diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 345677c05..c39480421 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -48,7 +48,7 @@ repos:
         exclude: "(^Pipfile\\.lock$)"
   # Python hooks
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.6.4'
+    rev: 'v0.6.5'
     hooks:
       - id: ruff
       - id: ruff-format
diff --git a/Pipfile.lock b/Pipfile.lock
index 48a9ad907..4b94f6dfe 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -3473,12 +3473,12 @@
         },
         "pytest": {
             "hashes": [
-                "sha256:4ba08f9ae7dcf84ded419494d229b48d0903ea6407b030eaec46df5e6a73bba5",
-                "sha256:c132345d12ce551242c87269de812483f5bcc87cdbb4722e48487ba194f9fdce"
+                "sha256:70b98107bd648308a7952b06e6ca9a50bc660be218d53c257cc1fc94fda10181",
+                "sha256:a6853c7375b2663155079443d2e45de913a911a11d669df02a50814944db57b2"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.8'",
-            "version": "==8.3.2"
+            "version": "==8.3.3"
         },
         "pytest-cov": {
             "hashes": [
@@ -3760,28 +3760,28 @@
         },
         "ruff": {
             "hashes": [
-                "sha256:0308610470fcc82969082fc83c76c0d362f562e2f0cdab0586516f03a4e06ec6",
-                "sha256:0b52387d3289ccd227b62102c24714ed75fbba0b16ecc69a923a37e3b5e0aaaa",
-                "sha256:0ea086601b22dc5e7693a78f3fcfc460cceabfdf3bdc36dc898792aba48fbad6",
-                "sha256:34d5efad480193c046c86608dbba2bccdc1c5fd11950fb271f8086e0c763a5d1",
-                "sha256:50e30b437cebef547bd5c3edf9ce81343e5dd7c737cb36ccb4fe83573f3d392e",
-                "sha256:549daccee5227282289390b0222d0fbee0275d1db6d514550d65420053021a58",
-                "sha256:66dbfea86b663baab8fcae56c59f190caba9398df1488164e2df53e216248baa",
-                "sha256:7862f42fc1a4aca1ea3ffe8a11f67819d183a5693b228f0bb3a531f5e40336fc",
-                "sha256:803b96dea21795a6c9d5bfa9e96127cc9c31a1987802ca68f35e5c95aed3fc0d",
-                "sha256:932063a03bac394866683e15710c25b8690ccdca1cf192b9a98260332ca93408",
-                "sha256:ac3b5bfbee99973f80aa1b7cbd1c9cbce200883bdd067300c22a6cc1c7fba212",
-                "sha256:ac4b75e898ed189b3708c9ab3fc70b79a433219e1e87193b4f2b77251d058d14",
-                "sha256:bedff9e4f004dad5f7f76a9d39c4ca98af526c9b1695068198b3bda8c085ef60",
-                "sha256:c44536df7b93a587de690e124b89bd47306fddd59398a0fb12afd6133c7b3818",
-                "sha256:c4b153fc152af51855458e79e835fb6b933032921756cec9af7d0ba2aa01a258",
-                "sha256:d02a4127a86de23002e694d7ff19f905c51e338c72d8e09b56bfb60e1681724f",
-                "sha256:eebe4ff1967c838a1a9618a5a59a3b0a00406f8d7eefee97c70411fefc353617",
-                "sha256:f0f8968feea5ce3777c0d8365653d5e91c40c31a81d95824ba61d871a11b8523"
+                "sha256:005256d977021790cc52aa23d78f06bb5090dc0bfbd42de46d49c201533982ae",
+                "sha256:09c72a833fd3551135ceddcba5ebdb68ff89225d30758027280968c9acdc7810",
+                "sha256:381413ec47f71ce1d1c614f7779d88886f406f1fd53d289c77e4e533dc6ea200",
+                "sha256:3a8d42d11fff8d3143ff4da41742a98f8f233bf8890e9fe23077826818f8d680",
+                "sha256:3e42a57b58e3612051a636bc1ac4e6b838679530235520e8f095f7c44f706ff9",
+                "sha256:482c1e6bfeb615eafc5899127b805d28e387bd87db38b2c0c41d271f5e58d8cc",
+                "sha256:4d32d87fab433c0cf285c3683dd4dae63be05fd7a1d65b3f5bf7cdd05a6b96fb",
+                "sha256:51935067740773afdf97493ba9b8231279e9beef0f2a8079188c4776c25688e0",
+                "sha256:52e75a82bbc9b42e63c08d22ad0ac525117e72aee9729a069d7c4f235fc4d276",
+                "sha256:7291e64d7129f24d1b0c947ec3ec4c0076e958d1475c61202497c6aced35dd19",
+                "sha256:794ada3400a0d0b89e3015f1a7e01f4c97320ac665b7bc3ade24b50b54cb2972",
+                "sha256:7e4e308f16e07c95fc7753fc1aaac690a323b2bb9f4ec5e844a97bb7fbebd748",
+                "sha256:800c50371bdcb99b3c1551d5691e14d16d6f07063a518770254227f7f6e8c178",
+                "sha256:8e25ddd9cd63ba1f3bd51c1f09903904a6adf8429df34f17d728a8fa11174253",
+                "sha256:932cd69eefe4daf8c7d92bd6689f7e8182571cb934ea720af218929da7bd7d69",
+                "sha256:9ad7dfbd138d09d9a7e6931e6a7e797651ce29becd688be8a0d4d5f8177b4b0c",
+                "sha256:a50af6e828ee692fb10ff2dfe53f05caecf077f4210fae9677e06a808275754f",
+                "sha256:cf4d3fa53644137f6a4a27a2b397381d16454a1566ae5335855c187fbf67e4f5"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.7'",
-            "version": "==0.6.4"
+            "version": "==0.6.5"
         },
         "scipy": {
             "hashes": [
diff --git a/docs/api.md b/docs/api.md
index 94ece85ab..057ccaedb 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -235,12 +235,6 @@ results:
 Pagination works exactly the same as it does for normal requests on this
 endpoint.
 
-Certain limitations apply to full text queries:
-
-- Results are always sorted by search score. The results matching the
-  query best will show up first.
-- Only a small subset of filtering parameters are supported.
-
 Furthermore, each returned document has an additional `__search_hit__`
 attribute with various information about the search results:
 
@@ -280,6 +274,67 @@ attribute with various information about the search results:
 - `rank` is the index of the search results. The first result will
   have rank 0.
 
+### Filtering by custom fields
+
+You can filter documents by their custom field values by specifying the
+`custom_field_lookup` query parameter. Here are some recipes for common
+use cases:
+
+1. Documents with a custom field "due" (date) between Aug 1, 2024 and
+   Sept 1, 2024 (inclusive):
+
+   `?custom_field_lookup=["due", "range", ["2024-08-01", "2024-09-01"]]`
+
+2. Documents with a custom field "customer" (text) that equals "bob"
+   (case sensitive):
+
+   `?custom_field_lookup=["customer", "exact", "bob"]`
+
+3. Documents with a custom field "answered" (boolean) set to `true`:
+
+   `?custom_field_lookup=["answered", "exact", true]`
+
+4. Documents with a custom field "favorite animal" (select) set to either
+   "cat" or "dog":
+
+   `?custom_field_lookup=["favorite animal", "in", ["cat", "dog"]]`
+
+5. Documents with a custom field "address" (text) that is empty:
+
+   `?custom_field_lookup=["OR", ["address", "isnull", true], ["address", "exact", ""]]`
+
+6. Documents that don't have a field called "foo":
+
+   `?custom_field_lookup=["foo", "exists", false]`
+
+7. Documents that have document links "references" to both document 3 and 7:
+
+   `?custom_field_lookup=["references", "contains", [3, 7]]`
+
+All field types support basic operations including `exact`, `in`, `isnull`,
+and `exists`. String, URL, and monetary fields support case-insensitive
+substring matching operations including `icontains`, `istartswith`, and
+`iendswith`. Integer, float, and date fields support arithmetic comparisons
+including `gt` (>), `gte` (>=), `lt` (<), `lte` (<=), and `range`.
+Lastly, document link fields support a `contains` operator that behaves
+like a "is superset of" check.
+
+!!! warning
+
+    It is possible to do case-insensitive exact match (i.e., `iexact`) and
+    case-sensitive substring match (i.e., `contains`, `startswith`,
+    `endswith`) for string, URL, and monetary fields, but
+    [they may not work as expected on some database backends](https://docs.djangoproject.com/en/5.1/ref/databases/#substring-matching-and-case-sensitivity).
+
+    It is also possible to use regular expressions to match string, URL, and
+    monetary fields, but the syntax is database-dependent, and accepting
+    regular expressions from untrusted sources could make your instance
+    vulnerable to regular expression denial of service attacks.
+
+    For these reasons the above expressions are disabled by default.
+    If you understand the implications, you may enable them by uncommenting
+    `PAPERLESS_CUSTOM_FIELD_LOOKUP_OPT_IN` in your configuration file.
+
 ### `/api/search/autocomplete/`
 
 Get auto completions for a partial search term.
diff --git a/docs/configuration.md b/docs/configuration.md
index 3530849dd..57edb7c72 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -608,9 +608,18 @@ You can optionally also automatically redirect users to the SSO login with [PAPE
 
 #### [`PAPERLESS_ACCOUNT_SESSION_REMEMBER=<bool>`](#PAPERLESS_ACCOUNT_SESSION_REMEMBER) {#PAPERLESS_ACCOUNT_SESSION_REMEMBER}
 
-: Only applies to regular (non-SSO) accounts. See the corresponding
+: If false, sessions will expire at browser close, if true will use `PAPERLESS_SESSION_COOKIE_AGE` for expiration. See the corresponding
 [django-allauth documentation](https://docs.allauth.org/en/latest/account/configuration.html)
 
+    Defaults to True
+
+#### [`PAPERLESS_SESSION_COOKIE_AGE=<int>`](#PAPERLESS_SESSION_COOKIE_AGE) {#PAPERLESS_SESSION_COOKIE_AGE}
+
+: Login session cookie expiration. Applies if `PAPERLESS_ACCOUNT_SESSION_REMEMBER` is enabled. See the corresponding
+[django documentation](https://docs.djangoproject.com/en/5.1/ref/settings/#std-setting-SESSION_COOKIE_AGE)
+
+    Defaults to 1209600 (2 weeks)
+
 ## OCR settings {#ocr}
 
 Paperless uses [OCRmyPDF](https://ocrmypdf.readthedocs.io/en/latest/)
diff --git a/paperless.conf.example b/paperless.conf.example
index 63ee7be22..5fabbf390 100644
--- a/paperless.conf.example
+++ b/paperless.conf.example
@@ -81,6 +81,7 @@
 #PAPERLESS_THUMBNAIL_FONT_NAME=
 #PAPERLESS_IGNORE_DATES=
 #PAPERLESS_ENABLE_UPDATE_CHECK=
+#PAPERLESS_ALLOW_CUSTOM_FIELD_LOOKUP=iexact,contains,startswith,endswith,regex,iregex
 
 # Tika settings
 
diff --git a/src-ui/messages.xlf b/src-ui/messages.xlf
index 18ba85ce4..201cb5faa 100644
--- a/src-ui/messages.xlf
+++ b/src-ui/messages.xlf
@@ -726,7 +726,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">105</context>
+          <context context-type="linenumber">137</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -1092,11 +1092,19 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">39</context>
+          <context context-type="linenumber">41</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">85</context>
+          <context context-type="linenumber">51</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">99</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">111</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -1398,7 +1406,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">69</context>
+          <context context-type="linenumber">81</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -1493,7 +1501,15 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">88</context>
+          <context context-type="linenumber">54</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">100</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">114</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -1549,7 +1565,11 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
-          <context context-type="linenumber">38</context>
+          <context context-type="linenumber">41</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
+          <context context-type="linenumber">52</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6338800642797811873" datatype="html">
@@ -1879,7 +1899,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">66</context>
+          <context context-type="linenumber">78</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -2207,7 +2227,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">173</context>
+          <context context-type="linenumber">179</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.ts</context>
@@ -2215,7 +2235,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">97</context>
+          <context context-type="linenumber">115</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1980187861066369604" datatype="html">
@@ -2402,11 +2422,19 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">36</context>
+          <context context-type="linenumber">40</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">82</context>
+          <context context-type="linenumber">48</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">98</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">108</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.html</context>
@@ -2442,7 +2470,11 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
-          <context context-type="linenumber">35</context>
+          <context context-type="linenumber">40</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
+          <context context-type="linenumber">49</context>
         </context-group>
       </trans-unit>
       <trans-unit id="9124347207158517893" datatype="html">
@@ -2546,7 +2578,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">175</context>
+          <context context-type="linenumber">181</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.ts</context>
@@ -2554,7 +2586,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">99</context>
+          <context context-type="linenumber">117</context>
         </context-group>
       </trans-unit>
       <trans-unit id="857903183180440990" datatype="html">
@@ -3062,22 +3094,6 @@
           <context context-type="sourcefile">src/app/components/common/clearable-badge/clearable-badge.component.html</context>
           <context context-type="linenumber">2</context>
         </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">38</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">59</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">104</context>
-        </context-group>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">125</context>
-        </context-group>
       </trans-unit>
       <trans-unit id="7515883357904500238" datatype="html">
         <source>Are you sure?</source>
@@ -3292,36 +3308,36 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">91</context>
+          <context context-type="linenumber">89</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6371576811194810854" datatype="html">
         <source>After</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">34</context>
+          <context context-type="linenumber">42</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">100</context>
+          <context context-type="linenumber">106</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1218334388194408974" datatype="html">
         <source>Before</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">55</context>
+          <context context-type="linenumber">62</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">121</context>
+          <context context-type="linenumber">126</context>
         </context-group>
       </trans-unit>
       <trans-unit id="231679111972850796" datatype="html">
         <source>Added</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.html</context>
-          <context context-type="linenumber">76</context>
+          <context context-type="linenumber">74</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
@@ -3340,28 +3356,28 @@
         <source>Last 7 days</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.ts</context>
-          <context context-type="linenumber">45</context>
+          <context context-type="linenumber">48</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4463380307954693363" datatype="html">
         <source>Last month</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.ts</context>
-          <context context-type="linenumber">50</context>
+          <context context-type="linenumber">53</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8697368973702409683" datatype="html">
         <source>Last 3 months</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.ts</context>
-          <context context-type="linenumber">55</context>
+          <context context-type="linenumber">58</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3566342898065860218" datatype="html">
         <source>Last year</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/dates-dropdown/dates-dropdown.component.ts</context>
-          <context context-type="linenumber">60</context>
+          <context context-type="linenumber">63</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8743659855412792665" datatype="html">
@@ -3665,7 +3681,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">68</context>
+          <context context-type="linenumber">80</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4348351765075925931" datatype="html">
@@ -4614,7 +4630,7 @@
         <source>Not assigned</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts</context>
-          <context context-type="linenumber">340</context>
+          <context context-type="linenumber">343</context>
         </context-group>
         <note priority="1" from="description">Filter drop down element to filter for documents with no correspondent/type/tag assigned</note>
       </trans-unit>
@@ -4622,7 +4638,7 @@
         <source>Open <x id="PH" equiv-text="this.title"/> filter</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts</context>
-          <context context-type="linenumber">452</context>
+          <context context-type="linenumber">455</context>
         </context-group>
       </trans-unit>
       <trans-unit id="7005745151564974365" datatype="html">
@@ -5025,6 +5041,22 @@
           <context context-type="sourcefile">src/app/components/common/system-status-dialog/system-status-dialog.component.html</context>
           <context context-type="linenumber">156</context>
         </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">101</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
+          <context context-type="linenumber">119</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
+          <context context-type="linenumber">42</context>
+        </context-group>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
+          <context context-type="linenumber">57</context>
+        </context-group>
       </trans-unit>
       <trans-unit id="595732867213154214" datatype="html">
         <source>Regenerate auth token</source>
@@ -7420,35 +7452,35 @@
         <source>No mail accounts defined.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">50</context>
+          <context context-type="linenumber">62</context>
         </context-group>
       </trans-unit>
       <trans-unit id="5364020217520256833" datatype="html">
         <source>Mail rules</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">58</context>
+          <context context-type="linenumber">70</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1372022816709469401" datatype="html">
         <source>Add Rule</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">60</context>
+          <context context-type="linenumber">72</context>
         </context-group>
       </trans-unit>
       <trans-unit id="2535466903620876415" datatype="html">
         <source>Sort Order</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">67</context>
+          <context context-type="linenumber">79</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6751234988479444294" datatype="html">
         <source>No mail rules defined.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.html</context>
-          <context context-type="linenumber">96</context>
+          <context context-type="linenumber">128</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3178554336792037159" datatype="html">
@@ -7511,56 +7543,56 @@
         <source>Saved rule &quot;<x id="PH" equiv-text="newMailRule.name"/>&quot;.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">152</context>
+          <context context-type="linenumber">151</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8951124554918814321" datatype="html">
         <source>Error saving rule.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">163</context>
+          <context context-type="linenumber">162</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3896080636020672118" datatype="html">
         <source>Confirm delete mail rule</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">171</context>
+          <context context-type="linenumber">177</context>
         </context-group>
       </trans-unit>
       <trans-unit id="2250372580580310337" datatype="html">
         <source>This operation will permanently delete this mail rule.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">172</context>
+          <context context-type="linenumber">178</context>
         </context-group>
       </trans-unit>
       <trans-unit id="9077981247971516916" datatype="html">
         <source>Deleted mail rule</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">181</context>
+          <context context-type="linenumber">187</context>
         </context-group>
       </trans-unit>
       <trans-unit id="2033194641751367552" datatype="html">
         <source>Error deleting mail rule.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">190</context>
+          <context context-type="linenumber">196</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3061362835271417984" datatype="html">
         <source>Permissions updated</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">212</context>
+          <context context-type="linenumber">218</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4639647950943944112" datatype="html">
         <source>Error updating permissions</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/mail/mail.component.ts</context>
-          <context context-type="linenumber">217</context>
+          <context context-type="linenumber">223</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/management-list/management-list.component.ts</context>
@@ -7821,49 +7853,49 @@
         <source>No workflows defined.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
-          <context context-type="linenumber">46</context>
+          <context context-type="linenumber">66</context>
         </context-group>
       </trans-unit>
       <trans-unit id="4200688335642457098" datatype="html">
         <source>Saved workflow &quot;<x id="PH" equiv-text="newWorkflow.name"/>&quot;.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">79</context>
+          <context context-type="linenumber">78</context>
         </context-group>
       </trans-unit>
       <trans-unit id="7593065565369163325" datatype="html">
         <source>Error saving workflow.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">87</context>
+          <context context-type="linenumber">86</context>
         </context-group>
       </trans-unit>
       <trans-unit id="563460864902055482" datatype="html">
         <source>Confirm delete workflow</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">95</context>
+          <context context-type="linenumber">113</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6874008462443189248" datatype="html">
         <source>This operation will permanently delete this workflow.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">96</context>
+          <context context-type="linenumber">114</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1848226135059921165" datatype="html">
         <source>Deleted workflow</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">105</context>
+          <context context-type="linenumber">123</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3177411222429626224" datatype="html">
         <source>Error deleting workflow.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.ts</context>
-          <context context-type="linenumber">110</context>
+          <context context-type="linenumber">128</context>
         </context-group>
       </trans-unit>
       <trans-unit id="2649252321173430744" datatype="html">
diff --git a/src-ui/src/app/components/app-frame/app-frame.component.scss b/src-ui/src/app/components/app-frame/app-frame.component.scss
index cdb6e3be5..f5427c713 100644
--- a/src-ui/src/app/components/app-frame/app-frame.component.scss
+++ b/src-ui/src/app/components/app-frame/app-frame.component.scss
@@ -12,6 +12,9 @@
   z-index: 995; /* Behind the navbar */
   padding: 50px 0 0; /* Height of navbar */
   box-shadow: inset -1px 0 0 rgba(0, 0, 0, .1);
+  overflow-y: auto;
+  --pngx-sidebar-width: 100%;
+  max-width: var(--pngx-sidebar-width);
 
   .sidebar-heading .spinner-border {
     width: 0.8em;
@@ -24,15 +27,15 @@
 
   // These come from the col-* classes for non-slim sidebar, needed for animation
   @media (min-width: 768px) {
-    max-width: 25%;
+    --pngx-sidebar-width: 25%;
   }
 
   @media (min-width: 992px) {
-    max-width: 16.66666667%;
+    --pngx-sidebar-width: 16.66666667%;
   }
 
   @media (min-width: 2400px) {
-    max-width: 8.33333333%;
+    --pngx-sidebar-width: 8.33333333%;
   }
 
   transition: all .2s ease;
@@ -109,12 +112,17 @@ main {
 
   .sidebar-slim-toggler {
     display: block;
-    position: absolute;
-    right: -12px;
+    position: fixed;
+    left: calc(var(--pngx-sidebar-width) - 12px);
     top: 60px;
     z-index: 996;
     --bs-btn-padding-x: 0.35rem;
     --bs-btn-padding-y: 0.125rem;
+    transition: all .2s ease;
+  }
+
+  .sidebar.slim .sidebar-slim-toggler {
+    --pngx-sidebar-width: 50px !important;
   }
 }
 
diff --git a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
index 8991363d2..dcab4606d 100644
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.html
@@ -1,4 +1,4 @@
-<div class="btn-group w-100" ngbDropdown role="group">
+<div class="btn-group w-100" ngbDropdown role="group" [popperOptions]="popperOptions">
   <button class="btn btn-sm" id="dropdown{{title}}" ngbDropdownToggle [ngClass]="createdDateBefore || createdDateAfter ? 'btn-primary' : 'btn-outline-primary'" [disabled]="disabled">
     <i-bs width="1em" height="1em" name="calendar-event-fill"></i-bs>
     <div class="d-none d-sm-inline">&nbsp;{{title}}</div>
@@ -17,7 +17,7 @@
                 }
               </div>
               <div class="d-flex justify-content-between w-100 align-items-center ps-2">
-                <div class="pe-2 pe-lg-4">
+                <div class="pe-4">
                   {{rd.name}}
                 </div>
                 <div class="text-muted small pe-2">
@@ -28,20 +28,19 @@
               </div>
             </button>
           }
-          <div class="list-group-item d-flex flex-column align-items-start" role="menuitem">
+          <div class="list-group-item d-flex p-2" role="menuitem">
 
-            <div class="mb-2 d-flex flex-row w-100 justify-content-between small">
-              <div i18n>After</div>
+            <div class="selected-icon">
               @if (createdDateAfter) {
-                <a class="btn btn-link p-0 m-0" (click)="clearCreatedAfter()">
-                  <i-bs width="1em" height="1em" name="x"></i-bs>
-                  <small i18n>Clear</small>
+                <a class="text-light focus-variants" href="javascript:void(0)" (click)="clearCreatedAfter()">
+                  <i-bs width="1em" height="1em" name="check" class="variant-unfocused"></i-bs>
+                  <i-bs width="1em" height="1em" name="x" class="variant-focused text-primary"></i-bs>
                 </a>
               }
             </div>
-
-            <div class="input-group input-group-sm">
-              <input class="form-control" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
+            <div class="input-group input-group-sm small ps-1 pe-2">
+              <span class="input-group-text w-25 small text-muted" i18n>After</span>
+              <input class="form-control small" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
                 maxlength="10" [(ngModel)]="createdDateAfter" ngbDatepicker #createdDateAfterPicker="ngbDatepicker">
               <button class="btn btn-outline-secondary" (click)="createdDateAfterPicker.toggle()" type="button">
                 <i-bs width="1em" height="1em" name="calendar"></i-bs>
@@ -49,20 +48,19 @@
             </div>
 
           </div>
-          <div class="list-group-item d-flex flex-column align-items-start" role="menuitem">
+          <div class="list-group-item d-flex p-2" role="menuitem">
 
-            <div class="mb-2 d-flex flex-row w-100 justify-content-between small">
-              <div i18n>Before</div>
+            <div class="selected-icon">
               @if (createdDateBefore) {
-                <a class="btn btn-link p-0 m-0" (click)="clearCreatedBefore()">
-                  <i-bs width="1em" height="1em" name="x"></i-bs>
-                  <small i18n>Clear</small>
+                <a class="text-light focus-variants" href="javascript:void(0)" (click)="clearCreatedBefore()">
+                  <i-bs width="1em" height="1em" name="check" class="variant-unfocused"></i-bs>
+                  <i-bs width="1em" height="1em" name="x" class="variant-focused text-primary"></i-bs>
                 </a>
               }
             </div>
-
-            <div class="input-group input-group-sm">
-              <input class="form-control" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
+            <div class="input-group input-group-sm small ps-1 pe-2">
+              <span class="input-group-text w-25 small text-muted" i18n>Before</span>
+              <input class="form-control small" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
                 maxlength="10" [(ngModel)]="createdDateBefore" ngbDatepicker #createdDateBeforePicker="ngbDatepicker">
               <button class="btn btn-outline-secondary" (click)="createdDateBeforePicker.toggle()" type="button">
                 <i-bs width="1em" height="1em" name="calendar"></i-bs>
@@ -83,7 +81,7 @@
                 }
               </div>
               <div class="d-flex justify-content-between w-100 align-items-center ps-2">
-                <div class="pe-2 pe-lg-4">
+                <div class="pe-4">
                   {{rd.name}}
                 </div>
                 <div class="text-muted small pe-2">
@@ -94,20 +92,19 @@
               </div>
             </button>
           }
-          <div class="list-group-item d-flex flex-column align-items-start" role="menuitem">
+          <div class="list-group-item d-flex p-2" role="menuitem">
 
-            <div class="mb-2 d-flex flex-row w-100 justify-content-between small">
-              <div i18n>After</div>
+            <div class="selected-icon">
               @if (addedDateAfter) {
-                <a class="btn btn-link p-0 m-0" (click)="clearAddedAfter()">
-                  <i-bs width="1em" height="1em" name="x"></i-bs>
-                  <small i18n>Clear</small>
+                <a class="text-light focus-variants" href="javascript:void(0)" (click)="clearAddedAfter()">
+                  <i-bs width="1em" height="1em" name="check" class="variant-unfocused"></i-bs>
+                  <i-bs width="1em" height="1em" name="x" class="variant-focused text-primary"></i-bs>
                 </a>
               }
             </div>
-
-            <div class="input-group input-group-sm">
-              <input class="form-control" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
+            <div class="input-group input-group-sm small ps-1 pe-2">
+              <span class="input-group-text w-25 small text-muted" i18n>After</span>
+              <input class="form-control small" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
                 maxlength="10" [(ngModel)]="addedDateAfter" ngbDatepicker #addedDateAfterPicker="ngbDatepicker">
               <button class="btn btn-outline-secondary" (click)="addedDateAfterPicker.toggle()" type="button">
                 <i-bs width="1em" height="1em" name="calendar"></i-bs>
@@ -115,20 +112,19 @@
             </div>
 
           </div>
-          <div class="list-group-item d-flex flex-column align-items-start" role="menuitem">
+          <div class="list-group-item d-flex p-2" role="menuitem">
 
-            <div class="mb-2 d-flex flex-row w-100 justify-content-between small">
-              <div i18n>Before</div>
+            <div class="selected-icon">
               @if (addedDateBefore) {
-                <a class="btn btn-link p-0 m-0" (click)="clearAddedBefore()">
-                  <i-bs width="1em" height="1em" name="x"></i-bs>
-                  <small i18n>Clear</small>
+                <a class="text-light focus-variants" href="javascript:void(0)" (click)="clearAddedBefore()">
+                  <i-bs width="1em" height="1em" name="check" class="variant-unfocused"></i-bs>
+                  <i-bs width="1em" height="1em" name="x" class="variant-focused text-primary"></i-bs>
                 </a>
               }
             </div>
-
-            <div class="input-group input-group-sm">
-              <input class="form-control" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
+            <div class="input-group input-group-sm small ps-1 pe-2">
+              <span class="input-group-text w-25 small text-muted" i18n>Before</span>
+              <input class="form-control small" [placeholder]="datePlaceHolder" (dateSelect)="onChangeDebounce()" (change)="onChangeDebounce()" (keypress)="onKeyPress($event)"
                 maxlength="10" [(ngModel)]="addedDateBefore" ngbDatepicker #addedDateBeforePicker="ngbDatepicker">
               <button class="btn btn-outline-secondary" (click)="addedDateBeforePicker.toggle()" type="button">
                 <i-bs width="1em" height="1em" name="calendar"></i-bs>
diff --git a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.scss b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.scss
index f8e09e1b2..e101a131d 100644
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.scss
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.scss
@@ -5,6 +5,12 @@
     --bs-dropdown-min-width: 40rem;
   }
 
+  @media screen and (max-width: 767px) {
+    .border-end {
+      border: none !important;
+    }
+  }
+
   .btn-link {
     line-height: 1;
   }
@@ -14,3 +20,24 @@
   min-width: 1em;
   min-height: 1em;
 }
+
+.input-group-sm {
+  .form-control {
+    font-size: 0.875rem;
+  }
+}
+
+.focus-variants {
+  .variant-focused {
+    display: none;
+  }
+
+  &:hover, &:focus {
+    .variant-unfocused {
+      display: none;
+    }
+    .variant-focused {
+      display: block;
+    }
+  }
+}
diff --git a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
index 966e9640a..21b39f0cb 100644
--- a/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
+++ b/src-ui/src/app/components/common/dates-dropdown/dates-dropdown.component.ts
@@ -11,6 +11,7 @@ import { Subject, Subscription } from 'rxjs'
 import { debounceTime } from 'rxjs/operators'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ISODateAdapter } from 'src/app/utils/ngb-iso-date-adapter'
+import { popperOptionsReenablePreventOverflow } from 'src/app/utils/popper-options'
 
 export interface DateSelection {
   createdBefore?: string
@@ -35,6 +36,8 @@ export enum RelativeDate {
   providers: [{ provide: NgbDateAdapter, useClass: ISODateAdapter }],
 })
 export class DatesDropdownComponent implements OnInit, OnDestroy {
+  public popperOptions = popperOptionsReenablePreventOverflow
+
   constructor(settings: SettingsService) {
     this.datePlaceHolder = settings.getLocalizedDateInputFormat()
   }
diff --git a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html
index 9e9a73124..413ed8d3b 100644
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html
@@ -1,4 +1,4 @@
-<div class="btn-group w-100" ngbDropdown role="group" (openChange)="dropdownOpenChange($event)" #dropdown="ngbDropdown" (keydown)="listKeyDown($event)">
+<div class="btn-group w-100" ngbDropdown role="group" (openChange)="dropdownOpenChange($event)" #dropdown="ngbDropdown" (keydown)="listKeyDown($event)" [popperOptions]="popperOptions">
   <button class="btn btn-sm" id="dropdown_{{name}}" ngbDropdownToggle [ngClass]="!editing && selectionModel.selectionSize() > 0 ? 'btn-primary' : 'btn-outline-primary'" [disabled]="disabled">
     <i-bs name="{{icon}}"></i-bs>
     <div class="d-none d-sm-inline">&nbsp;{{title}}</div>
diff --git a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
index a285144f4..d1c37bc8b 100644
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.spec.ts
@@ -539,15 +539,10 @@ describe('FilterableDropdownComponent & FilterableDropdownSelectionModel', () =>
     fixture.nativeElement
       .querySelector('button')
       .dispatchEvent(new MouseEvent('click')) // open
-    fixture.detectChanges()
     tick(100)
     component.filterText = 'FooBar'
-    fixture.detectChanges()
-    component.listFilterTextInput.nativeElement.dispatchEvent(
-      new KeyboardEvent('keyup', { key: 'Enter' })
-    )
+    component.listFilterEnter()
     expect(component.selectionModel.getSelectedItems()).toEqual([])
-    tick(300)
     expect(createSpy).toHaveBeenCalled()
   }))
 
diff --git a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
index 4a3c70953..5e39b1d2d 100644
--- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
+++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.ts
@@ -16,6 +16,7 @@ import { Subject, filter, take, takeUntil } from 'rxjs'
 import { SelectionDataItem } from 'src/app/services/rest/document.service'
 import { ObjectWithPermissions } from 'src/app/data/object-with-permissions'
 import { HotKeyService } from 'src/app/services/hot-key.service'
+import { popperOptionsReenablePreventOverflow } from 'src/app/utils/popper-options'
 
 export interface ChangedItems {
   itemsToAdd: MatchingModel[]
@@ -330,6 +331,8 @@ export class FilterableDropdownComponent implements OnDestroy, OnInit {
   @ViewChild('dropdown') dropdown: NgbDropdown
   @ViewChild('buttonItems') buttonItems: ElementRef
 
+  public popperOptions = popperOptionsReenablePreventOverflow
+
   filterText: string
 
   @Input()
@@ -483,7 +486,7 @@ export class FilterableDropdownComponent implements OnDestroy, OnInit {
   dropdownOpenChange(open: boolean): void {
     if (open) {
       setTimeout(() => {
-        this.listFilterTextInput.nativeElement.focus()
+        this.listFilterTextInput?.nativeElement.focus()
       }, 0)
       if (this.editing) {
         this.selectionModel.reset()
@@ -492,7 +495,7 @@ export class FilterableDropdownComponent implements OnDestroy, OnInit {
       this.opened.next(this)
     } else {
       if (this.creating) {
-        this.dropdown.open()
+        this.dropdown?.open()
         this.creating = false
       } else {
         this.filterText = ''
diff --git a/src-ui/src/app/components/manage/mail/mail.component.html b/src-ui/src/app/components/manage/mail/mail.component.html
index b804b0f2f..add5614c4 100644
--- a/src-ui/src/app/components/manage/mail/mail.component.html
+++ b/src-ui/src/app/components/manage/mail/mail.component.html
@@ -19,7 +19,7 @@
       <div class="row">
         <div class="col" i18n>Name</div>
         <div class="col" i18n>Server</div>
-        <div class="col" i18n>Username</div>
+        <div class="col d-none d-sm-block" i18n>Username</div>
         <div class="col" i18n>Actions</div>
       </div>
     </li>
@@ -29,9 +29,21 @@
         <div class="row">
           <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editMailAccount(account)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.MailAccount)">{{account.name}}</button></div>
           <div class="col d-flex align-items-center">{{account.imap_server}}</div>
-          <div class="col d-flex align-items-center">{{account.username}}</div>
+          <div class="col d-flex align-items-center d-none d-sm-block">{{account.username}}</div>
           <div class="col">
-            <div class="btn-group">
+            <div class="btn-group d-block d-sm-none">
+              <div ngbDropdown container="body" class="d-inline-block">
+                <button type="button" class="btn btn-link" id="actionsMenuMobile" (click)="$event.stopPropagation()" ngbDropdownToggle>
+                  <i-bs name="three-dots-vertical"></i-bs>
+                </button>
+                <div ngbDropdownMenu aria-labelledby="actionsMenuMobile">
+                  <button (click)="editMailAccount(account)" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.MailAccount }" ngbDropdownItem i18n>Edit</button>
+                  <button (click)="editPermissions(account)" *pngxIfOwner="account" ngbDropdownItem i18n>Permissions</button>
+                  <button (click)="deleteMailAccount(account)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.MailAccount }" ngbDropdownItem i18n>Delete</button>
+                </div>
+              </div>
+            </div>
+            <div class="btn-group d-none d-sm-block">
               <button *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.MailAccount }" [disabled]="!userCanEdit(account)" class="btn btn-sm btn-outline-secondary" type="button" (click)="editMailAccount(account)">
                 <i-bs width="1em" height="1em" name="pencil"></i-bs>&nbsp;<ng-container i18n>Edit</ng-container>
               </button>
@@ -64,7 +76,7 @@
     <li class="list-group-item">
       <div class="row">
         <div class="col" i18n>Name</div>
-        <div class="col" i18n>Sort Order</div>
+        <div class="col d-none d-sm-block" i18n>Sort Order</div>
         <div class="col" i18n>Account</div>
         <div class="col" i18n>Actions</div>
       </div>
@@ -74,19 +86,39 @@
       <li class="list-group-item">
         <div class="row">
           <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editMailRule(rule)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.MailRule)">{{rule.name}}</button></div>
-          <div class="col d-flex align-items-center">{{rule.order}}</div>
+          <div class="col d-flex align-items-center d-none d-sm-block">{{rule.order}}</div>
           <div class="col d-flex align-items-center">{{(mailAccountService.getCached(rule.account) | async)?.name}}</div>
           <div class="col">
-            <div class="btn-group">
-              <button *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.MailRule }" [disabled]="!userCanEdit(rule)" class="btn btn-sm btn-outline-secondary" type="button" (click)="editMailRule(rule)">
-                <i-bs width="1em" height="1em" name="pencil"></i-bs>&nbsp;<ng-container i18n>Edit</ng-container>
-              </button>
-              <button *pngxIfOwner="rule" class="btn btn-sm btn-outline-secondary" type="button" (click)="editPermissions(rule)">
-                <i-bs width="1em" height="1em" name="person-lock"></i-bs>&nbsp;<ng-container i18n>Permissions</ng-container>
-              </button>
-              <button *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.MailRule }" [disabled]="!userIsOwner(rule)" class="btn btn-sm btn-outline-danger" type="button" (click)="deleteMailRule(rule)">
-                <i-bs width="1em" height="1em" name="trash"></i-bs>&nbsp;<ng-container i18n>Delete</ng-container>
-              </button>
+            <div class="btn-group d-block d-sm-none">
+              <div ngbDropdown container="body" class="d-inline-block">
+                <button type="button" class="btn btn-link" id="actionsMenuMobile" (click)="$event.stopPropagation()" ngbDropdownToggle>
+                  <i-bs name="three-dots-vertical"></i-bs>
+                </button>
+                <div ngbDropdownMenu aria-labelledby="actionsMenuMobile">
+                  <button (click)="editMailRule(rule)" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.MailRule }" ngbDropdownItem i18n>Edit</button>
+                  <button (click)="editPermissions(rule)" *pngxIfOwner="rule" ngbDropdownItem i18n>Permissions</button>
+                  <button (click)="deleteMailRule(rule)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.MailRule }" ngbDropdownItem i18n>Delete</button>
+                  <button (click)="copyMailRule(rule)" *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.MailRule }" ngbDropdownItem i18n>Copy</button>
+                </div>
+              </div>
+            </div>
+            <div class="btn-toolbar d-none d-sm-flex gap-2" role="toolbar">
+              <div class="btn-group">
+                <button *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.MailRule }" [disabled]="!userCanEdit(rule)" class="btn btn-sm btn-outline-secondary" type="button" (click)="editMailRule(rule)">
+                  <i-bs width="1em" height="1em" name="pencil"></i-bs>&nbsp;<ng-container i18n>Edit</ng-container>
+                </button>
+                <button *pngxIfOwner="rule" class="btn btn-sm btn-outline-secondary" type="button" (click)="editPermissions(rule)">
+                  <i-bs width="1em" height="1em" name="person-lock"></i-bs>&nbsp;<ng-container i18n>Permissions</ng-container>
+                </button>
+                <button *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.MailRule }" [disabled]="!userIsOwner(rule)" class="btn btn-sm btn-outline-danger" type="button" (click)="deleteMailRule(rule)">
+                  <i-bs width="1em" height="1em" name="trash"></i-bs>&nbsp;<ng-container i18n>Delete</ng-container>
+                </button>
+              </div>
+              <div class="btn-group">
+                <button *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.MailRule }" class="btn btn-sm btn-outline-secondary" type="button" (click)="copyMailRule(rule)">
+                  <i-bs width="1em" height="1em" name="files"></i-bs>&nbsp;<ng-container i18n>Copy</ng-container>
+                </button>
+              </div>
             </div>
           </div>
         </div>
diff --git a/src-ui/src/app/components/manage/mail/mail.component.scss b/src-ui/src/app/components/manage/mail/mail.component.scss
index e69de29bb..0c1f432aa 100644
--- a/src-ui/src/app/components/manage/mail/mail.component.scss
+++ b/src-ui/src/app/components/manage/mail/mail.component.scss
@@ -0,0 +1,4 @@
+// hide caret on mobile dropdown
+.d-block.d-sm-none .dropdown-toggle::after {
+  display: none;
+}
diff --git a/src-ui/src/app/components/manage/mail/mail.component.spec.ts b/src-ui/src/app/components/manage/mail/mail.component.spec.ts
index e72b49b0f..4a134b880 100644
--- a/src-ui/src/app/components/manage/mail/mail.component.spec.ts
+++ b/src-ui/src/app/components/manage/mail/mail.component.spec.ts
@@ -226,6 +226,17 @@ describe('MailComponent', () => {
     component.editMailRule()
   })
 
+  it('should support copy mail rule', () => {
+    completeSetup()
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((refs) => (modal = refs[0]))
+    component.copyMailRule(mailRules[0] as MailRule)
+    const editDialog = modal.componentInstance as MailRuleEditDialogComponent
+    expect(editDialog.object.id).toBeNull()
+    expect(editDialog.object.name).toEqual(`${mailRules[0].name} (copy)`)
+    expect(editDialog.dialogMode).toEqual(EditDialogMode.CREATE)
+  })
+
   it('should support delete mail rule, show error if needed', () => {
     completeSetup()
     let modal: NgbModalRef
diff --git a/src-ui/src/app/components/manage/mail/mail.component.ts b/src-ui/src/app/components/manage/mail/mail.component.ts
index d8820ed38..5d00b6c13 100644
--- a/src-ui/src/app/components/manage/mail/mail.component.ts
+++ b/src-ui/src/app/components/manage/mail/mail.component.ts
@@ -137,14 +137,13 @@ export class MailComponent
     })
   }
 
-  editMailRule(rule: MailRule = null) {
+  editMailRule(rule: MailRule = null, forceCreate = false) {
     const modal = this.modalService.open(MailRuleEditDialogComponent, {
       backdrop: 'static',
       size: 'xl',
     })
-    modal.componentInstance.dialogMode = rule
-      ? EditDialogMode.EDIT
-      : EditDialogMode.CREATE
+    modal.componentInstance.dialogMode =
+      rule && !forceCreate ? EditDialogMode.EDIT : EditDialogMode.CREATE
     modal.componentInstance.object = rule
     modal.componentInstance.succeeded
       .pipe(takeUntil(this.unsubscribeNotifier))
@@ -164,6 +163,13 @@ export class MailComponent
       })
   }
 
+  copyMailRule(rule: MailRule) {
+    const clone = { ...rule }
+    clone.id = null
+    clone.name = `${rule.name} (copy)`
+    this.editMailRule(clone, true)
+  }
+
   deleteMailRule(rule: MailRule) {
     const modal = this.modalService.open(ConfirmDialogComponent, {
       backdrop: 'static',
diff --git a/src-ui/src/app/components/manage/workflows/workflows.component.html b/src-ui/src/app/components/manage/workflows/workflows.component.html
index d398b95b1..1e83efd36 100644
--- a/src-ui/src/app/components/manage/workflows/workflows.component.html
+++ b/src-ui/src/app/components/manage/workflows/workflows.component.html
@@ -15,9 +15,9 @@
   <li class="list-group-item">
     <div class="row">
       <div class="col" i18n>Name</div>
-      <div class="col" i18n>Sort order</div>
+      <div class="col d-none d-sm-block" i18n>Sort order</div>
       <div class="col" i18n>Status</div>
-      <div class="col" i18n>Triggers</div>
+      <div class="col d-none d-sm-block" i18n>Triggers</div>
       <div class="col" i18n>Actions</div>
     </div>
   </li>
@@ -26,17 +26,37 @@
     <li class="list-group-item">
       <div class="row">
         <div class="col d-flex align-items-center"><button class="btn btn-link p-0 text-start" type="button" (click)="editWorkflow(workflow)" [disabled]="!permissionsService.currentUserCan(PermissionAction.Change, PermissionType.Workflow)">{{workflow.name}}</button></div>
-        <div class="col d-flex align-items-center"><code>{{workflow.order}}</code></div>
+        <div class="col d-flex align-items-center d-none d-sm-block"><code>{{workflow.order}}</code></div>
         <div class="col d-flex align-items-center"><code> @if(workflow.enabled) { <ng-container i18n>Enabled</ng-container> } @else { <span i18n class="text-muted">Disabled</span> }</code></div>
-        <div class="col d-flex align-items-center">{{getTypesList(workflow)}}</div>
+        <div class="col d-flex align-items-center d-none d-sm-block">{{getTypesList(workflow)}}</div>
         <div class="col">
-          <div class="btn-group">
-            <button *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Workflow }" class="btn btn-sm btn-outline-secondary" type="button" (click)="editWorkflow(workflow)">
-              <i-bs width="1em" height="1em" name="pencil"></i-bs>&nbsp;<ng-container i18n>Edit</ng-container>
-            </button>
-            <button *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.Workflow }" class="btn btn-sm btn-outline-danger" type="button" (click)="deleteWorkflow(workflow)">
-              <i-bs width="1em" height="1em" name="trash"></i-bs>&nbsp;<ng-container i18n>Delete</ng-container>
-            </button>
+
+          <div class="btn-group d-block d-sm-none">
+            <div ngbDropdown container="body" class="d-inline-block">
+              <button type="button" class="btn btn-link" id="actionsMenuMobile" (click)="$event.stopPropagation()" ngbDropdownToggle>
+                <i-bs name="three-dots-vertical"></i-bs>
+              </button>
+              <div ngbDropdownMenu aria-labelledby="actionsMenuMobile">
+                <button (click)="editWorkflow(workflow)" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Workflow }" ngbDropdownItem i18n>Edit</button>
+                <button (click)="deleteWorkflow(workflow)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.Workflow }" ngbDropdownItem i18n>Delete</button>
+                <button (click)="copyWorkflow(workflow)" *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.Workflow }" ngbDropdownItem i18n>Copy</button>
+              </div>
+            </div>
+          </div>
+          <div class="btn-toolbar d-none d-sm-flex gap-2" role="toolbar">
+            <div class="btn-group">
+              <button *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.Workflow }" class="btn btn-sm btn-outline-secondary" type="button" (click)="editWorkflow(workflow)">
+                <i-bs width="1em" height="1em" name="pencil"></i-bs>&nbsp;<ng-container i18n>Edit</ng-container>
+              </button>
+              <button *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.Workflow }" class="btn btn-sm btn-outline-danger" type="button" (click)="deleteWorkflow(workflow)">
+                <i-bs width="1em" height="1em" name="trash"></i-bs>&nbsp;<ng-container i18n>Delete</ng-container>
+              </button>
+            </div>
+            <div class="btn-group">
+              <button *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.Workflow }" class="btn btn-sm btn-outline-secondary" type="button" (click)="copyWorkflow(workflow)">
+                <i-bs width="1em" height="1em" name="files"></i-bs>&nbsp;<ng-container i18n>Copy</ng-container>
+              </button>
+            </div>
           </div>
         </div>
       </div>
diff --git a/src-ui/src/app/components/manage/workflows/workflows.component.scss b/src-ui/src/app/components/manage/workflows/workflows.component.scss
index e69de29bb..0c1f432aa 100644
--- a/src-ui/src/app/components/manage/workflows/workflows.component.scss
+++ b/src-ui/src/app/components/manage/workflows/workflows.component.scss
@@ -0,0 +1,4 @@
+// hide caret on mobile dropdown
+.d-block.d-sm-none .dropdown-toggle::after {
+  display: none;
+}
diff --git a/src-ui/src/app/components/manage/workflows/workflows.component.spec.ts b/src-ui/src/app/components/manage/workflows/workflows.component.spec.ts
index 5a73b07b0..0bccbad2d 100644
--- a/src-ui/src/app/components/manage/workflows/workflows.component.spec.ts
+++ b/src-ui/src/app/components/manage/workflows/workflows.component.spec.ts
@@ -26,6 +26,7 @@ import {
 import { WorkflowActionType } from 'src/app/data/workflow-action'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
+import { EditDialogMode } from '../../common/edit-dialog/edit-dialog.component'
 
 const workflows: Workflow[] = [
   {
@@ -173,6 +174,19 @@ describe('WorkflowsComponent', () => {
     expect(reloadSpy).toHaveBeenCalled()
   })
 
+  it('should support copy', () => {
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((m) => (modal = m[m.length - 1]))
+
+    const copyButton = fixture.debugElement.queryAll(By.css('button'))[6]
+    copyButton.triggerEventHandler('click')
+
+    expect(modal).not.toBeUndefined()
+    const editDialog = modal.componentInstance as WorkflowEditDialogComponent
+    expect(editDialog.object.name).toEqual(workflows[0].name + ' (copy)')
+    expect(editDialog.dialogMode).toEqual(EditDialogMode.CREATE)
+  })
+
   it('should support delete, show notification on error / success', () => {
     let modal: NgbModalRef
     modalService.activeInstances.subscribe((m) => (modal = m[m.length - 1]))
@@ -180,7 +194,7 @@ describe('WorkflowsComponent', () => {
     const deleteSpy = jest.spyOn(workflowService, 'delete')
     const reloadSpy = jest.spyOn(component, 'reload')
 
-    const deleteButton = fixture.debugElement.queryAll(By.css('button'))[4]
+    const deleteButton = fixture.debugElement.queryAll(By.css('button'))[5]
     deleteButton.triggerEventHandler('click')
 
     expect(modal).not.toBeUndefined()
diff --git a/src-ui/src/app/components/manage/workflows/workflows.component.ts b/src-ui/src/app/components/manage/workflows/workflows.component.ts
index a80f03577..92b421e9f 100644
--- a/src-ui/src/app/components/manage/workflows/workflows.component.ts
+++ b/src-ui/src/app/components/manage/workflows/workflows.component.ts
@@ -57,14 +57,13 @@ export class WorkflowsComponent
       .join(', ')
   }
 
-  editWorkflow(workflow: Workflow) {
+  editWorkflow(workflow: Workflow, forceCreate: boolean = false) {
     const modal = this.modalService.open(WorkflowEditDialogComponent, {
       backdrop: 'static',
       size: 'xl',
     })
-    modal.componentInstance.dialogMode = workflow
-      ? EditDialogMode.EDIT
-      : EditDialogMode.CREATE
+    modal.componentInstance.dialogMode =
+      workflow && !forceCreate ? EditDialogMode.EDIT : EditDialogMode.CREATE
     if (workflow) {
       // quick "deep" clone so original doesn't get modified
       const clone = Object.assign({}, workflow)
@@ -88,6 +87,25 @@ export class WorkflowsComponent
       })
   }
 
+  copyWorkflow(workflow: Workflow) {
+    const clone = Object.assign({}, workflow)
+    clone.id = null
+    clone.name = `${workflow.name} (copy)`
+    clone.actions = [
+      ...workflow.actions.map((a) => {
+        a.id = null
+        return a
+      }),
+    ]
+    clone.triggers = [
+      ...workflow.triggers.map((t) => {
+        t.id = null
+        return t
+      }),
+    ]
+    this.editWorkflow(clone, true)
+  }
+
   deleteWorkflow(workflow: Workflow) {
     const modal = this.modalService.open(ConfirmDialogComponent, {
       backdrop: 'static',
diff --git a/src-ui/src/app/utils/popper-options.spec.ts b/src-ui/src/app/utils/popper-options.spec.ts
new file mode 100644
index 000000000..bf350f94c
--- /dev/null
+++ b/src-ui/src/app/utils/popper-options.spec.ts
@@ -0,0 +1,24 @@
+import { popperOptionsReenablePreventOverflow } from './popper-options'
+import { Options } from '@popperjs/core'
+
+describe('popperOptionsReenablePreventOverflow', () => {
+  it('should return the config without the empty fun preventOverflow, add padding to other', () => {
+    const config: Partial<Options> = {
+      modifiers: [
+        { name: 'preventOverflow', fn: function () {} },
+        {
+          name: 'preventOverflow',
+          fn: function (arg0) {
+            return
+          },
+        },
+      ],
+    }
+
+    const result = popperOptionsReenablePreventOverflow(config)
+
+    expect(result.modifiers.length).toBe(1)
+    expect(result.modifiers[0].name).toBe('preventOverflow')
+    expect(result.modifiers[0].options).toEqual({ padding: 10 })
+  })
+})
diff --git a/src-ui/src/app/utils/popper-options.ts b/src-ui/src/app/utils/popper-options.ts
new file mode 100644
index 000000000..d52a79c8c
--- /dev/null
+++ b/src-ui/src/app/utils/popper-options.ts
@@ -0,0 +1,18 @@
+import { Options } from '@popperjs/core'
+
+export function popperOptionsReenablePreventOverflow(
+  config: Partial<Options>
+): Partial<Options> {
+  config.modifiers = config.modifiers?.filter(
+    (m) => !(m.name === 'preventOverflow' && m.fn?.length === 0)
+  )
+  const ogPreventOverflowModifier = config.modifiers.find(
+    (m) => m.name === 'preventOverflow'
+  )
+  if (ogPreventOverflowModifier) {
+    ogPreventOverflowModifier.options = {
+      padding: 10,
+    }
+  }
+  return config
+}
diff --git a/src/documents/filters.py b/src/documents/filters.py
index 1770f8514..5288bd45c 100644
--- a/src/documents/filters.py
+++ b/src/documents/filters.py
@@ -1,24 +1,36 @@
+import functools
+import inspect
+import json
+import operator
+from contextlib import contextmanager
+from typing import Callable
+from typing import Union
+
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import CharField
 from django.db.models import Count
 from django.db.models import OuterRef
 from django.db.models import Q
 from django.db.models.functions import Cast
+from django.utils.translation import gettext_lazy as _
 from django_filters.rest_framework import BooleanFilter
 from django_filters.rest_framework import Filter
 from django_filters.rest_framework import FilterSet
 from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
+from rest_framework import serializers
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 
 from documents.models import Correspondent
 from documents.models import CustomField
+from documents.models import CustomFieldInstance
 from documents.models import Document
 from documents.models import DocumentType
 from documents.models import Log
 from documents.models import ShareLink
 from documents.models import StoragePath
 from documents.models import Tag
+from paperless import settings
 
 CHAR_KWARGS = ["istartswith", "iendswith", "icontains", "iexact"]
 ID_KWARGS = ["in", "exact"]
@@ -182,6 +194,488 @@ class CustomFieldsFilter(Filter):
             return qs
 
 
+class SelectField(serializers.IntegerField):
+    def __init__(self, custom_field: CustomField):
+        self._options = custom_field.extra_data["select_options"]
+        super().__init__(min_value=0, max_value=len(self._options))
+
+    def to_internal_value(self, data):
+        if not isinstance(data, int):
+            # If the supplied value is not an integer,
+            # we will try to map it to an option index.
+            try:
+                data = self._options.index(data)
+            except ValueError:
+                pass
+        return super().to_internal_value(data)
+
+
+def handle_validation_prefix(func: Callable):
+    """
+    Catch ValidationErrors raised by the wrapped function
+    and add a prefix to the exception detail to track what causes the exception,
+    similar to nested serializers.
+    """
+
+    def wrapper(*args, validation_prefix=None, **kwargs):
+        try:
+            return func(*args, **kwargs)
+        except serializers.ValidationError as e:
+            raise serializers.ValidationError({validation_prefix: e.detail})
+
+    # Update the signature to include the validation_prefix argument
+    old_sig = inspect.signature(func)
+    new_param = inspect.Parameter("validation_prefix", inspect.Parameter.KEYWORD_ONLY)
+    new_sig = old_sig.replace(parameters=[*old_sig.parameters.values(), new_param])
+
+    # Apply functools.wraps and manually set the new signature
+    functools.update_wrapper(wrapper, func)
+    wrapper.__signature__ = new_sig
+
+    return wrapper
+
+
+class CustomFieldLookupParser:
+    EXPR_BY_CATEGORY = {
+        "basic": ["exact", "in", "isnull", "exists"],
+        "string": [
+            "iexact",
+            "contains",
+            "icontains",
+            "startswith",
+            "istartswith",
+            "endswith",
+            "iendswith",
+            "regex",
+            "iregex",
+        ],
+        "arithmetic": [
+            "gt",
+            "gte",
+            "lt",
+            "lte",
+            "range",
+        ],
+        "containment": ["contains"],
+    }
+
+    # These string lookup expressions are problematic. We shall disable
+    # them by default unless the user explicitly opts in.
+    STR_EXPR_DISABLED_BY_DEFAULT = [
+        # SQLite: is case-sensitive outside the ASCII range
+        "iexact",
+        # SQLite: behaves the same as icontains
+        "contains",
+        # SQLite: behaves the same as istartswith
+        "startswith",
+        # SQLite: behaves the same as iendswith
+        "endswith",
+        # Syntax depends on database backends, can be exploited for ReDoS
+        "regex",
+        # Syntax depends on database backends, can be exploited for ReDoS
+        "iregex",
+    ]
+
+    SUPPORTED_EXPR_CATEGORIES = {
+        CustomField.FieldDataType.STRING: ("basic", "string"),
+        CustomField.FieldDataType.URL: ("basic", "string"),
+        CustomField.FieldDataType.DATE: ("basic", "arithmetic"),
+        CustomField.FieldDataType.BOOL: ("basic",),
+        CustomField.FieldDataType.INT: ("basic", "arithmetic"),
+        CustomField.FieldDataType.FLOAT: ("basic", "arithmetic"),
+        CustomField.FieldDataType.MONETARY: ("basic", "string"),
+        CustomField.FieldDataType.DOCUMENTLINK: ("basic", "containment"),
+        CustomField.FieldDataType.SELECT: ("basic",),
+    }
+
+    DATE_COMPONENTS = [
+        "year",
+        "iso_year",
+        "month",
+        "day",
+        "week",
+        "week_day",
+        "iso_week_day",
+        "quarter",
+    ]
+
+    def __init__(
+        self,
+        validation_prefix,
+        max_query_depth=10,
+        max_atom_count=20,
+    ) -> None:
+        """
+        A helper class that parses the query string into a `django.db.models.Q` for filtering
+        documents based on custom field values.
+
+        The syntax of the query expression is illustrated with the below pseudo code rules:
+        1. parse([`custom_field`, "exists", true]):
+            matches documents with Q(custom_fields__field=`custom_field`)
+        2. parse([`custom_field`, "exists", false]):
+            matches documents with ~Q(custom_fields__field=`custom_field`)
+        3. parse([`custom_field`, `op`, `value`]):
+            matches documents with
+            Q(custom_fields__field=`custom_field`, custom_fields__value_`type`__`op`= `value`)
+        4. parse(["AND", [`q0`, `q1`, ..., `qn`]])
+            -> parse(`q0`) & parse(`q1`) & ... & parse(`qn`)
+        5. parse(["OR", [`q0`, `q1`, ..., `qn`]])
+            -> parse(`q0`) | parse(`q1`) | ... | parse(`qn`)
+        6. parse(["NOT", `q`])
+            -> ~parse(`q`)
+
+        Args:
+            validation_prefix: Used to generate the ValidationError message.
+            max_query_depth: Limits the maximum nesting depth of queries.
+            max_atom_count: Limits the maximum number of atoms (i.e., rule 1, 2, 3) in the query.
+
+        `max_query_depth` and `max_atom_count` can be set to guard against generating arbitrarily
+        complex SQL queries.
+        """
+        self._custom_fields: dict[Union[int, str], CustomField] = {}
+        self._validation_prefix = validation_prefix
+        # Dummy ModelSerializer used to convert a Django models.Field to serializers.Field.
+        self._model_serializer = serializers.ModelSerializer()
+        # Used for sanity check
+        self._max_query_depth = max_query_depth
+        self._max_atom_count = max_atom_count
+        self._current_depth = 0
+        self._atom_count = 0
+        # The set of annotations that we need to apply to the queryset
+        self._annotations = {}
+
+    def parse(self, query: str) -> tuple[Q, dict[str, Count]]:
+        """
+        Parses the query string into a `django.db.models.Q`
+        and a set of annotations to be applied to the queryset.
+        """
+        try:
+            expr = json.loads(query)
+        except json.JSONDecodeError:
+            raise serializers.ValidationError(
+                {self._validation_prefix: [_("Value must be valid JSON.")]},
+            )
+        return (
+            self._parse_expr(expr, validation_prefix=self._validation_prefix),
+            self._annotations,
+        )
+
+    @handle_validation_prefix
+    def _parse_expr(self, expr) -> Q:
+        """
+        Applies rule (1, 2, 3) or (4, 5, 6) based on the length of the expr.
+        """
+        with self._track_query_depth():
+            if isinstance(expr, (list, tuple)):
+                if len(expr) == 2:
+                    return self._parse_logical_expr(*expr)
+                elif len(expr) == 3:
+                    return self._parse_atom(*expr)
+            raise serializers.ValidationError(
+                [_("Invalid custom field lookup expression")],
+            )
+
+    @handle_validation_prefix
+    def _parse_expr_list(self, exprs) -> list[Q]:
+        """
+        Handles [`q0`, `q1`, ..., `qn`] in rule 4 & 5.
+        """
+        if not isinstance(exprs, (list, tuple)) or not exprs:
+            raise serializers.ValidationError(
+                [_("Invalid expression list. Must be nonempty.")],
+            )
+        return [
+            self._parse_expr(expr, validation_prefix=i) for i, expr in enumerate(exprs)
+        ]
+
+    def _parse_logical_expr(self, op, args) -> Q:
+        """
+        Handles rule 4, 5, 6.
+        """
+        op_lower = op.lower()
+
+        if op_lower == "not":
+            return ~self._parse_expr(args, validation_prefix=1)
+
+        if op_lower == "and":
+            op_func = operator.and_
+        elif op_lower == "or":
+            op_func = operator.or_
+        else:
+            raise serializers.ValidationError(
+                {"0": [_("Invalid logical operator {op!r}").format(op=op)]},
+            )
+
+        qs = self._parse_expr_list(args, validation_prefix="1")
+        return functools.reduce(op_func, qs)
+
+    def _parse_atom(self, id_or_name, op, value) -> Q:
+        """
+        Handles rule 1, 2, 3.
+        """
+        # Guard against queries with too many conditions.
+        self._atom_count += 1
+        if self._atom_count > self._max_atom_count:
+            raise serializers.ValidationError(
+                [
+                    _(
+                        "Maximum number of query conditions exceeded. You can raise "
+                        "the limit by setting PAPERLESS_CUSTOM_FIELD_LOOKUP_MAX_ATOMS "
+                        "in your configuration file.",
+                    ),
+                ],
+            )
+
+        custom_field = self._get_custom_field(id_or_name, validation_prefix="0")
+        op = self._validate_atom_op(custom_field, op, validation_prefix="1")
+        value = self._validate_atom_value(
+            custom_field,
+            op,
+            value,
+            validation_prefix="2",
+        )
+
+        # Needed because not all DB backends support Array __contains
+        if (
+            custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK
+            and op == "contains"
+        ):
+            return self._parse_atom_doc_link_contains(custom_field, value)
+
+        value_field_name = CustomFieldInstance.get_value_field_name(
+            custom_field.data_type,
+        )
+        has_field = Q(custom_fields__field=custom_field)
+
+        # Our special exists operator.
+        if op == "exists":
+            field_filter = has_field if value else ~has_field
+        else:
+            field_filter = has_field & Q(
+                **{f"custom_fields__{value_field_name}__{op}": value},
+            )
+
+        # We need to use an annotation here because different atoms
+        # might be referring to different instances of custom fields.
+        annotation_name = f"_custom_field_filter_{len(self._annotations)}"
+        self._annotations[annotation_name] = Count("custom_fields", filter=field_filter)
+
+        return Q(**{f"{annotation_name}__gt": 0})
+
+    @handle_validation_prefix
+    def _get_custom_field(self, id_or_name):
+        """Get the CustomField instance by id or name."""
+        if id_or_name in self._custom_fields:
+            return self._custom_fields[id_or_name]
+
+        kwargs = (
+            {"id": id_or_name} if isinstance(id_or_name, int) else {"name": id_or_name}
+        )
+        try:
+            custom_field = CustomField.objects.get(**kwargs)
+        except CustomField.DoesNotExist:
+            raise serializers.ValidationError(
+                [_("{name!r} is not a valid custom field.").format(name=id_or_name)],
+            )
+        self._custom_fields[custom_field.id] = custom_field
+        self._custom_fields[custom_field.name] = custom_field
+        return custom_field
+
+    @staticmethod
+    def _split_op(full_op):
+        *prefix, op = str(full_op).rsplit("__", maxsplit=1)
+        prefix = prefix[0] if prefix else None
+        return prefix, op
+
+    @handle_validation_prefix
+    def _validate_atom_op(self, custom_field, raw_op):
+        """Check if the `op` is compatible with the type of the custom field."""
+        prefix, op = self._split_op(raw_op)
+
+        # Check if the operator is supported for the current data_type.
+        supported = False
+        for category in self.SUPPORTED_EXPR_CATEGORIES[custom_field.data_type]:
+            if (
+                category == "string"
+                and op in self.STR_EXPR_DISABLED_BY_DEFAULT
+                and op not in settings.CUSTOM_FIELD_LOOKUP_OPT_IN
+            ):
+                raise serializers.ValidationError(
+                    [
+                        _(
+                            "{expr!r} is disabled by default because it does not "
+                            "behave consistently across database backends, or can "
+                            "cause security risks. If you understand the implications "
+                            "you may enabled it by adding it to "
+                            "`PAPERLESS_CUSTOM_FIELD_LOOKUP_OPT_IN`.",
+                        ).format(expr=op),
+                    ],
+                )
+            if op in self.EXPR_BY_CATEGORY[category]:
+                supported = True
+                break
+
+        # Check prefix
+        if prefix is not None:
+            if (
+                prefix in self.DATE_COMPONENTS
+                and custom_field.data_type == CustomField.FieldDataType.DATE
+            ):
+                pass  # ok - e.g., "year__exact" for date field
+            else:
+                supported = False  # anything else is invalid
+
+        if not supported:
+            raise serializers.ValidationError(
+                [
+                    _("{data_type} does not support lookup expr {expr!r}.").format(
+                        data_type=custom_field.data_type,
+                        expr=raw_op,
+                    ),
+                ],
+            )
+
+        return raw_op
+
+    def _get_serializer_field(self, custom_field, full_op):
+        """Return a serializers.Field for value validation."""
+        prefix, op = self._split_op(full_op)
+        field = None
+
+        if op in ("isnull", "exists"):
+            # `isnull` takes either True or False regardless of the data_type.
+            field = serializers.BooleanField()
+        elif (
+            custom_field.data_type == CustomField.FieldDataType.DATE
+            and prefix in self.DATE_COMPONENTS
+        ):
+            # DateField admits lookups in the form of `year__exact`, etc. These take integers.
+            field = serializers.IntegerField()
+        elif custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
+            # We can be more specific here and make sure the value is a list.
+            field = serializers.ListField(child=serializers.IntegerField())
+        elif custom_field.data_type == CustomField.FieldDataType.SELECT:
+            # We use this custom field to permit SELECT option names.
+            field = SelectField(custom_field)
+        elif custom_field.data_type == CustomField.FieldDataType.URL:
+            # For URL fields we don't need to be strict about validation (e.g., for istartswith).
+            field = serializers.CharField()
+        else:
+            # The general case: inferred from the corresponding field in CustomFieldInstance.
+            value_field_name = CustomFieldInstance.get_value_field_name(
+                custom_field.data_type,
+            )
+            model_field = CustomFieldInstance._meta.get_field(value_field_name)
+            field_name = model_field.deconstruct()[0]
+            field_class, field_kwargs = self._model_serializer.build_standard_field(
+                field_name,
+                model_field,
+            )
+            field = field_class(**field_kwargs)
+            field.allow_null = False
+
+            # Need to set allow_blank manually because of the inconsistency in CustomFieldInstance validation.
+            # See https://github.com/paperless-ngx/paperless-ngx/issues/7361.
+            if isinstance(field, serializers.CharField):
+                field.allow_blank = True
+
+        if op == "in":
+            # `in` takes a list of values.
+            field = serializers.ListField(child=field, allow_empty=False)
+        elif op == "range":
+            # `range` takes a list of values, i.e., [start, end].
+            field = serializers.ListField(
+                child=field,
+                min_length=2,
+                max_length=2,
+            )
+
+        return field
+
+    @handle_validation_prefix
+    def _validate_atom_value(self, custom_field, op, value):
+        """Check if `value` is valid for the custom field and `op`. Returns the validated value."""
+        serializer_field = self._get_serializer_field(custom_field, op)
+        return serializer_field.run_validation(value)
+
+    def _parse_atom_doc_link_contains(self, custom_field, value) -> Q:
+        """
+        Handles document link `contains` in a way that is supported by all DB backends.
+        """
+
+        # If the value is an empty set,
+        # this is trivially true for any document with not null document links.
+        if not value:
+            return Q(
+                custom_fields__field=custom_field,
+                custom_fields__value_document_ids__isnull=False,
+            )
+
+        # First we lookup reverse links from the requested documents.
+        links = CustomFieldInstance.objects.filter(
+            document_id__in=value,
+            field__data_type=CustomField.FieldDataType.DOCUMENTLINK,
+        )
+
+        # Check if any of the requested IDs are missing.
+        missing_ids = set(value) - set(link.document_id for link in links)
+        if missing_ids:
+            # The result should be an empty set in this case.
+            return Q(id__in=[])
+
+        # Take the intersection of the reverse links - this should be what we are looking for.
+        document_ids_we_want = functools.reduce(
+            operator.and_,
+            (set(link.value_document_ids) for link in links),
+        )
+
+        return Q(id__in=document_ids_we_want)
+
+    @contextmanager
+    def _track_query_depth(self):
+        # guard against queries that are too deeply nested
+        self._current_depth += 1
+        if self._current_depth > self._max_query_depth:
+            raise serializers.ValidationError(
+                [
+                    _(
+                        "Maximum nesting depth exceeded. You can raise the limit "
+                        "by setting PAPERLESS_CUSTOM_FIELD_LOOKUP_MAX_DEPTH in "
+                        "your configuration file.",
+                    ),
+                ],
+            )
+        try:
+            yield
+        finally:
+            self._current_depth -= 1
+
+
+class CustomFieldLookupFilter(Filter):
+    def __init__(self, validation_prefix):
+        """
+        A filter that filters documents based on custom field name and value.
+
+        Args:
+            validation_prefix: Used to generate the ValidationError message.
+        """
+        super().__init__()
+        self._validation_prefix = validation_prefix
+
+    def filter(self, qs, value):
+        if not value:
+            return qs
+
+        parser = CustomFieldLookupParser(
+            self._validation_prefix,
+            max_query_depth=settings.CUSTOM_FIELD_LOOKUP_MAX_DEPTH,
+            max_atom_count=settings.CUSTOM_FIELD_LOOKUP_MAX_ATOMS,
+        )
+        q, annotations = parser.parse(value)
+
+        return qs.annotate(**annotations).filter(q)
+
+
 class DocumentFilterSet(FilterSet):
     is_tagged = BooleanFilter(
         label="Is tagged",
@@ -229,6 +723,8 @@ class DocumentFilterSet(FilterSet):
         exclude=True,
     )
 
+    custom_field_lookup = CustomFieldLookupFilter("custom_field_lookup")
+
     shared_by__id = SharedByUser()
 
     class Meta:
diff --git a/src/documents/models.py b/src/documents/models.py
index 3ee11aeba..24e8c2b26 100644
--- a/src/documents/models.py
+++ b/src/documents/models.py
@@ -857,6 +857,18 @@ class CustomFieldInstance(models.Model):
     and attached to a single Document to be metadata for it
     """
 
+    TYPE_TO_DATA_STORE_NAME_MAP = {
+        CustomField.FieldDataType.STRING: "value_text",
+        CustomField.FieldDataType.URL: "value_url",
+        CustomField.FieldDataType.DATE: "value_date",
+        CustomField.FieldDataType.BOOL: "value_bool",
+        CustomField.FieldDataType.INT: "value_int",
+        CustomField.FieldDataType.FLOAT: "value_float",
+        CustomField.FieldDataType.MONETARY: "value_monetary",
+        CustomField.FieldDataType.DOCUMENTLINK: "value_document_ids",
+        CustomField.FieldDataType.SELECT: "value_select",
+    }
+
     created = models.DateTimeField(
         _("created"),
         default=timezone.now,
@@ -923,31 +935,21 @@ class CustomFieldInstance(models.Model):
         )
         return str(self.field.name) + f" : {value}"
 
+    @classmethod
+    def get_value_field_name(cls, data_type: CustomField.FieldDataType):
+        try:
+            return cls.TYPE_TO_DATA_STORE_NAME_MAP[data_type]
+        except KeyError:  # pragma: no cover
+            raise NotImplementedError(data_type)
+
     @property
     def value(self):
         """
         Based on the data type, access the actual value the instance stores
         A little shorthand/quick way to get what is actually here
         """
-        if self.field.data_type == CustomField.FieldDataType.STRING:
-            return self.value_text
-        elif self.field.data_type == CustomField.FieldDataType.URL:
-            return self.value_url
-        elif self.field.data_type == CustomField.FieldDataType.DATE:
-            return self.value_date
-        elif self.field.data_type == CustomField.FieldDataType.BOOL:
-            return self.value_bool
-        elif self.field.data_type == CustomField.FieldDataType.INT:
-            return self.value_int
-        elif self.field.data_type == CustomField.FieldDataType.FLOAT:
-            return self.value_float
-        elif self.field.data_type == CustomField.FieldDataType.MONETARY:
-            return self.value_monetary
-        elif self.field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
-            return self.value_document_ids
-        elif self.field.data_type == CustomField.FieldDataType.SELECT:
-            return self.value_select
-        raise NotImplementedError(self.field.data_type)
+        value_field_name = self.get_value_field_name(self.field.data_type)
+        return getattr(self, value_field_name)
 
 
 if settings.AUDIT_LOG_ENABLED:
diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py
index 747d744b6..5218cbf8a 100644
--- a/src/documents/serialisers.py
+++ b/src/documents/serialisers.py
@@ -578,23 +578,14 @@ class CustomFieldInstanceSerializer(serializers.ModelSerializer):
     value = ReadWriteSerializerMethodField(allow_null=True)
 
     def create(self, validated_data):
-        type_to_data_store_name_map = {
-            CustomField.FieldDataType.STRING: "value_text",
-            CustomField.FieldDataType.URL: "value_url",
-            CustomField.FieldDataType.DATE: "value_date",
-            CustomField.FieldDataType.BOOL: "value_bool",
-            CustomField.FieldDataType.INT: "value_int",
-            CustomField.FieldDataType.FLOAT: "value_float",
-            CustomField.FieldDataType.MONETARY: "value_monetary",
-            CustomField.FieldDataType.DOCUMENTLINK: "value_document_ids",
-            CustomField.FieldDataType.SELECT: "value_select",
-        }
         # An instance is attached to a document
         document: Document = validated_data["document"]
         # And to a CustomField
         custom_field: CustomField = validated_data["field"]
         # This key must exist, as it is validated
-        data_store_name = type_to_data_store_name_map[custom_field.data_type]
+        data_store_name = CustomFieldInstance.get_value_field_name(
+            custom_field.data_type,
+        )
 
         if custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
             # prior to update so we can look for any docs that are going to be removed
diff --git a/src/documents/tests/test_api_filter_by_custom_fields.py b/src/documents/tests/test_api_filter_by_custom_fields.py
new file mode 100644
index 000000000..9ab96d068
--- /dev/null
+++ b/src/documents/tests/test_api_filter_by_custom_fields.py
@@ -0,0 +1,670 @@
+import json
+import re
+from datetime import date
+from typing import Callable
+from unittest.mock import Mock
+from urllib.parse import quote
+
+import pytest
+from django.contrib.auth.models import User
+from rest_framework.test import APITestCase
+
+from documents.models import CustomField
+from documents.models import Document
+from documents.serialisers import DocumentSerializer
+from documents.tests.utils import DirectoriesMixin
+from paperless import settings
+
+
+class DocumentWrapper:
+    """
+    Allows Pythonic access to the custom fields associated with the wrapped document.
+    """
+
+    def __init__(self, document: Document) -> None:
+        self._document = document
+
+    def __contains__(self, custom_field: str) -> bool:
+        return self._document.custom_fields.filter(field__name=custom_field).exists()
+
+    def __getitem__(self, custom_field: str):
+        return self._document.custom_fields.get(field__name=custom_field).value
+
+
+def string_expr_opted_in(op):
+    return op in settings.CUSTOM_FIELD_LOOKUP_OPT_IN
+
+
+class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
+    def setUp(self):
+        super().setUp()
+
+        self.user = User.objects.create_superuser(username="temp_admin")
+        self.client.force_authenticate(user=self.user)
+
+        # Create one custom field per type. The fields are called f"{type}_field".
+        self.custom_fields = {}
+        for data_type in CustomField.FieldDataType.values:
+            name = data_type + "_field"
+            self.custom_fields[name] = CustomField.objects.create(
+                name=name,
+                data_type=data_type,
+            )
+
+        # Add some options to the select_field
+        select = self.custom_fields["select_field"]
+        select.extra_data = {"select_options": ["A", "B", "C"]}
+        select.save()
+
+        # Now we will create some test documents
+        self.documents = []
+
+        # CustomField.FieldDataType.STRING
+        self._create_document(string_field=None)
+        self._create_document(string_field="")
+        self._create_document(string_field="paperless")
+        self._create_document(string_field="Paperless")
+        self._create_document(string_field="PAPERLESS")
+        self._create_document(string_field="pointless")
+        self._create_document(string_field="pointy")
+
+        # CustomField.FieldDataType.URL
+        self._create_document(url_field=None)
+        self._create_document(url_field="")
+        self._create_document(url_field="https://docs.paperless-ngx.com/")
+        self._create_document(url_field="https://www.django-rest-framework.org/")
+        self._create_document(url_field="http://example.com/")
+
+        # A document to check if the filter correctly associates field names with values.
+        # E.g., ["url_field", "exact", "https://docs.paperless-ngx.com/"] should not
+        # yield this document.
+        self._create_document(
+            string_field="https://docs.paperless-ngx.com/",
+            url_field="http://example.com/",
+        )
+
+        # CustomField.FieldDataType.DATE
+        self._create_document(date_field=None)
+        self._create_document(date_field=date(2023, 8, 22))
+        self._create_document(date_field=date(2024, 8, 22))
+        self._create_document(date_field=date(2024, 11, 15))
+
+        # CustomField.FieldDataType.BOOL
+        self._create_document(boolean_field=None)
+        self._create_document(boolean_field=True)
+        self._create_document(boolean_field=False)
+
+        # CustomField.FieldDataType.INT
+        self._create_document(integer_field=None)
+        self._create_document(integer_field=-1)
+        self._create_document(integer_field=0)
+        self._create_document(integer_field=1)
+
+        # CustomField.FieldDataType.FLOAT
+        self._create_document(float_field=None)
+        self._create_document(float_field=-1e9)
+        self._create_document(float_field=0.05)
+        self._create_document(float_field=270.0)
+
+        # CustomField.FieldDataType.MONETARY
+        self._create_document(monetary_field=None)
+        self._create_document(monetary_field="USD100.00")
+        self._create_document(monetary_field="USD1.00")
+        self._create_document(monetary_field="EUR50.00")
+
+        # CustomField.FieldDataType.DOCUMENTLINK
+        self._create_document(documentlink_field=None)
+        self._create_document(documentlink_field=[])
+        self._create_document(
+            documentlink_field=[
+                self.documents[0].id,
+                self.documents[1].id,
+                self.documents[2].id,
+            ],
+        )
+        self._create_document(
+            documentlink_field=[self.documents[4].id, self.documents[5].id],
+        )
+
+        # CustomField.FieldDataType.SELECT
+        self._create_document(select_field=None)
+        self._create_document(select_field=0)
+        self._create_document(select_field=1)
+        self._create_document(select_field=2)
+
+    def _create_document(self, **kwargs):
+        title = str(kwargs)
+        document = Document.objects.create(
+            title=title,
+            checksum=title,
+            archive_serial_number=len(self.documents) + 1,
+        )
+        data = {
+            "custom_fields": [
+                {"field": self.custom_fields[name].id, "value": value}
+                for name, value in kwargs.items()
+            ],
+        }
+        serializer = DocumentSerializer(
+            document,
+            data=data,
+            partial=True,
+            context={"request": Mock()},
+        )
+        serializer.is_valid(raise_exception=True)
+        serializer.save()
+        self.documents.append(document)
+        return document
+
+    def _assert_query_match_predicate(
+        self,
+        query: list,
+        reference_predicate: Callable[[DocumentWrapper], bool],
+        match_nothing_ok=False,
+    ):
+        """
+        Checks the results of the query against a callable reference predicate.
+        """
+        reference_document_ids = [
+            document.id
+            for document in self.documents
+            if reference_predicate(DocumentWrapper(document))
+        ]
+        # First sanity check our test cases
+        if not match_nothing_ok:
+            self.assertTrue(
+                reference_document_ids,
+                msg="Bad test case - should match at least one document.",
+            )
+        self.assertNotEqual(
+            len(reference_document_ids),
+            len(self.documents),
+            msg="Bad test case - should not match all documents.",
+        )
+
+        # Now make the API call.
+        query_string = quote(json.dumps(query), safe="")
+        response = self.client.get(
+            "/api/documents/?"
+            + "&".join(
+                (
+                    f"custom_field_lookup={query_string}",
+                    "ordering=archive_serial_number",
+                    "page=1",
+                    f"page_size={len(self.documents)}",
+                    "truncate_content=true",
+                ),
+            ),
+        )
+        self.assertEqual(response.status_code, 200, msg=str(response.json()))
+        response_document_ids = [
+            document["id"] for document in response.json()["results"]
+        ]
+        self.assertEqual(reference_document_ids, response_document_ids)
+
+    def _assert_validation_error(self, query: str, path: list, keyword: str):
+        """
+        Asserts that the query raises a validation error.
+        Checks the message to make sure it points to the right place.
+        """
+        query_string = quote(query, safe="")
+        response = self.client.get(
+            "/api/documents/?"
+            + "&".join(
+                (
+                    f"custom_field_lookup={query_string}",
+                    "ordering=archive_serial_number",
+                    "page=1",
+                    f"page_size={len(self.documents)}",
+                    "truncate_content=true",
+                ),
+            ),
+        )
+        self.assertEqual(response.status_code, 400)
+
+        exception_path = []
+        detail = response.json()
+        while not isinstance(detail, list):
+            path_item, detail = next(iter(detail.items()))
+            exception_path.append(path_item)
+
+        self.assertEqual(path, exception_path)
+        self.assertIn(keyword, " ".join(detail))
+
+    # ==========================================================#
+    # Sanity checks                                             #
+    # ==========================================================#
+    def test_name_value_association(self):
+        """
+        GIVEN:
+            - A document with `{"string_field": "https://docs.paperless-ngx.com/",
+              "url_field": "http://example.com/"}`
+        WHEN:
+            - Filtering by `["url_field", "exact", "https://docs.paperless-ngx.com/"]`
+        THEN:
+            - That document should not get matched.
+        """
+        self._assert_query_match_predicate(
+            ["url_field", "exact", "https://docs.paperless-ngx.com/"],
+            lambda document: "url_field" in document
+            and document["url_field"] == "https://docs.paperless-ngx.com/",
+        )
+
+    def test_filter_by_multiple_fields(self):
+        """
+        GIVEN:
+            - A document with `{"string_field": "https://docs.paperless-ngx.com/",
+              "url_field": "http://example.com/"}`
+        WHEN:
+            - Filtering by `['AND', [["string_field", "exists", True], ["url_field", "exists", True]]]`
+        THEN:
+            - That document should get matched.
+        """
+        self._assert_query_match_predicate(
+            ["AND", [["string_field", "exists", True], ["url_field", "exists", True]]],
+            lambda document: "url_field" in document and "string_field" in document,
+        )
+
+    # ==========================================================#
+    # Basic expressions supported by all custom field types     #
+    # ==========================================================#
+    def test_exact(self):
+        self._assert_query_match_predicate(
+            ["string_field", "exact", "paperless"],
+            lambda document: "string_field" in document
+            and document["string_field"] == "paperless",
+        )
+
+    def test_in(self):
+        self._assert_query_match_predicate(
+            ["string_field", "in", ["paperless", "Paperless"]],
+            lambda document: "string_field" in document
+            and document["string_field"] in ("paperless", "Paperless"),
+        )
+
+    def test_isnull(self):
+        self._assert_query_match_predicate(
+            ["string_field", "isnull", True],
+            lambda document: "string_field" in document
+            and document["string_field"] is None,
+        )
+
+    def test_exists(self):
+        self._assert_query_match_predicate(
+            ["string_field", "exists", True],
+            lambda document: "string_field" in document,
+        )
+
+    def test_select(self):
+        # For select fields, you can either specify the index
+        # or the name of the option. They function exactly the same.
+        self._assert_query_match_predicate(
+            ["select_field", "exact", 1],
+            lambda document: "select_field" in document
+            and document["select_field"] == 1,
+        )
+        # This is the same as:
+        self._assert_query_match_predicate(
+            ["select_field", "exact", "B"],
+            lambda document: "select_field" in document
+            and document["select_field"] == 1,
+        )
+
+    # ==========================================================#
+    # Expressions for string, URL, and monetary fields          #
+    # ==========================================================#
+    @pytest.mark.skipif(
+        not string_expr_opted_in("iexact"),
+        reason="iexact expr is disabled.",
+    )
+    def test_iexact(self):
+        self._assert_query_match_predicate(
+            ["string_field", "iexact", "paperless"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and document["string_field"].lower() == "paperless",
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("contains"),
+        reason="contains expr is disabled.",
+    )
+    def test_contains(self):
+        # WARNING: SQLite treats "contains" as "icontains"!
+        # You should avoid "contains" unless you know what you are doing!
+        self._assert_query_match_predicate(
+            ["string_field", "contains", "aper"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and "aper" in document["string_field"],
+        )
+
+    def test_icontains(self):
+        self._assert_query_match_predicate(
+            ["string_field", "icontains", "aper"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and "aper" in document["string_field"].lower(),
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("startswith"),
+        reason="startswith expr is disabled.",
+    )
+    def test_startswith(self):
+        # WARNING: SQLite treats "startswith" as "istartswith"!
+        # You should avoid "startswith" unless you know what you are doing!
+        self._assert_query_match_predicate(
+            ["string_field", "startswith", "paper"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and document["string_field"].startswith("paper"),
+        )
+
+    def test_istartswith(self):
+        self._assert_query_match_predicate(
+            ["string_field", "istartswith", "paper"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and document["string_field"].lower().startswith("paper"),
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("endswith"),
+        reason="endswith expr is disabled.",
+    )
+    def test_endswith(self):
+        # WARNING: SQLite treats "endswith" as "iendswith"!
+        # You should avoid "endswith" unless you know what you are doing!
+        self._assert_query_match_predicate(
+            ["string_field", "iendswith", "less"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and document["string_field"].lower().endswith("less"),
+        )
+
+    def test_iendswith(self):
+        self._assert_query_match_predicate(
+            ["string_field", "iendswith", "less"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and document["string_field"].lower().endswith("less"),
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("regex"),
+        reason="regex expr is disabled.",
+    )
+    def test_regex(self):
+        # WARNING: the regex syntax is database dependent!
+        self._assert_query_match_predicate(
+            ["string_field", "regex", r"^p.+s$"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and re.match(r"^p.+s$", document["string_field"]),
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("iregex"),
+        reason="iregex expr is disabled.",
+    )
+    def test_iregex(self):
+        # WARNING: the regex syntax is database dependent!
+        self._assert_query_match_predicate(
+            ["string_field", "iregex", r"^p.+s$"],
+            lambda document: "string_field" in document
+            and document["string_field"] is not None
+            and re.match(r"^p.+s$", document["string_field"], re.IGNORECASE),
+        )
+
+    def test_url_field_istartswith(self):
+        # URL fields supports all of the expressions above.
+        # Just showing one of them here.
+        self._assert_query_match_predicate(
+            ["url_field", "istartswith", "http://"],
+            lambda document: "url_field" in document
+            and document["url_field"] is not None
+            and document["url_field"].startswith("http://"),
+        )
+
+    @pytest.mark.skipif(
+        not string_expr_opted_in("iregex"),
+        reason="regex expr is disabled.",
+    )
+    def test_monetary_field_iregex(self):
+        # Monetary fields supports all of the expressions above.
+        # Just showing one of them here.
+        #
+        # Unfortunately we can't do arithmetic comparisons on monetary field,
+        # but you are welcome to use regex to do some of that.
+        # E.g., USD between 100.00 and 999.99:
+        self._assert_query_match_predicate(
+            ["monetary_field", "regex", r"USD[1-9][0-9]{2}\.[0-9]{2}"],
+            lambda document: "monetary_field" in document
+            and document["monetary_field"] is not None
+            and re.match(
+                r"USD[1-9][0-9]{2}\.[0-9]{2}",
+                document["monetary_field"],
+                re.IGNORECASE,
+            ),
+        )
+
+    # ==========================================================#
+    # Arithmetic comparisons                                    #
+    # ==========================================================#
+    def test_gt(self):
+        self._assert_query_match_predicate(
+            ["date_field", "gt", date(2024, 8, 22).isoformat()],
+            lambda document: "date_field" in document
+            and document["date_field"] is not None
+            and document["date_field"] > date(2024, 8, 22),
+        )
+
+    def test_gte(self):
+        self._assert_query_match_predicate(
+            ["date_field", "gte", date(2024, 8, 22).isoformat()],
+            lambda document: "date_field" in document
+            and document["date_field"] is not None
+            and document["date_field"] >= date(2024, 8, 22),
+        )
+
+    def test_lt(self):
+        self._assert_query_match_predicate(
+            ["integer_field", "lt", 0],
+            lambda document: "integer_field" in document
+            and document["integer_field"] is not None
+            and document["integer_field"] < 0,
+        )
+
+    def test_lte(self):
+        self._assert_query_match_predicate(
+            ["integer_field", "lte", 0],
+            lambda document: "integer_field" in document
+            and document["integer_field"] is not None
+            and document["integer_field"] <= 0,
+        )
+
+    def test_range(self):
+        self._assert_query_match_predicate(
+            ["float_field", "range", [-0.05, 0.05]],
+            lambda document: "float_field" in document
+            and document["float_field"] is not None
+            and -0.05 <= document["float_field"] <= 0.05,
+        )
+
+    def test_date_modifier(self):
+        # For date fields you can optionally prefix the operator
+        # with the part of the date you are comparing with.
+        self._assert_query_match_predicate(
+            ["date_field", "year__gte", 2024],
+            lambda document: "date_field" in document
+            and document["date_field"] is not None
+            and document["date_field"].year >= 2024,
+        )
+
+    # ==========================================================#
+    # Subset check (document link field only)                   #
+    # ==========================================================#
+    def test_document_link_contains(self):
+        # Document link field "contains" performs a subset check.
+        self._assert_query_match_predicate(
+            ["documentlink_field", "contains", [1, 2]],
+            lambda document: "documentlink_field" in document
+            and document["documentlink_field"] is not None
+            and set(document["documentlink_field"]) >= {1, 2},
+        )
+        # The order of IDs don't matter - this is the same as above.
+        self._assert_query_match_predicate(
+            ["documentlink_field", "contains", [2, 1]],
+            lambda document: "documentlink_field" in document
+            and document["documentlink_field"] is not None
+            and set(document["documentlink_field"]) >= {1, 2},
+        )
+
+    def test_document_link_contains_empty_set(self):
+        # An empty set is a subset of any set.
+        self._assert_query_match_predicate(
+            ["documentlink_field", "contains", []],
+            lambda document: "documentlink_field" in document
+            and document["documentlink_field"] is not None,
+        )
+
+    def test_document_link_contains_no_reverse_link(self):
+        # An edge case is that the document in the value list
+        # doesn't have a document link field and thus has no reverse link.
+        self._assert_query_match_predicate(
+            ["documentlink_field", "contains", [self.documents[6].id]],
+            lambda document: "documentlink_field" in document
+            and document["documentlink_field"] is not None
+            and set(document["documentlink_field"]) >= {self.documents[6].id},
+            match_nothing_ok=True,
+        )
+
+    # ==========================================================#
+    # Logical expressions                                       #
+    # ==========================================================#
+    def test_logical_and(self):
+        self._assert_query_match_predicate(
+            [
+                "AND",
+                [["date_field", "year__exact", 2024], ["date_field", "month__lt", 9]],
+            ],
+            lambda document: "date_field" in document
+            and document["date_field"] is not None
+            and document["date_field"].year == 2024
+            and document["date_field"].month < 9,
+        )
+
+    def test_logical_or(self):
+        # This is also the recommend way to check for "empty" text, URL, and monetary fields.
+        self._assert_query_match_predicate(
+            [
+                "OR",
+                [["string_field", "exact", ""], ["string_field", "isnull", True]],
+            ],
+            lambda document: "string_field" in document
+            and not bool(document["string_field"]),
+        )
+
+    def test_logical_not(self):
+        # This means `NOT ((document has string_field) AND (string_field iexact "paperless"))`,
+        # not `(document has string_field) AND (NOT (string_field iexact "paperless"))`!
+        self._assert_query_match_predicate(
+            [
+                "NOT",
+                ["string_field", "exact", "paperless"],
+            ],
+            lambda document: not (
+                "string_field" in document and document["string_field"] == "paperless"
+            ),
+        )
+
+    # ==========================================================#
+    # Tests for invalid queries                                 #
+    # ==========================================================#
+
+    def test_invalid_json(self):
+        self._assert_validation_error(
+            "not valid json",
+            ["custom_field_lookup"],
+            "must be valid JSON",
+        )
+
+    def test_invalid_expression(self):
+        self._assert_validation_error(
+            json.dumps("valid json but not valid expr"),
+            ["custom_field_lookup"],
+            "Invalid custom field lookup expression",
+        )
+
+    def test_invalid_custom_field_name(self):
+        self._assert_validation_error(
+            json.dumps(["invalid name", "iexact", "foo"]),
+            ["custom_field_lookup", "0"],
+            "is not a valid custom field",
+        )
+
+    def test_invalid_operator(self):
+        self._assert_validation_error(
+            json.dumps(["integer_field", "iexact", "foo"]),
+            ["custom_field_lookup", "1"],
+            "does not support lookup expr",
+        )
+
+    def test_invalid_value(self):
+        self._assert_validation_error(
+            json.dumps(["select_field", "exact", "not an option"]),
+            ["custom_field_lookup", "2"],
+            "integer",
+        )
+
+    def test_invalid_logical_operator(self):
+        self._assert_validation_error(
+            json.dumps(["invalid op", ["integer_field", "gt", 0]]),
+            ["custom_field_lookup", "0"],
+            "Invalid logical operator",
+        )
+
+    def test_invalid_expr_list(self):
+        self._assert_validation_error(
+            json.dumps(["AND", "not a list"]),
+            ["custom_field_lookup", "1"],
+            "Invalid expression list",
+        )
+
+    def test_invalid_operator_prefix(self):
+        self._assert_validation_error(
+            json.dumps(["integer_field", "foo__gt", 0]),
+            ["custom_field_lookup", "1"],
+            "does not support lookup expr",
+        )
+
+    @pytest.mark.skipif(
+        string_expr_opted_in("regex"),
+        reason="user opted into allowing regex expr",
+    )
+    def test_disabled_operator(self):
+        self._assert_validation_error(
+            json.dumps(["string_field", "regex", r"^p.+s$"]),
+            ["custom_field_lookup", "1"],
+            "disabled by default",
+        )
+
+    def test_query_too_deep(self):
+        query = ["string_field", "exact", "paperless"]
+        for _ in range(10):
+            query = ["NOT", query]
+        self._assert_validation_error(
+            json.dumps(query),
+            ["custom_field_lookup", *(["1"] * 10)],
+            "Maximum nesting depth exceeded",
+        )
+
+    def test_query_too_many_atoms(self):
+        atom = ["string_field", "exact", "paperless"]
+        query = ["AND", [atom for _ in range(21)]]
+        self._assert_validation_error(
+            json.dumps(query),
+            ["custom_field_lookup", "1", "20"],
+            "Maximum number of query conditions exceeded",
+        )
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
index ebe64ba9e..851fe6217 100644
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -472,7 +472,11 @@ ACCOUNT_EMAIL_VERIFICATION = os.getenv(
     "optional",
 )
 
-ACCOUNT_SESSION_REMEMBER = __get_boolean("PAPERLESS_ACCOUNT_SESSION_REMEMBER")
+ACCOUNT_SESSION_REMEMBER = __get_boolean("PAPERLESS_ACCOUNT_SESSION_REMEMBER", "True")
+SESSION_EXPIRE_AT_BROWSER_CLOSE = not ACCOUNT_SESSION_REMEMBER
+SESSION_COOKIE_AGE = int(
+    os.getenv("PAPERLESS_SESSION_COOKIE_AGE", 60 * 60 * 24 * 7 * 3),
+)
 
 if AUTO_LOGIN_USERNAME:
     _index = MIDDLEWARE.index("django.contrib.auth.middleware.AuthenticationMiddleware")
@@ -1188,6 +1192,23 @@ EMAIL_ENABLE_GPG_DECRYPTOR: Final[bool] = __get_boolean(
 
 
 ###############################################################################
-# Soft Delete
+# Soft Delete                                                                 #
 ###############################################################################
 EMPTY_TRASH_DELAY = max(__get_int("PAPERLESS_EMPTY_TRASH_DELAY", 30), 1)
+
+###############################################################################
+# custom_field_lookup Filter Settings                                         #
+###############################################################################
+
+CUSTOM_FIELD_LOOKUP_OPT_IN = __get_list(
+    "PAPERLESS_CUSTOM_FIELD_LOOKUP_OPT_IN",
+    default=[],
+)
+CUSTOM_FIELD_LOOKUP_MAX_DEPTH = __get_int(
+    "PAPERLESS_CUSTOM_FIELD_LOOKUP_MAX_DEPTH",
+    default=10,
+)
+CUSTOM_FIELD_LOOKUP_MAX_ATOMS = __get_int(
+    "PAPERLESS_CUSTOM_FIELD_LOOKUP_MAX_ATOMS",
+    default=20,
+)