // Node 20.10+ exposes getSetCookie(); fall back to splitting the combined
+    // header string (older runtimes / undici behaviour).
+    type H = { getSetCookie?(): string[] };
+    const rawList: string[] =
+      typeof (headers as unknown as H).getSetCookie === "function"
+        ? (headers as unknown as H).getSetCookie!()
+        : (headers.get("set-cookie") ?? "").split(/\n/).filter(Boolean);
+
+    for (const raw of rawList) {
+      const nameValue = raw.split(";")[0].trim();
+      if (!nameValue.includes("=")) continue;
+      const name = nameValue.split("=")[0];
+      const re = new RegExp(`(?:^|; *)${name}=[^;]*`);
+      this.cookieJar = this.cookieJar
+        ? re.test(this.cookieJar)
+          ? this.cookieJar.replace(re, nameValue)
+          : `${this.cookieJar}; ${nameValue}`
+        : nameValue;
+    }
+  }
+
+  /** Send a request, injecting stored cookies and persisting Set-Cookie headers. */
+  private async req(url: string, init: RequestInit = {}): Promise<Response> {
+    const headers = new Headers(init.headers as HeadersInit | undefined);
+    if (!headers.has("Content-Type"))
+      headers.set("Content-Type", "application/json");
+    if (this.cookieJar) headers.set("Cookie", this.cookieJar);
+
+    const res = await fetch(url, { ...init, headers });
+    this.storeCookies(res.headers);
+    return res;
+  }
+
+  // ── Meeting setup ────────────────────────────────────────────────────────────
+
+  /**
+   * POST /api/create-meeting (server) then POST /api/login (trustauth).
+   * Returns the session IDs for subsequent calls.
+   */
+  async createMeeting(
+    title = "Load Test",
+    hostName = "Test Host",
+  ): Promise<{ muuid: string; uuuid: string }> {
+    const serverRes = await this.req(`${BASE_URL}/api/create-meeting`, {
+      method: "POST",
+      body: JSON.stringify({ title, host_name: hostName, pub_key: "test-key" }),
+    });
+    if (!serverRes.ok)
+      throw new Error(`createMeeting HTTP ${serverRes.status}`);
+
+    const data = await serverRes.json();
+    const ids = { muuid: data.muuid as string, uuuid: data.uuuid as string };
+
+    const trustRes = await this.req(`${TRUSTAUTH_URL}/api/login`, {
+      method: "POST",
+      body: JSON.stringify(ids),
+    });
+    if (!trustRes.ok)
+      throw new Error(`trustauth createMeeting login HTTP ${trustRes.status}`);
+
+    return ids;
+  }
+
+  /**
+   * POST /api/host/new-voter — add a voter and return the invite link.
+   * Requires a host session (cookie set by createMeeting).
+   */
+  async addVoter(name: string, isHost = false): Promise<string> {
+    const res = await this.req(`${BASE_URL}/api/host/new-voter`, {
+      method: "POST",
+      body: JSON.stringify({ voterName: name, isHost }),
+    });
+    if (!res.ok) throw new Error(`addVoter HTTP ${res.status}`);
+    const data = await res.json();
+    return data.inviteLink as string;
+  }
+
+  /**
+   * Log in by following an invite link (voter or host).
+   *
+   * Host invite links carry admin_msg (hex-encoded bytes) and admin_sig as
+   * extra query parameters. When present they are forwarded as admin_cred in
+   * the login body, causing the server to issue a host JWT (is_host=true).
+   * Without them a regular voter JWT is issued. Mirrors the logic in login.tsx.
+   */
+  async loginFromInviteLink(
+    inviteLink: string,
+  ): Promise<{ muuid: string; uuuid: string }> {
+    // The invite link may be a full URL or a relative path; URL() handles both.
+    const url = new URL(inviteLink, BASE_URL);
+    const muuid = url.searchParams.get("muuid")!;
+    const uuuid = url.searchParams.get("uuuid")!;
+    const adminMsg = url.searchParams.get("admin_msg");
+    const adminSig = url.searchParams.get("admin_sig");
+    const admin_cred =
+      adminMsg && adminSig
+        ? {
+            msg: adminMsg.match(/.{2}/g)!.map((b) => parseInt(b, 16)),
+            sig: adminSig,
+          }
+        : undefined;
+
+    const serverRes = await this.req(`${BASE_URL}/api/login`, {
+      method: "POST",
+      body: JSON.stringify({ uuuid, muuid, admin_cred }),
+    });
+    if (!serverRes.ok)
+      throw new Error(`voter server login HTTP ${serverRes.status}`);
+
+    const trustRes = await this.req(`${TRUSTAUTH_URL}/api/login`, {
+      method: "POST",
+      body: JSON.stringify({ uuuid, muuid }),
+    });
+    if (!trustRes.ok)
+      throw new Error(`voter trustauth login HTTP ${trustRes.status}`);
+
+    return { muuid, uuuid };
+  }
+
+  // ── Vote round management ────────────────────────────────────────────────────
+
+  async startVoteRound(
+    name = "Load Test Vote",
+    metadata: BallotMetaData = DEFAULT_METADATA,
+  ): Promise<void> {
+    const res = await this.req(`${BASE_URL}/api/host/start-vote`, {
+      method: "POST",
+      body: JSON.stringify({ name, shuffle: false, metadata }),
+    });
+    if (!res.ok) throw new Error(`startVoteRound HTTP ${res.status}`);
+  }
+
+  // ── Voter workflow ────────────────────────────────────────────────────────────
+
+  /**
+   * POST /api/register on trustauth — generate a blind-signature commitment
+   * and get back a blind signature. The token and blind_factor are derived
+   * from the voter's session IDs and kept in memory for later ballot building.
+   *
+   * Stores the generated token/blind_factor in this client so getVoteData()
+   * can serve them from the trustauth /api/vote-data endpoint.
+   */
+  async registerVoter(session: {
+    uuuid: string;
+    muuid: string;
+  }): Promise<void> {
+    const tokenData = generateToken(
+      uuidToBytes(session.uuuid),
+      uuidToBytes(session.muuid),
+    );
+    const res = await this.req(`${TRUSTAUTH_URL}/api/register`, {
+      method: "POST",
+      body: JSON.stringify({
+        context: tokenData.context,
+        commitment: tokenData.commitmentJson,
+        token: Array.from(tokenData.token),
+        blind_factor: Array.from(tokenData.blindFactor),
+      }),
+    });
+    if (!res.ok) throw new Error(`registerVoter HTTP ${res.status}`);
+  }
+
+  /**
+   * GET /api/vote-data — retrieve the stored token, blind_factor, and blind
+   * signature from trustauth. Must be called after registerVoter.
+   */
+  async getVoteData(): Promise<VoteData> {
+    const res = await this.req(`${TRUSTAUTH_URL}/api/vote-data`);
+    if (!res.ok) throw new Error(`getVoteData HTTP ${res.status}`);
+    return res.json() as Promise<VoteData>;
+  }
+
+  /**
+   * Build a ballot from the stored vote data and POST it to /api/voter/submit.
+   * @param choice  Array of candidate indices, or null for a blank vote.
+   */
+  async submitVote(
+    voteData: VoteData,
+    choice: number[] | null,
+    metadata: BallotMetaData = DEFAULT_METADATA,
+  ): Promise<void> {
+    const ballot = buildBallot(
+      metadata,
+      choice,
+      new Uint8Array(voteData.token),
+      new Uint8Array(voteData.blind_factor),
+      voteData.signature,
+    );
+    const res = await this.req(`${BASE_URL}/api/voter/submit`, {
+      method: "POST",
+      body: JSON.stringify(ballot),
+    });
+    if (!res.ok) throw new Error(`submitVote HTTP ${res.status}`);
+  }
+
+  // ── Tally & cleanup ──────────────────────────────────────────────────────────
+
+  async endVoteRound(): Promise<void> {
+    const res = await this.req(`${BASE_URL}/api/host/end-vote-round`, {
+      method: "DELETE",
+    });
+    if (!res.ok) throw new Error(`endVoteRound HTTP ${res.status}`);
+  }
+
+  async tally(): Promise<TallyResult> {
+    const res = await this.req(`${BASE_URL}/api/host/tally`, {
+      method: "POST",
+    });
+    if (!res.ok) throw new Error(`tally HTTP ${res.status}`);
+    return res.json() as Promise<TallyResult>;
+  }
+
+  async closeMeeting(): Promise<void> {
+    await this.req(`${BASE_URL}/api/host/close-meeting`, { method: "DELETE" });
+  }
+}
+
+// ── Helpers ────────────────────────────────────────────────────────────────────
+
+/**
+ * Execute `tasks` with at most `batchSize` tasks running concurrently.
+ * Preserves insertion order in the returned results array.
+ */
+async function runInBatches<T>(
+  tasks: Array<() => Promise<T>>,
+  batchSize: number,
+): Promise<T[]> {
+  const results: T[] = [];
+  for (let i = 0; i < tasks.length; i += batchSize) {
+    const wave = tasks.slice(i, i + batchSize).map((fn) => fn());
+    results.push(...(await Promise.all(wave)));
+  }
+  return results;
+}
+
+// ── Test suites ────────────────────────────────────────────────────────────────
+
+// ─── 1. Concurrent host invites ────────────────────────────────────────────────
+
+describe.skipIf(!servicesReachable)("concurrent host invites", () => {
+  /**
+   * Five meetings are created simultaneously; then every host adds twenty
+   * voters at the same time, giving 100 parallel new-voter requests spread
+   * across five independent meetings. We verify:
+   *   • all 100 calls succeed (no 5xx or deadlock)
+   *   • every returned invite link contains the expected query parameters
+   *
+   * This exercises write-path concurrency: the outer AppState read-lock is
+   * held briefly to clone each Arc<Meeting>, then per-meeting voter locks are
+   * acquired independently. Parallel writes to different meetings must not
+   * interfere.
+   */
+  it(
+    "5 hosts each add 20 voters concurrently — all 100 invite links are valid",
+    async () => {
+      const N_MEETINGS = 5;
+      const VOTERS_PER_MEETING = 20;
+
+      // ── Create all meetings concurrently ────────────────────────────────────
+      const hosts = await Promise.all(
+        Array.from({ length: N_MEETINGS }, async (_, i) => {
+          const host = new ConcurrentClient();
+          await host.createMeeting(
+            `Concurrent Meeting ${i + 1}`,
+            `Host ${i + 1}`,
+          );
+          return host;
+        }),
+      );
+
+      // ── Every host adds all its voters simultaneously ────────────────────────
+      // Flatten to a single Promise.all so all 100 requests fire at once.
+      const allTasks = hosts.flatMap((host, hi) =>
+        Array.from(
+          { length: VOTERS_PER_MEETING },
+          (_, vi) => () => host.addVoter(`M${hi + 1} Voter ${vi + 1}`),
+        ),
+      );
+      const inviteLinks = await Promise.all(allTasks.map((fn) => fn()));
+
+      // ── Assertions ──────────────────────────────────────────────────────────
+      expect(inviteLinks).toHaveLength(N_MEETINGS * VOTERS_PER_MEETING);
+      for (const link of inviteLinks) {
+        expect(link).toMatch(/\/login\?/);
+        expect(link).toMatch(/muuid=/);
+        expect(link).toMatch(/uuuid=/);
+      }
+
+      // ── Cleanup ─────────────────────────────────────────────────────────────
+      await Promise.all(hosts.map((host) => host.closeMeeting()));
+    },
+    { timeout: 60_000 },
+  );
+});
+
+// ─── 2. 50 simultaneous registrations ─────────────────────────────────────────
+
+describe.skipIf(!servicesReachable)("50 simultaneous registrations", () => {
+  /**
+   * Fifty voters all call POST /api/register on trustauth at the same time.
+   *
+   * The trustauth RoundState holds an async mutex that guards the registered-
+   * voters set. This test checks that:
+   *   • all 50 registrations complete successfully under contention
+   *   • no voter is incorrectly rejected as a duplicate (each client has a
+   *     distinct JWT, so trustauth must serialise the set writes correctly)
+   *
+   * After registration we start a tally to confirm the server session is still
+   * consistent (tally count = 0 since no votes were submitted).
+   */
+  it(
+    "all 50 registrations succeed with no duplicates or errors",
+    async () => {
+      const N = 50;
+
+      // ── Setup: one meeting, N voters ────────────────────────────────────────
+      const host = new ConcurrentClient();
+      await host.createMeeting("50-Reg Load Test", "Host");
+
+      // Add all voters via host API (parallel — exercises write path too)
+      const inviteLinks = await Promise.all(
+        Array.from({ length: N }, (_, i) => host.addVoter(`Voter ${i + 1}`)),
+      );
+
+      // Log in all voters before start-vote so they are not pruned.
+      // Use a batch size of 25 to avoid saturating the login endpoint.
+      const voterSessions = await runInBatches(
+        inviteLinks.map((link) => async () => {
+          const voter = new ConcurrentClient();
+          const session = await voter.loginFromInviteLink(link);
+          return { voter, session };
+        }),
+        25,
+      );
+
+      // ── Start vote round ────────────────────────────────────────────────────
+      await host.startVoteRound("Concurrent Registration Test");
+
+      // ── All 50 voters register simultaneously ────────────────────────────────
+      // This is the core of the test: 50 concurrent writes to the trustauth
+      // registered-voters set. Every one must succeed (no AlreadyRegistered 409).
+      await Promise.all(
+        voterSessions.map(({ voter, session }) => voter.registerVoter(session)),
+      );
+
+      // ── Tally: no votes submitted, all counts must be zero ──────────────────
+      const result = await host.tally();
+      expect(result.blank).toBe(0);
+      for (const candidate of DEFAULT_METADATA.candidates) {
+        expect(result.score[candidate]).toBe(0);
+      }
+
+      // ── Cleanup ─────────────────────────────────────────────────────────────
+      await host.closeMeeting();
+    },
+    { timeout: 3 * 60_000 },
+  );
+});
+
+// ─── 3. 500-voter multi-round stress test ─────────────────────────────────────
+
+describe.skipIf(!servicesReachable)("500-voter full system flow", () => {
+  /**
+   * The entire voting protocol under maximum concurrency with 500 participants
+   * across three consecutive vote rounds.
+   *
+   * Every step is a single Promise.all — no batching anywhere. The server and
+   * trustauth face worst-case burst load at every phase, and the state machine
+   * must transition cleanly through Idle → Voting → Tally → Idle three times.
+   *
+   * Multi-host invite phase (runs once, before all rounds):
+   *   One master host creates the meeting and promotes 9 co-hosts. All 10 hosts
+   *   then add their 50 voters simultaneously (500 concurrent new-voter writes
+   *   across 10 host JWTs on the same meeting). All 500 voters log in at once
+   *   before start-vote prunes unclaimed slots.
+   *
+   * Per-round phase (repeated for each round):
+   *   start-vote → 500 register simultaneously → 500 get-vote-data simultaneously
+   *   → 500 submit simultaneously → tally → assert exact counts → end-vote-round
+   *
+   * Round distributions (500 voters each):
+   *   Round 1 — mixed:     125 blank / 150 A / 125 B / 100 C
+   *   Round 2 — no blanks:   0 blank / 200 A / 150 B / 150 C
+   *   Round 3 — all blank: 500 blank /   0 A /   0 B /   0 C
+   *
+   * State machine transitions under stress:
+   *   Idle →(start-vote)→ Voting →(tally)→ Tally →(end-vote-round)→ Idle  ×3
+   *   A second start-vote while Voting must 409; tallying while Idle must 410.
+   *   Both are verified after every round transition.
+   */
+  it(
+    "500 voters across 3 rounds — state machine stays consistent, tallies match",
+    async () => {
+      const N = 500;
+      const N_COHOSTS = 9; // + 1 master = 10 total host clients
+      const N_HOSTS = N_COHOSTS + 1;
+      const VOTERS_PER_HOST = N / N_HOSTS; // 50 voters per host
+
+      // Per-round vote distributions. choices[i] is indexed by voter position
+      // in the flat invite-link array produced during setup.
+      const ROUNDS = [
+        {
+          name: "Round 1 — mixed",
+          choices: [
+            ...Array<null>(125).fill(null), // blank
+            ...Array<number[]>(150).fill([0]), // Option A
+            ...Array<number[]>(125).fill([1]), // Option B
+            ...Array<number[]>(100).fill([2]), // Option C
+          ] as Array<number[] | null>,
+          expected: { blank: 125, A: 150, B: 125, C: 100 },
+        },
+        {
+          name: "Round 2 — no blanks",
+          choices: [
+            ...Array<number[]>(200).fill([0]), // Option A
+            ...Array<number[]>(150).fill([1]), // Option B
+            ...Array<number[]>(150).fill([2]), // Option C
+          ] as Array<number[] | null>,
+          expected: { blank: 0, A: 200, B: 150, C: 150 },
+        },
+        {
+          name: "Round 3 — all blank",
+          choices: Array<null>(N).fill(null) as Array<number[] | null>,
+          expected: { blank: 500, A: 0, B: 0, C: 0 },
+        },
+      ];
+
+      // ── 1. Master creates the meeting ──────────────────────────────────────
+      const master = new ConcurrentClient();
+      await master.createMeeting("500-Voter Multi-Round Test", "Master Host");
+
+      // ── 2. Master creates 9 co-host invite links concurrently ──────────────
+      const coHostLinks = await Promise.all(
+        Array.from({ length: N_COHOSTS }, (_, i) =>
+          master.addVoter(`Co-Host ${i + 1}`, /* isHost */ true),
+        ),
+      );
+
+      // ── 3. All co-hosts log in concurrently ────────────────────────────────
+      const coHosts = await Promise.all(
+        coHostLinks.map(async (link) => {
+          const client = new ConcurrentClient();
+          await client.loginFromInviteLink(link);
+          return client;
+        }),
+      );
+
+      const allHosts = [master, ...coHosts]; // 10 host clients
+
+      // ── 4. All 10 hosts add their voters simultaneously ────────────────────
+      // 500 concurrent new-voter writes across 10 host JWTs on the same meeting.
+      const inviteLinks = (
+        await Promise.all(
+          allHosts.map((host, hi) =>
+            Promise.all(
+              Array.from({ length: VOTERS_PER_HOST }, (_, vi) =>
+                host.addVoter(`H${hi + 1} Voter ${vi + 1}`),
+              ),
+            ),
+          ),
+        )
+      ).flat();
+      expect(inviteLinks).toHaveLength(N);
+
+      // ── 5. All 500 voters log in simultaneously ────────────────────────────
+      // 1 000 HTTP calls in-flight at once (server login + trustauth login per voter).
+      // Must finish before start-vote, which prunes unclaimed voter slots.
+      const voterSessions = await Promise.all(
+        inviteLinks.map(async (link) => {
+          const voter = new ConcurrentClient();
+          const session = await voter.loginFromInviteLink(link);
+          return { voter, session };
+        }),
+      );
+      expect(voterSessions).toHaveLength(N);
+
+      // ── 6. Three vote rounds ───────────────────────────────────────────────
+      // ── State machine guard: tally while Idle must fail ───────────────────
+      // Verified once before any round to keep the per-round hot path clean.
+      // Starting a round is tested below; duplicate-start is checked BEFORE the
+      // round goes live so it can never corrupt an active keypair.
+      const idleTally = await master["req"](`${BASE_URL}/api/host/tally`, {
+        method: "POST",
+      });
+      expect(idleTally.status).toBe(410); // VotingInactive — no active round yet
+
+      for (const round of ROUNDS.values()) {
+        // ── 6a. Start round ─────────────────────────────────────────────────
+        await master.startVoteRound(round.name);
+
+        // Duplicate start-vote while Voting must be rejected (409).
+        // NOTE: this check is safe post-fix because the server now acquires the
+        // vote_auth write-lock BEFORE calling trustauth, so a rejected duplicate
+        // never reaches trustauth and cannot replace the active keypair.
+        const dupStart = await master["req"](
+          `${BASE_URL}/api/host/start-vote`,
+          {
+            method: "POST",
+            body: JSON.stringify({
+              name: "dup",
+              shuffle: false,
+              metadata: DEFAULT_METADATA,
+            }),
+          },
+        );
+        expect(dupStart.status).toBe(409);
+
+        // ── 6b. All 500 register simultaneously ─────────────────────────────
+        await Promise.all(
+          voterSessions.map(({ voter, session }) =>
+            voter.registerVoter(session),
+          ),
+        );
+
+        // ── 6c. All 500 get vote data simultaneously ─────────────────────────
+        const voteDataList = await Promise.all(
+          voterSessions.map(({ voter }) => voter.getVoteData()),
+        );
+
+        // ── 6d. All 500 submit simultaneously ────────────────────────────────
+        await Promise.all(
+          voterSessions.map(({ voter }, i) =>
+            voter.submitVote(voteDataList[i], round.choices[i]),
+          ),
+        );
+
+        // ── 6e. Tally and verify ─────────────────────────────────────────────
+        const result = await master.tally();
+
+        expect(result.blank).toBe(round.expected.blank);
+        expect(result.score[DEFAULT_METADATA.candidates[0]]).toBe(
+          round.expected.A,
+        );
+        expect(result.score[DEFAULT_METADATA.candidates[1]]).toBe(
+          round.expected.B,
+        );
+        expect(result.score[DEFAULT_METADATA.candidates[2]]).toBe(
+          round.expected.C,
+        );
+
+        const total =
+          result.blank + Object.values(result.score).reduce((a, b) => a + b, 0);
+        expect(total).toBe(N);
+
+        // Tallying again from Tally state must be rejected (410).
+        const dupTally = await master["req"](`${BASE_URL}/api/host/tally`, {
+          method: "POST",
+        });
+        expect(dupTally.status).toBe(410);
+
+        // ── 6f. Reset state machine for the next round ───────────────────────
+        await master.endVoteRound();
+
+        // Tallying after reset (Idle state) must also be rejected (410).
+        const staleTally = await master["req"](`${BASE_URL}/api/host/tally`, {
+          method: "POST",
+        });
+        expect(staleTally.status).toBe(410);
+      }
+
+      // ── 7. Cleanup ──────────────────────────────────────────────────────────
+      await master.closeMeeting();
+    },
+    { timeout: 45 * 60_000 }, // 45 minutes — 3 rounds × 500 concurrent voters
+  );
+});
diff --git a/frontend/src/signatures/voteSession.ts b/frontend/src/signatures/voteSession.ts
index 846a143..268b983 100644
--- a/frontend/src/signatures/voteSession.ts
+++ b/frontend/src/signatures/voteSession.ts
@@ -80,6 +80,7 @@ export interface SessionIds {
 
 export async function getSessionIds(): Promise<SessionIds> {
   const res = await apiFetch("/api/session-ids");
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
   const { uuuid, muuid } = await res.json();
 
   return { uuuid, muuid };
diff --git a/rustsystem-core/src/lib.rs b/rustsystem-core/src/lib.rs
index e0f951a..9ee0b86 100644
--- a/rustsystem-core/src/lib.rs
+++ b/rustsystem-core/src/lib.rs
@@ -264,87 +264,58 @@ impl APIErrorFinal {
 
 pub trait APIEndpointError: Into<APIError> {}
 
-/// Defines one API route. Implementing this trait for an empty struct will requires the `handler`
-/// method that can be used as a [`Handler`] for a [`MethodRouter`].
+/// Defines one API route. Implement this trait on an empty struct, then register it with
+/// [`add_handler`].
 ///
-/// The `State` should be set to the type expected when calling upon the server State.
+/// - `State` — the Axum application state type.
+/// - `Request` — any type implementing [`FromRequest`]. Typically a tuple of extractors
+///   (e.g. `(State<AppState>, Json<Body>)`).
+/// - `SuccessResponse` — the response body type on success. Use `()` for no body.
 ///
-/// The `Request` type can be any type that implements [`FromRequest`]. The simplest case is for
-/// `Request` to be a tuple of the parameters that would form the parameters of the equivalent
-/// handler function.
+/// Errors are always returned as [`APIError`]. The provided `handler` method wraps `route`,
+/// converts any `APIError` into a JSON [`APIErrorFinal`] response, and attaches the correct
+/// HTTP status code. Implementors only need to write `route`.
 ///
-/// The `SuccessResponse` is the type that forms the response in the successful case (i.e. the
-/// expected success structure)
-///
-/// Equivalently, the `ErrorResponse` is the structure of the unsuccessful case.
-///
-/// Note that the StatusCode should not be included in either `SuccessResponse` or `ErrorResponse`.
-/// rather, the StatusCode is enforced in the `APIResult` and `APIResponse` return types. A
-/// response cannot be sent without a StatusCode.
+/// Route registration is done via [`add_handler`], which reads `METHOD` and `PATH` to call
+/// the appropriate Axum routing method automatically.
 ///
 /// Example:
-/// ```rust
-///
+/// ```rust,ignore
+/// use serde::{Deserialize, Serialize};
+/// use axum::{Json, extract::State, http::StatusCode};
+/// use rustsystem_core::{APIError, APIErrorCode, APIHandler, Method, add_handler};
 ///
 /// #[derive(Deserialize)]
 /// struct ExampleRequestBody {
 ///     name: String,
-///     age: u8,
-///     id: usize,
-/// }
-///
-/// #[derive(Serialize)]
-/// enum ExampleError {
-///     SomethingFailed,
-///     ServerSadness { tears: u8 },
-///     Other,
 /// }
 ///
 /// #[derive(Serialize)]
 /// struct ExampleSuccess {
-///     epoch: u64,
-///     reference: String,
+///     greeting: String,
 /// }
 ///
 /// struct ExampleHandler;
+///
+/// #[async_trait::async_trait]
 /// impl APIHandler for ExampleHandler {
 ///     type State = AppState;
-///     // Any type that can be found in `FromRequestParts` can be included in the Request
-///     type Request = (
-///         CookieJar,
-///         State<AppState>,
-///         AuthUser,
-///         Json<ExampleRequestBody>,
-///     );
-///
-///     // Note that the `SuccessResponse` can also be unit type if there should be no response body
+///     type Request = (State<AppState>, Json<ExampleRequestBody>);
+///     // Use () if there is no response body
 ///     type SuccessResponse = Json<ExampleSuccess>;
-///     type ErrorResponse = Json<ExampleError>;
 ///
-///     async fn handler(
-///         request: Self::Request,
-///     ) -> APIResponse<Self::SuccessResponse, Self::ErrorResponse> {
-///         // Destructure, just like you would in a handler function
-///         let (
-///             jar,
-///             State(state),
-///             AuthUser {
-///                 uuid,
-///                 muid,
-///                 is_host,
-///             },
-///             Json(body),
-///         ) = request;
+///     const METHOD: Method = Method::Post;
+///     const PATH: &'static str = "/example";
+///     const SUCCESS_CODE: StatusCode = StatusCode::OK;
 ///
-///         // Do some stuff
-///         unimplemented!()
+///     async fn route(request: Self::Request) -> Result<Self::SuccessResponse, APIError> {
+///         let (State(state), Json(body)) = request;
+///         Ok(Json(ExampleSuccess { greeting: format!("Hello, {}!", body.name) }))
 ///     }
 /// }
 ///
-/// fn main() {
-///     // The `handler` function can now be used in the router
-///     Router::new().route("/example", post(ExampleHandler::handler));
-/// }
+/// // Register in a router:
+/// let router = add_handler::<ExampleHandler>(Router::new());
 /// ```
 
 #[async_trait]
diff --git a/rustsystem-server/Cargo.toml b/rustsystem-server/Cargo.toml
index 37de845..6afb0a0 100644
--- a/rustsystem-server/Cargo.toml
+++ b/rustsystem-server/Cargo.toml
@@ -11,6 +11,7 @@ axum-extra = { version = "0.10.1", features = ["cookie"]}
 tokio = { version = "1", features = ["full"] }
 tokio-stream = { version = "0.1.17", features = ["sync"] }
 tower-http = { version = "0.6.4", features = ["fs", "trace", "set-header"] }
+tower_governor = "0.8"
 serde.workspace = true
 serde_json = "1.0.140"
 
diff --git a/rustsystem-server/src/api/host/invite_watch.rs b/rustsystem-server/src/api/host/invite_watch.rs
index dba9f54..46e86bb 100644
--- a/rustsystem-server/src/api/host/invite_watch.rs
+++ b/rustsystem-server/src/api/host/invite_watch.rs
@@ -28,7 +28,7 @@ impl APIHandler for InviteWatch {
     const PATH: &'static str = "/invite-watch";
     const SUCCESS_CODE: StatusCode = StatusCode::OK;
     type SuccessResponse =
-        Sse<FilterMap<WatchStream<bool>, fn(bool) -> Option<Result<Event, APIError>>>>;
+        Sse<FilterMap<WatchStream<Option<String>>, fn(Option<String>) -> Option<Result<Event, APIError>>>>;
 
     async fn route(request: Self::Request) -> Result<Self::SuccessResponse, APIError> {
         let InviteWatchRequest {
@@ -36,17 +36,13 @@ impl APIHandler for InviteWatch {
             state: State(state),
         } = request;
 
-        let upon_event = |new_state| {
-            if new_state {
-                Some(Ok::<Event, APIError>(Event::default().data("Ready")))
-            } else {
-                Some(Ok::<Event, APIError>(Event::default().data("Wait")))
-            }
+        let upon_event = |new_state: Option<String>| {
+            new_state.map(|name| Ok::<Event, APIError>(Event::default().data(name)))
         };
 
         let meeting = state.get_meeting(auth.muuid).await?;
         let state_rx = meeting.invite_auth.read().await.new_watcher();
-        let stream = WatchStream::new(state_rx).filter_map(upon_event as _);
+        let stream = WatchStream::from_changes(state_rx).filter_map(upon_event as _);
         Ok(Sse::new(stream))
     }
 }
diff --git a/rustsystem-server/src/api/host/start_invite.rs b/rustsystem-server/src/api/host/start_invite.rs
index 441192d..dbc3901 100644
--- a/rustsystem-server/src/api/host/start_invite.rs
+++ b/rustsystem-server/src/api/host/start_invite.rs
@@ -33,8 +33,7 @@ impl APIHandler for StartInvite {
             state: State(state),
         } = request;
 
-        let meeting = state.get_meeting(auth.muuid).await?;
-        meeting.invite_auth.write().await.set_state(true);
+        state.get_meeting(auth.muuid).await?;
 
         info!(muuid = %auth.muuid, "Invite watch opened");
 
diff --git a/rustsystem-server/src/api/host/start_vote.rs b/rustsystem-server/src/api/host/start_vote.rs
index f4d87d7..f765328 100644
--- a/rustsystem-server/src/api/host/start_vote.rs
+++ b/rustsystem-server/src/api/host/start_vote.rs
@@ -52,20 +52,24 @@ impl APIHandler for StartVote {
         let candidates = metadata.get_candidates();
         let num_candidates = candidates.len();
 
-        // Ask trustauth to generate a BLS keypair for this round; it owns the private key.
-        let public_key = state
-            .start_round_on_trustauth(auth.muuid, &body.name)
-            .await?;
-
         let meeting = state.get_meeting(auth.muuid).await?;
 
         // Hold the vote_auth write lock for the whole check-and-start sequence to
         // prevent a concurrent start-vote from racing past the is_inactive check.
+        // The state guard is acquired BEFORE calling trustauth so that a rejected
+        // duplicate never causes trustauth to replace the active round's keypair.
         let mut vote_auth = meeting.vote_auth.write().await;
         if !vote_auth.is_inactive() {
             return Err(APIError::from_error_code(APIErrorCode::InvalidState));
         }
 
+        // Ask trustauth to generate a BLS keypair for this round; it owns the private key.
+        // Called only after confirming the server is in Idle state, so the round is
+        // created in trustauth if and only if the server will also transition to Voting.
+        let public_key = state
+            .start_round_on_trustauth(auth.muuid, &body.name)
+            .await?;
+
         // Remove unclaimed voters and mark the meeting as locked.
         // Acquiring voters.write() while holding vote_auth.write() is safe: no other
         // operation holds voters.write() and then waits for vote_auth.write().
diff --git a/rustsystem-server/src/api/login.rs b/rustsystem-server/src/api/login.rs
index 0edbaca..b5effae 100644
--- a/rustsystem-server/src/api/login.rs
+++ b/rustsystem-server/src/api/login.rs
@@ -60,8 +60,8 @@ impl APIHandler for Login {
             voter.name.clone()
         }; // voters write guard released
 
-        // Signal the invite watcher.
-        meeting.invite_auth.write().await.set_state(true);
+        // Signal the invite watcher with the voter's name.
+        meeting.invite_auth.write().await.notify_login(voter_name.clone());
 
         // Validate optional admin credentials.
         let is_host = if let Some(admin_cred) = body.admin_cred {
diff --git a/rustsystem-server/src/invite_auth.rs b/rustsystem-server/src/invite_auth.rs
index 86a5c36..e1fb62f 100644
--- a/rustsystem-server/src/invite_auth.rs
+++ b/rustsystem-server/src/invite_auth.rs
@@ -2,22 +2,22 @@ use tokio::sync::watch::{Receiver, Sender};
 use tracing::error;
 
 pub struct InviteAuthority {
-    state_tx: Sender<bool>,
+    state_tx: Sender<Option<String>>,
 }
 impl InviteAuthority {
     pub fn new() -> Self {
         Self {
-            state_tx: Sender::new(false),
+            state_tx: Sender::new(None),
         }
     }
 
-    pub fn set_state(&mut self, new_state: bool) {
-        if let Err(e) = self.state_tx.send(new_state) {
+    pub fn notify_login(&mut self, voter_name: String) {
+        if let Err(e) = self.state_tx.send(Some(voter_name)) {
             error!("{e}");
         }
     }
 
-    pub fn new_watcher(&self) -> Receiver<bool> {
+    pub fn new_watcher(&self) -> Receiver<Option<String>> {
         self.state_tx.subscribe()
     }
 }
diff --git a/rustsystem-server/src/lib.rs b/rustsystem-server/src/lib.rs
index 5877b69..ca41081 100644
--- a/rustsystem-server/src/lib.rs
+++ b/rustsystem-server/src/lib.rs
@@ -9,10 +9,11 @@ use std::{
         Arc, RwLock, RwLockReadGuard,
         atomic::{AtomicBool, Ordering},
     },
-    time::SystemTime,
+    time::{Duration, SystemTime},
 };
 use tokens::AuthUser;
 use tokio::sync::RwLock as AsyncRwLock;
+use tower_governor::{GovernorLayer, governor::GovernorConfigBuilder};
 use tower_http::services::{ServeDir, ServeFile};
 use tracing::info;
 use zkryptium::bbsplus::keys::BBSplusPublicKey;
@@ -112,6 +113,10 @@ impl AppState {
             .map_err(|_e| APIError::from_error_code(APIErrorCode::StateCurrupt))
     }
 
+    pub fn is_secure(&self) -> bool {
+        self.read().map(|g| g.is_secure).unwrap_or(false)
+    }
+
     /// Use when you need to look up or read from an existing meeting.
     /// Callers should call `.read().await` on the returned Arc.
     pub fn meetings_read(&self) -> Result<ActiveMeetings, APIError> {
@@ -201,17 +206,49 @@ pub fn new_test_state(trustauth_url: impl Into<String>) -> AppState {
 
 /// Combines public and internal routers on a single `Router`. Used by
 /// integration tests that run both services in the same process on a single port.
+/// Rate limiting is intentionally omitted here — tests don't provide `ConnectInfo`.
 pub fn app_combined(state: AppState) -> Router {
-    app_public(state.clone()).merge(app_internal(state))
+    let serve_dir = ServeDir::new("frontend/dist")
+        .not_found_service(ServeFile::new("frontend/dist/index.html"));
+    let public = Router::new()
+        .fallback_service(serve_dir)
+        .nest("/api", api_routes())
+        .with_state(state.clone());
+    public.merge(app_internal(state))
 }
 
 pub fn app_public(state: AppState) -> Router {
     let serve_dir = ServeDir::new("frontend/dist")
         .not_found_service(ServeFile::new("frontend/dist/index.html"));
 
+    // Rate limiting is only active in HTTPS (production) mode.
+    // In HTTP mode (local dev and E2E tests) it is skipped so tests can send requests freely.
+    let api = if state.is_secure() {
+        let governor_conf = Arc::new(
+            GovernorConfigBuilder::default()
+                .per_second(10)
+                .burst_size(30)
+                .finish()
+                .unwrap(),
+        );
+        // Periodically remove stale entries to prevent unbounded memory growth.
+        let limiter = governor_conf.limiter().clone();
+        tokio::spawn(async move {
+            let mut interval = tokio::time::interval(Duration::from_secs(60));
+            loop {
+                interval.tick().await;
+                limiter.retain_recent();
+            }
+        });
+        api_routes().layer(GovernorLayer::new(governor_conf))
+    } else {
+        info!("Rate limiting disabled (non-HTTPS endpoint)");
+        api_routes()
+    };
+
     Router::new()
         .fallback_service(serve_dir)
-        .nest("/api", api_routes())
+        .nest("/api", api)
         .with_state(state)
 }
 
diff --git a/rustsystem-server/src/main.rs b/rustsystem-server/src/main.rs
index 4a7fadc..3b6809f 100644
--- a/rustsystem-server/src/main.rs
+++ b/rustsystem-server/src/main.rs
@@ -30,7 +30,8 @@ async fn main() -> Result<(), APIError> {
     )
     .serve(app_internal.into_make_service());
 
-    let public_serve = axum_server::bind(addr_public).serve(app_public.into_make_service());
+    let public_serve = axum_server::bind(addr_public)
+        .serve(app_public.into_make_service_with_connect_info::<SocketAddr>());
 
     tokio::try_join!(internal_serve, public_serve)
         .map_err(|_| APIError::from_error_code(rustsystem_core::APIErrorCode::InitError))?;
diff --git a/rustsystem-trustauth/Cargo.toml b/rustsystem-trustauth/Cargo.toml
index 6bc6ab5..f1aba80 100644
--- a/rustsystem-trustauth/Cargo.toml
+++ b/rustsystem-trustauth/Cargo.toml
@@ -10,6 +10,7 @@ axum-server = { version = "0.7.2", features = ["tls-rustls"] }
 axum-extra = { version = "0.10.1", features = ["cookie"]}
 tokio = { version = "1", features = ["full"] }
 tower-http = { version = "0.6.4", features = ["fs", "trace", "set-header", "cors"] }
+tower_governor = "0.8"
 serde.workspace = true
 serde_json = "1.0.140"
 
diff --git a/rustsystem-trustauth/src/lib.rs b/rustsystem-trustauth/src/lib.rs
index 5bf070f..f4fbbe8 100644
--- a/rustsystem-trustauth/src/lib.rs
+++ b/rustsystem-trustauth/src/lib.rs
@@ -1,14 +1,15 @@
-use rustsystem_core::{APIError, APIErrorCode, mtls::build_mtls_client};
 use axum::{
     Router,
     http::{HeaderValue, Method, header},
 };
 use reqwest::{Client, Response};
+use rustsystem_core::{APIError, APIErrorCode, mtls::build_mtls_client};
 use serde::{Deserialize, Serialize};
-use std::{collections::HashMap, sync::Arc};
+use std::{collections::HashMap, sync::Arc, time::Duration};
 use tokio::sync::RwLock as AsyncRwLock;
+use tower_governor::{GovernorLayer, governor::GovernorConfigBuilder};
 use tower_http::cors::{AllowOrigin, CorsLayer};
-use tracing::error;
+use tracing::{error, info};
 use uuid::Uuid;
 use zkryptium::{keys::pair::KeyPair, schemes::algorithms::BbsBls12381Sha256};
 
@@ -35,8 +36,8 @@ pub struct VoterRegistration {
 
 /// Per-round state owned by trustauth.
 pub struct RoundState {
-    pub keys: AuthenticationKeys,    // immutable after construction — no lock
-    pub header: Vec<u8>,             // immutable after construction — no lock
+    pub keys: AuthenticationKeys, // immutable after construction — no lock
+    pub header: Vec<u8>,          // immutable after construction — no lock
     pub registered_voters: AsyncRwLock<HashMap<Uuid, VoterRegistration>>,
 }
 
@@ -185,12 +186,16 @@ pub fn new_test_state(server_url: impl Into<String>) -> AppState {
     }))
 }
 
-pub fn app_public(state: AppState) -> Result<Router, APIError> {
+fn build_cors() -> Result<CorsLayer, APIError> {
     // Allow both the canonical origin and its localhost/127.0.0.1 counterpart,
     // since browsers may use either form even when pointing at the same host.
-    let origin: HeaderValue = API_ENDPOINT_SERVER
-        .parse()
-        .map_err(|_| APIError::new(APIErrorCode::InitError, "API_ENDPOINT_SERVER is not a valid CORS origin", 500))?;
+    let origin: HeaderValue = API_ENDPOINT_SERVER.parse().map_err(|_| {
+        APIError::new(
+            APIErrorCode::InitError,
+            "API_ENDPOINT_SERVER is not a valid CORS origin",
+            500,
+        )
+    })?;
     let mut origins: Vec<HeaderValue> = vec![origin];
 
     let alt = if API_ENDPOINT_SERVER.contains("127.0.0.1") {
@@ -204,15 +209,42 @@ pub fn app_public(state: AppState) -> Result<Router, APIError> {
         origins.push(v);
     }
 
-    let cors = CorsLayer::new()
+    Ok(CorsLayer::new()
         .allow_origin(AllowOrigin::list(origins))
         .allow_methods([Method::GET, Method::POST])
         .allow_headers([header::CONTENT_TYPE])
-        .allow_credentials(true);
+        .allow_credentials(true))
+}
+
+pub fn app_public(state: AppState) -> Result<Router, APIError> {
+    // Rate limiting is only active in HTTPS (production) mode.
+    // In HTTP mode (local dev and E2E tests) it is skipped so tests can send requests freely.
+    let api = if state.is_secure() {
+        let governor_conf = Arc::new(
+            GovernorConfigBuilder::default()
+                .per_second(10)
+                .burst_size(30)
+                .finish()
+                .unwrap(),
+        );
+        // Periodically remove stale entries to prevent unbounded memory growth.
+        let limiter = governor_conf.limiter().clone();
+        tokio::spawn(async move {
+            let mut interval = tokio::time::interval(Duration::from_secs(60));
+            loop {
+                interval.tick().await;
+                limiter.retain_recent();
+            }
+        });
+        public_routes().layer(GovernorLayer::new(governor_conf))
+    } else {
+        info!("Rate limiting disabled (non-HTTPS endpoint)");
+        public_routes()
+    };
 
     Ok(Router::new()
-        .nest("/api", public_routes())
-        .layer(cors)
+        .nest("/api", api)
+        .layer(build_cors()?)
         .with_state(state))
 }
 
@@ -224,6 +256,11 @@ pub fn app_internal(state: AppState) -> Router {
 
 /// Combines public and internal routers on a single `Router`. Used by
 /// integration tests that run both services in the same process on a single port.
+/// Rate limiting is intentionally omitted here — tests don't provide `ConnectInfo`.
 pub fn app_combined(state: AppState) -> Result<Router, APIError> {
-    Ok(app_public(state.clone())?.merge(app_internal(state)))
+    let public = Router::new()
+        .nest("/api", public_routes())
+        .layer(build_cors()?)
+        .with_state(state.clone());
+    Ok(public.merge(app_internal(state)))
 }
diff --git a/rustsystem-trustauth/src/main.rs b/rustsystem-trustauth/src/main.rs
index 38a20c4..2f8fe37 100644
--- a/rustsystem-trustauth/src/main.rs
+++ b/rustsystem-trustauth/src/main.rs
@@ -27,7 +27,8 @@ async fn main() -> Result<(), APIError> {
 
     info!("Running trustauth on public={addr_public} internal={addr_internal}");
 
-    let public_serve = axum_server::bind(addr_public).serve(app_public.into_make_service());
+    let public_serve = axum_server::bind(addr_public)
+        .serve(app_public.into_make_service_with_connect_info::<SocketAddr>());
     let internal_serve = axum_server::bind_rustls(
         addr_internal,
         RustlsConfig::from_config(Arc::new(tls_config)),