diff --git a/apps/note-mark/1.0.3/docker-compose.yml b/apps/note-mark/1.0.3/docker-compose.yml
index 6bf7916f8..5ed5e9a03 100644
--- a/apps/note-mark/1.0.3/docker-compose.yml
+++ b/apps/note-mark/1.0.3/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   note-mark:
-    image: "ghcr.io/enchant97/note-mark:1.1.1"
+    image: "ghcr.io/enchant97/note-mark:1.0.3"
     container_name: ${CONTAINER_NAME}
     restart: unless-stopped
     networks:
diff --git a/apps/note-mark/1.1.0/docker-compose.yml b/apps/note-mark/1.1.0/docker-compose.yml
index 6bf7916f8..fbab2e1c7 100644
--- a/apps/note-mark/1.1.0/docker-compose.yml
+++ b/apps/note-mark/1.1.0/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   note-mark:
-    image: "ghcr.io/enchant97/note-mark:1.1.1"
+    image: "ghcr.io/enchant97/note-mark:1.1.0"
     container_name: ${CONTAINER_NAME}
     restart: unless-stopped
     networks:
diff --git a/apps/note-mark/1.1.1/.env.sample b/apps/note-mark/1.1.1/.env.sample
new file mode 100644
index 000000000..88b2cc9b8
--- /dev/null
+++ b/apps/note-mark/1.1.1/.env.sample
@@ -0,0 +1,13 @@
+CONTAINER_NAME=note-mark
+PANEL_APP_BIND_ADDRESS=127.0.0.1
+PANEL_APP_PORT_HTTP=8080
+NOTE_MARK_PUBLIC_URL=http://127.0.0.1:8080
+APP_DATA_DIR=./data
+NOTE_MARK_SECRET_SEED=generate
+NOTE_MARK_AUTH_SECRET=
+ENABLE_INTERNAL_SIGNUP=true
+ENABLE_INTERNAL_LOGIN=true
+ENABLE_ANONYMOUS_USER_SEARCH=true
+FILE_SIZE_LIMIT=12M
+LOGGING_LEVEL=info
+TZ=Asia/Shanghai
diff --git a/apps/note-mark/1.1.1/data.yml b/apps/note-mark/1.1.1/data.yml
new file mode 100644
index 000000000..56c4cac59
--- /dev/null
+++ b/apps/note-mark/1.1.1/data.yml
@@ -0,0 +1,223 @@
+additionalProperties:
+  formFields:
+    - default: 127.0.0.1
+      edit: true
+      envKey: PANEL_APP_BIND_ADDRESS
+      labelEn: Bind Address
+      labelZh: 绑定地址
+      label:
+        en: Bind Address
+        zh: 绑定地址
+        zh-Hant: 綁定位址
+        ja: バインドアドレス
+        ko: 바인드 주소
+        ru: Адрес привязки
+        ms: Alamat ikatan
+        pt-br: Endereco de vinculacao
+      required: true
+      type: text
+    - default: 8080
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: HTTP Port
+      labelZh: HTTP 端口
+      label:
+        en: HTTP Port
+        zh: HTTP 端口
+        zh-Hant: HTTP 連接埠
+        ja: HTTP ポート
+        ko: HTTP 포트
+        ru: HTTP-порт
+        ms: Port HTTP
+        pt-br: Porta HTTP
+      required: true
+      rule: paramPort
+      type: number
+    - default: http://127.0.0.1:8080
+      edit: true
+      envKey: NOTE_MARK_PUBLIC_URL
+      labelEn: Public URL
+      labelZh: 公开访问 URL
+      label:
+        en: Public URL
+        zh: 公开访问 URL
+        zh-Hant: 公開存取 URL
+        ja: 公開 URL
+        ko: 공개 URL
+        ru: Публичный URL
+        ms: URL awam
+        pt-br: URL publica
+      required: true
+      rule: paramExtUrl
+      type: text
+    - default: ./data
+      edit: true
+      envKey: APP_DATA_DIR
+      labelEn: Data Directory
+      labelZh: 数据目录
+      label:
+        en: Data Directory
+        zh: 数据目录
+        zh-Hant: 資料目錄
+        ja: データディレクトリ
+        ko: 데이터 디렉터리
+        ru: Каталог данных
+        ms: Direktori data
+        pt-br: Diretorio de dados
+      required: true
+      type: text
+    - default: ""
+      edit: true
+      envKey: NOTE_MARK_SECRET_SEED
+      labelEn: Authentication Secret Seed
+      labelZh: 认证密钥种子
+      label:
+        en: Authentication Secret Seed
+        zh: 认证密钥种子
+        zh-Hant: 驗證密鑰種子
+        ja: 認証シークレットシード
+        ko: 인증 비밀 시드
+        ru: Начальное значение секрета аутентификации
+        ms: Benih rahsia pengesahan
+        pt-br: Semente do segredo de autenticacao
+      random: true
+      required: true
+      rule: paramComplexity
+      type: password
+    - default: ""
+      disabled: true
+      edit: false
+      envKey: NOTE_MARK_AUTH_SECRET
+      labelEn: Authentication Secret (Derived)
+      labelZh: 认证密钥（自动派生）
+      label:
+        en: Authentication Secret (Derived)
+        zh: 认证密钥（自动派生）
+        zh-Hant: 驗證密鑰（自動衍生）
+        ja: 認証シークレット（自動導出）
+        ko: 인증 비밀 키(자동 파생)
+        ru: Секрет аутентификации (производный)
+        ms: Rahsia pengesahan (diterbitkan)
+        pt-br: Segredo de autenticacao (derivado)
+      required: false
+      type: password
+    - default: "true"
+      edit: true
+      envKey: ENABLE_INTERNAL_SIGNUP
+      labelEn: Enable Internal Signup
+      labelZh: 启用内部注册
+      label:
+        en: Enable Internal Signup
+        zh: 启用内部注册
+        zh-Hant: 啟用內部註冊
+        ja: 内部登録を有効化
+        ko: 내부 가입 활성화
+        ru: Включить внутреннюю регистрацию
+        ms: Dayakan pendaftaran dalaman
+        pt-br: Ativar cadastro interno
+      required: true
+      type: select
+      values:
+        - label: Enabled
+          value: "true"
+        - label: Disabled
+          value: "false"
+    - default: "true"
+      edit: true
+      envKey: ENABLE_INTERNAL_LOGIN
+      labelEn: Enable Internal Login
+      labelZh: 启用内部登录
+      label:
+        en: Enable Internal Login
+        zh: 启用内部登录
+        zh-Hant: 啟用內部登入
+        ja: 内部ログインを有効化
+        ko: 내부 로그인 활성화
+        ru: Включить внутренний вход
+        ms: Dayakan log masuk dalaman
+        pt-br: Ativar login interno
+      required: true
+      type: select
+      values:
+        - label: Enabled
+          value: "true"
+        - label: Disabled
+          value: "false"
+    - default: "true"
+      edit: true
+      envKey: ENABLE_ANONYMOUS_USER_SEARCH
+      labelEn: Enable Anonymous User Search
+      labelZh: 启用匿名用户搜索
+      label:
+        en: Enable Anonymous User Search
+        zh: 启用匿名用户搜索
+        zh-Hant: 啟用匿名使用者搜尋
+        ja: 匿名ユーザー検索を有効化
+        ko: 익명 사용자 검색 활성화
+        ru: Включить анонимный поиск пользователей
+        ms: Dayakan carian pengguna tanpa nama
+        pt-br: Ativar busca anonima de usuarios
+      required: true
+      type: select
+      values:
+        - label: Enabled
+          value: "true"
+        - label: Disabled
+          value: "false"
+    - default: 12M
+      edit: true
+      envKey: FILE_SIZE_LIMIT
+      labelEn: File Size Limit
+      labelZh: 文件大小限制
+      label:
+        en: File Size Limit
+        zh: 文件大小限制
+        zh-Hant: 檔案大小限制
+        ja: ファイルサイズ上限
+        ko: 파일 크기 제한
+        ru: Ограничение размера файла
+        ms: Had saiz fail
+        pt-br: Limite de tamanho de arquivo
+      required: true
+      type: text
+    - default: info
+      edit: true
+      envKey: LOGGING_LEVEL
+      labelEn: Log Level
+      labelZh: 日志级别
+      label:
+        en: Log Level
+        zh: 日志级别
+        zh-Hant: 日誌等級
+        ja: ログレベル
+        ko: 로그 수준
+        ru: Уровень журналирования
+        ms: Tahap log
+        pt-br: Nivel de log
+      required: true
+      type: select
+      values:
+        - label: Debug
+          value: debug
+        - label: Info
+          value: info
+        - label: Warn
+          value: warn
+        - label: Error
+          value: error
+    - default: Asia/Shanghai
+      edit: true
+      envKey: TZ
+      labelEn: Time Zone
+      labelZh: 时区
+      label:
+        en: Time Zone
+        zh: 时区
+        zh-Hant: 時區
+        ja: タイムゾーン
+        ko: 시간대
+        ru: Часовой пояс
+        ms: Zon waktu
+        pt-br: Fuso horario
+      required: true
+      type: text
diff --git a/apps/note-mark/1.1.1/docker-compose.yml b/apps/note-mark/1.1.1/docker-compose.yml
new file mode 100644
index 000000000..6bf7916f8
--- /dev/null
+++ b/apps/note-mark/1.1.1/docker-compose.yml
@@ -0,0 +1,37 @@
+services:
+  note-mark:
+    image: "ghcr.io/enchant97/note-mark:1.1.1"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    networks:
+      - 1panel-network
+    ports:
+      - "${PANEL_APP_BIND_ADDRESS}:${PANEL_APP_PORT_HTTP}:8080"
+    environment:
+      - AUTH_TOKEN__SECRET=${NOTE_MARK_AUTH_SECRET}
+      - PUBLIC_URL=${NOTE_MARK_PUBLIC_URL}
+      - DATA_PATH=/data
+      - BIND__HOST=0.0.0.0
+      - BIND__PORT=8080
+      - ENABLE_INTERNAL_SIGNUP=${ENABLE_INTERNAL_SIGNUP}
+      - ENABLE_INTERNAL_LOGIN=${ENABLE_INTERNAL_LOGIN}
+      - ENABLE_ANONYMOUS_USER_SEARCH=${ENABLE_ANONYMOUS_USER_SEARCH}
+      - FILE_SIZE_LIMIT=${FILE_SIZE_LIMIT}
+      - LOGGING__LEVEL=${LOGGING_LEVEL}
+      - LOGGING__ENABLE_JSON=true
+      - TZ=${TZ}
+    volumes:
+      - "${APP_DATA_DIR}:/data"
+    read_only: true
+    tmpfs:
+      - /tmp:rw,nosuid,nodev,noexec,size=32m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
diff --git a/apps/note-mark/1.1.1/scripts/init.sh b/apps/note-mark/1.1.1/scripts/init.sh
new file mode 100755
index 000000000..5c5983d65
--- /dev/null
+++ b/apps/note-mark/1.1.1/scripts/init.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+APP_ROOT_DIR="$(dirname "$ROOT_DIR")"
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+strip_matching_quotes() {
+  local value="$1"
+
+  if [[ ${#value} -ge 2 ]]; then
+    if [[ "${value:0:1}" == '"' && "${value: -1}" == '"' ]]; then
+      value="${value:1:${#value}-2}"
+    elif [[ "${value:0:1}" == "'" && "${value: -1}" == "'" ]]; then
+      value="${value:1:${#value}-2}"
+    fi
+  fi
+  printf '%s\n' "$value"
+}
+
+read_env_value() {
+  local key="$1"
+  local value=""
+
+  if [[ -f "$ENV_FILE" ]]; then
+    value="$(grep -E "^${key}=" "$ENV_FILE" | tail -n 1 | cut -d '=' -f 2- || true)"
+  fi
+  value="${value%$'\r'}"
+  strip_matching_quotes "$value"
+}
+
+set_env_value() {
+  local key="$1"
+  local value="$2"
+  local temp_file
+
+  temp_file="$(mktemp "${ENV_FILE}.tmp.XXXXXX")"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { updated = 0 }
+    $0 ~ ("^" key "=") {
+      if (!updated) {
+        print key "=" value
+        updated = 1
+      }
+      next
+    }
+    { print }
+    END {
+      if (!updated) print key "=" value
+    }
+  ' "$ENV_FILE" >"$temp_file"
+  chmod 600 "$temp_file"
+  mv -f -- "$temp_file" "$ENV_FILE"
+}
+
+path_is_dotenv_safe() {
+  local value="$1"
+
+  case "$value" in
+    *$'\n'* | *$'\r'* | *\\* | *'$'* | *'#'* | *'"'* | *"'"*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+seed_is_safe() {
+  [[ ${#1} -ge 32 && "$1" =~ ^[A-Za-z0-9._~-]+$ ]]
+}
+
+generate_seed() {
+  od -An -N 32 -tx1 /dev/urandom | tr -d ' \n'
+}
+
+[[ -f "$ENV_FILE" ]] || fail "Environment file not found: ${ENV_FILE}"
+chmod 600 "$ENV_FILE"
+
+if [[ ${APP_DATA_DIR+x} ]]; then
+  DATA_DIR_RAW="$APP_DATA_DIR"
+else
+  DATA_DIR_RAW="$(read_env_value APP_DATA_DIR)"
+fi
+DATA_DIR_RAW="$(strip_matching_quotes "${DATA_DIR_RAW:-./data}")"
+
+[[ -n "$DATA_DIR_RAW" ]] || fail "APP_DATA_DIR must not be empty"
+path_is_dotenv_safe "$DATA_DIR_RAW" || fail "APP_DATA_DIR contains unsupported dotenv characters"
+
+if [[ "$DATA_DIR_RAW" = /* ]]; then
+  [[ ! -L "$DATA_DIR_RAW" ]] || fail "APP_DATA_DIR must not be a symbolic link"
+  DATA_DIR_ABS="$(realpath -m -- "$DATA_DIR_RAW")"
+  [[ "$DATA_DIR_ABS" != "/" ]] || fail "APP_DATA_DIR must not be the filesystem root"
+else
+  CONTAINER_NAME_VALUE="$(read_env_value CONTAINER_NAME)"
+  [[ "$CONTAINER_NAME_VALUE" =~ ^[A-Za-z0-9._-]+$ ]] || \
+    fail "CONTAINER_NAME contains unsupported characters"
+
+  RETAINED_ROOT="${APP_ROOT_DIR}/retained-data"
+  [[ ! -L "$RETAINED_ROOT" ]] || fail "The retained data root must not be a symbolic link"
+  RETAINED_INSTANCE_ROOT="${RETAINED_ROOT}/${CONTAINER_NAME_VALUE}"
+  DATA_DIR_PATH="${RETAINED_INSTANCE_ROOT}/${DATA_DIR_RAW#./}"
+  [[ ! -L "$DATA_DIR_PATH" ]] || fail "APP_DATA_DIR must not be a symbolic link"
+  RETAINED_INSTANCE_ABS="$(realpath -m -- "$RETAINED_INSTANCE_ROOT")"
+  DATA_DIR_ABS="$(realpath -m -- "$DATA_DIR_PATH")"
+  case "$DATA_DIR_ABS" in
+    "${RETAINED_INSTANCE_ABS}"/*) ;;
+    *) fail "Relative APP_DATA_DIR must remain inside the isolated retained-data directory" ;;
+  esac
+
+  set_env_value APP_DATA_DIR "\"${DATA_DIR_ABS}\""
+fi
+
+if [[ -e "$DATA_DIR_ABS" && ! -d "$DATA_DIR_ABS" ]]; then
+  fail "APP_DATA_DIR must be a directory"
+fi
+if [[ ! -e "$DATA_DIR_ABS" ]]; then
+  install -d -m 0750 -- "$DATA_DIR_ABS"
+fi
+
+PUBLIC_URL="$(read_env_value NOTE_MARK_PUBLIC_URL)"
+[[ "$PUBLIC_URL" =~ ^https?://[A-Za-z0-9._~:/?%\&=+@-]+$ ]] || \
+  fail "NOTE_MARK_PUBLIC_URL must be a complete HTTP or HTTPS URL"
+[[ "$PUBLIC_URL" != */ ]] || fail "NOTE_MARK_PUBLIC_URL must not end in a trailing slash"
+
+for key in ENABLE_INTERNAL_SIGNUP ENABLE_INTERNAL_LOGIN ENABLE_ANONYMOUS_USER_SEARCH; do
+  value="$(read_env_value "$key")"
+  [[ "$value" == "true" || "$value" == "false" ]] || fail "${key} must be true or false"
+done
+
+FILE_LIMIT="$(read_env_value FILE_SIZE_LIMIT)"
+[[ "$FILE_LIMIT" =~ ^[1-9][0-9]*(B|K|KB|M|MB|G|GB)?$ ]] || \
+  fail "FILE_SIZE_LIMIT must be a positive byte-size value such as 12M"
+
+LOG_LEVEL="$(read_env_value LOGGING_LEVEL)"
+case "$LOG_LEVEL" in
+  debug | info | warn | warning | error) ;;
+  *) fail "LOGGING_LEVEL must be debug, info, warn, warning, or error" ;;
+esac
+
+TIME_ZONE="$(read_env_value TZ)"
+[[ "$TIME_ZONE" =~ ^[A-Za-z0-9_+./-]+$ ]] || fail "TZ contains unsupported characters"
+
+SECRET_SEED="$(read_env_value NOTE_MARK_SECRET_SEED)"
+if ! seed_is_safe "$SECRET_SEED"; then
+  printf '%s\n' 'NOTE_MARK_SECRET_SEED is missing, too short, or not dotenv-safe; replacing it with a generated value.' >&2
+  SECRET_SEED="$(generate_seed)"
+  set_env_value NOTE_MARK_SECRET_SEED "$SECRET_SEED"
+fi
+
+SECRET_DIGEST="$(printf '%s' "$SECRET_SEED" | sha256sum | awk '{print $1}')"
+AUTH_SECRET="$(printf '%s' "$SECRET_DIGEST" | base64 | tr -d '\n')"
+[[ "$(printf '%s' "$AUTH_SECRET" | base64 -d | wc -c)" -ge 32 ]] || \
+  fail "Failed to derive a valid authentication secret"
+set_env_value NOTE_MARK_AUTH_SECRET "$AUTH_SECRET"
diff --git a/apps/note-mark/1.1.1/scripts/uninstall.sh b/apps/note-mark/1.1.1/scripts/uninstall.sh
new file mode 100755
index 000000000..f39b2801c
--- /dev/null
+++ b/apps/note-mark/1.1.1/scripts/uninstall.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Persistent Note Mark data is intentionally retained for backup or reinstall.
+exit 0
diff --git a/apps/note-mark/1.1.1/scripts/upgrade.sh b/apps/note-mark/1.1.1/scripts/upgrade.sh
new file mode 100755
index 000000000..5ec28d784
--- /dev/null
+++ b/apps/note-mark/1.1.1/scripts/upgrade.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec "$SCRIPT_DIR/init.sh"