diff --git a/BFF/v4/Angular/Angular.Bff/Program.cs b/BFF/v4/Angular/Angular.Bff/Program.cs
index 163c455f..ea88609a 100644
--- a/BFF/v4/Angular/Angular.Bff/Program.cs
+++ b/BFF/v4/Angular/Angular.Bff/Program.cs
@@ -5,6 +5,7 @@
 using Duende.Bff;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -49,6 +50,11 @@
 
 builder.Services.AddAuthorization();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/BlazorAutoRendering/BlazorAutoRendering/Program.cs b/BFF/v4/BlazorAutoRendering/BlazorAutoRendering/Program.cs
index 9acf347c..f59011a3 100644
--- a/BFF/v4/BlazorAutoRendering/BlazorAutoRendering/Program.cs
+++ b/BFF/v4/BlazorAutoRendering/BlazorAutoRendering/Program.cs
@@ -9,6 +9,7 @@
 using Duende.Bff.Blazor;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 // Add services to the container.
@@ -66,6 +67,11 @@
 
 builder.Services.AddAuthorization();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 // Configure the HTTP request pipeline.
diff --git a/BFF/v4/BlazorWasm/BFF/Program.cs b/BFF/v4/BlazorWasm/BFF/Program.cs
index 2578e3b9..9c89ce5a 100644
--- a/BFF/v4/BlazorWasm/BFF/Program.cs
+++ b/BFF/v4/BlazorWasm/BFF/Program.cs
@@ -1,6 +1,7 @@
 using Duende.Bff;
 using Duende.Bff.Yarp;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -38,6 +39,11 @@
         options.Cookie.SameSite = SameSiteMode.Strict;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseAuthentication();
diff --git a/BFF/v4/DPoP/DPoP.Bff/Program.cs b/BFF/v4/DPoP/DPoP.Bff/Program.cs
index f7ae9cf2..88966d2c 100644
--- a/BFF/v4/DPoP/DPoP.Bff/Program.cs
+++ b/BFF/v4/DPoP/DPoP.Bff/Program.cs
@@ -8,6 +8,7 @@
 using Duende.Bff.AccessTokenManagement;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 using Serilog.Events;
@@ -91,6 +92,11 @@
     options.DefaultSignOutScheme = BffAuthenticationSchemes.BffOpenIdConnect;
 });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 builder.Services.AddUserAccessTokenHttpClient("api",
     configureClient: client =>
     {
diff --git a/BFF/v4/JsBffSample/FrontendHost/Program.cs b/BFF/v4/JsBffSample/FrontendHost/Program.cs
index a305978d..d70eeed1 100644
--- a/BFF/v4/JsBffSample/FrontendHost/Program.cs
+++ b/BFF/v4/JsBffSample/FrontendHost/Program.cs
@@ -5,6 +5,7 @@
 using Duende.Bff;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -56,6 +57,11 @@
     client.BaseAddress = new Uri("https://localhost:5002/");
 });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/JsBffYarpSample/FrontendHost/Program.cs b/BFF/v4/JsBffYarpSample/FrontendHost/Program.cs
index cdb3f2f0..d7724b7a 100644
--- a/BFF/v4/JsBffYarpSample/FrontendHost/Program.cs
+++ b/BFF/v4/JsBffYarpSample/FrontendHost/Program.cs
@@ -5,6 +5,7 @@
 using Duende.Bff;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -59,6 +60,11 @@
     options.DefaultSignOutScheme = BffAuthenticationSchemes.BffOpenIdConnect;
 });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/HostingExtensions.cs b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/HostingExtensions.cs
index 224f946b..f0b49997 100644
--- a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/HostingExtensions.cs
+++ b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/HostingExtensions.cs
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 using IdentityServer;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 namespace MultiFrontendSSO.IdentityServer;
@@ -33,6 +34,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         builder.Services
             .AddAuthentication();
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("BFF");
+
         return builder.Build();
     }
 
diff --git a/BFF/v4/OpenApi/OpenApi.Bff/Program.cs b/BFF/v4/OpenApi/OpenApi.Bff/Program.cs
index 36fb9cc8..21b5f8ac 100644
--- a/BFF/v4/OpenApi/OpenApi.Bff/Program.cs
+++ b/BFF/v4/OpenApi/OpenApi.Bff/Program.cs
@@ -1,6 +1,7 @@
 using Duende.Bff;
 using Duende.Bff.AccessTokenManagement;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 using OpenApi.Bff;
 using OpenApi.Bff.OpenApi;
 
@@ -13,6 +14,11 @@
     .AddRemoteApis()
     .LoadConfiguration(bffConfig);
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 // Make sure Yarp understands aspire's service discovery.
 builder.Services.AddHttpForwarderWithServiceDiscovery();
 
diff --git a/BFF/v4/Quickstarts/BlazorBffApp/BlazorBffApp/Program.cs b/BFF/v4/Quickstarts/BlazorBffApp/BlazorBffApp/Program.cs
index 889eccb4..438f5c6a 100644
--- a/BFF/v4/Quickstarts/BlazorBffApp/BlazorBffApp/Program.cs
+++ b/BFF/v4/Quickstarts/BlazorBffApp/BlazorBffApp/Program.cs
@@ -5,6 +5,7 @@
 using Duende.Bff;
 using Duende.Bff.Blazor;
 using Duende.Bff.DynamicFrontends;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -57,6 +58,11 @@
 
 builder.Services.AddAuthorization();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 // Register a server abstraction.
 builder.Services.AddSingleton<IWeatherClient, ServerWeatherClient>();
 
diff --git a/BFF/v4/React/React.Bff/Program.cs b/BFF/v4/React/React.Bff/Program.cs
index 46bd1b61..d4542fec 100644
--- a/BFF/v4/React/React.Bff/Program.cs
+++ b/BFF/v4/React/React.Bff/Program.cs
@@ -4,6 +4,7 @@
 using Duende.Bff;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 using React.Bff;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -43,6 +44,11 @@
 
 builder.Services.AddAuthorization();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/SplitHosts/BackendHost/Program.cs b/BFF/v4/SplitHosts/BackendHost/Program.cs
index fc7d21d7..425d126f 100644
--- a/BFF/v4/SplitHosts/BackendHost/Program.cs
+++ b/BFF/v4/SplitHosts/BackendHost/Program.cs
@@ -7,6 +7,7 @@
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Endpoints;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -63,6 +64,11 @@
     client.BaseAddress = new Uri("https://localhost:5002/");
 });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/Vue/Vue.Bff/Program.cs b/BFF/v4/Vue/Vue.Bff/Program.cs
index 35d675e8..6906823e 100644
--- a/BFF/v4/Vue/Vue.Bff/Program.cs
+++ b/BFF/v4/Vue/Vue.Bff/Program.cs
@@ -1,6 +1,7 @@
 using Duende.Bff;
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
+using Microsoft.AspNetCore.DataProtection;
 using Vue.Api;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -39,6 +40,11 @@
 
 builder.Services.AddAuthorization();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 app.UseDefaultFiles();
diff --git a/BFF/v4/docker/FrontendHost/Program.cs b/BFF/v4/docker/FrontendHost/Program.cs
index 6a83816b..6d1b1a2b 100644
--- a/BFF/v4/docker/FrontendHost/Program.cs
+++ b/BFF/v4/docker/FrontendHost/Program.cs
@@ -6,6 +6,7 @@
 using Duende.Bff.DynamicFrontends;
 using Duende.Bff.Yarp;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Microsoft.IdentityModel.Logging;
 
@@ -84,6 +85,11 @@
     IdentityModelEventSource.ShowPII = true;
 }
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("BFF");
+
 var app = builder.Build();
 
 // --- Middleware Pipeline ---
diff --git a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
index 37e36c30..fc960cb8 100644
--- a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
+++ b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
@@ -6,6 +6,7 @@
 using IdentityServerAspNetIdentityPasskeys.Data;
 using IdentityServerAspNetIdentityPasskeys.Models;
 using IdentityServerAspNetIdentityPasskeys.Passkeys;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
@@ -115,6 +116,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Configuration/IdentityServerHost/HostingExtensions.cs b/IdentityServer/v7/Configuration/IdentityServerHost/HostingExtensions.cs
index a1085980..5031bdbc 100644
--- a/IdentityServer/v7/Configuration/IdentityServerHost/HostingExtensions.cs
+++ b/IdentityServer/v7/Configuration/IdentityServerHost/HostingExtensions.cs
@@ -5,6 +5,7 @@
 using IdentityServer.Pages.Admin.ApiScopes;
 using IdentityServer.Pages.Admin.Clients;
 using IdentityServer.Pages.Admin.IdentityScopes;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
@@ -94,6 +95,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         //builder.Services.Configure<RazorPagesOptions>(options =>
         //    options.Conventions.AuthorizeFolder("/ServerSideSessions", "admin"));
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/IdentityServerHost/src/HostingExtensions.cs b/IdentityServer/v7/IdentityServerHost/src/HostingExtensions.cs
index 339769d5..5a831160 100644
--- a/IdentityServer/v7/IdentityServerHost/src/HostingExtensions.cs
+++ b/IdentityServer/v7/IdentityServerHost/src/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 internal static class HostingExtensions
@@ -53,6 +54,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/MTLS/IdentityServerHost/Program.cs b/IdentityServer/v7/MTLS/IdentityServerHost/Program.cs
index 707d0871..dfad54e1 100644
--- a/IdentityServer/v7/MTLS/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/MTLS/IdentityServerHost/Program.cs
@@ -4,6 +4,7 @@
 
 using System.Security.Cryptography.X509Certificates;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
 using Serilog;
 using Serilog.Events;
@@ -35,6 +36,11 @@
         opt.RevocationMode = X509RevocationMode.NoCheck;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var idsvrBuilder = builder.Services.AddIdentityServer(options =>
 {
     options.Events.RaiseErrorEvents = true;
diff --git a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
index 85eceb27..a7893cfe 100644
--- a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 using Duende.IdentityServer.Configuration;
 using Duende.IdentityServer.Configuration.Validation.DynamicClientRegistration;
 using Duende.IdentityServer.Stores;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
@@ -102,6 +103,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
index 62e55f55..c07fbdd6 100644
--- a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
index 4c72d2fb..ff148b5c 100644
--- a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
@@ -6,6 +6,7 @@
 using Duende.IdentityServer.EntityFramework.DbContexts;
 using Duende.IdentityServer.EntityFramework.Mappers;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
@@ -110,6 +111,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
index d0102b8e..7b7cd09f 100644
--- a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
@@ -4,6 +4,7 @@
 using Duende.IdentityServer;
 using IdentityServerAspNetIdentity.Data;
 using IdentityServerAspNetIdentity.Models;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..19ec233b 100644
--- a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
@@ -59,6 +59,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/ScopesAndResources/IdentityServerHost/Program.cs b/IdentityServer/v7/ScopesAndResources/IdentityServerHost/Program.cs
index 33bb6ed9..ece443a4 100644
--- a/IdentityServer/v7/ScopesAndResources/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/ScopesAndResources/IdentityServerHost/Program.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -35,6 +36,11 @@
 // register the token request validator to access the parsed scope in the pipeline
 idsvrBuilder.AddCustomTokenRequestValidator<TokenRequestValidator>();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 app.UseDeveloperExceptionPage();
diff --git a/IdentityServer/v7/SessionManagement/IdentityServerHost/Program.cs b/IdentityServer/v7/SessionManagement/IdentityServerHost/Program.cs
index 378f725f..2817a560 100644
--- a/IdentityServer/v7/SessionManagement/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/SessionManagement/IdentityServerHost/Program.cs
@@ -4,6 +4,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -60,6 +61,11 @@
         options.DisableTelemetry = true;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v7/SessionMigration/HostingExtensions.cs b/IdentityServer/v7/SessionMigration/HostingExtensions.cs
index aa26814f..ec323894 100644
--- a/IdentityServer/v7/SessionMigration/HostingExtensions.cs
+++ b/IdentityServer/v7/SessionMigration/HostingExtensions.cs
@@ -1,6 +1,7 @@
 // Copyright (c) Duende Software. All rights reserved.
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 namespace SessionMigration;
@@ -55,6 +56,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         // //** block above without enabling this will invalidate all existing sessions.
         // builder.Services.AddTransient<IPostConfigureOptions<CookieAuthenticationOptions>, SessionMigrationPostConfigureOptions>();
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/TokenExchange/IdentityServerHost/Program.cs b/IdentityServer/v7/TokenExchange/IdentityServerHost/Program.cs
index 8e45c6b8..b655fe29 100644
--- a/IdentityServer/v7/TokenExchange/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/TokenExchange/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -28,6 +29,11 @@
 // register a profile service to emit the act claim
 idsvrBuilder.AddProfileService<ProfileService>();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 app.UseDeveloperExceptionPage();
diff --git a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/Program.cs b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/Program.cs
index 709082c7..7082f9b2 100644
--- a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/Program.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -34,6 +35,11 @@
 idsvrBuilder.AddInMemoryApiScopes(Resources.ApiScopes);
 idsvrBuilder.AddInMemoryClients(Clients.List);
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
index c140ddb3..07ee7cc4 100644
--- a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
@@ -88,6 +89,11 @@
         };
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/Program.cs b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/Program.cs
index 309c8934..eb81dc01 100644
--- a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Events;
 using Serilog.Sinks.SystemConsole.Themes;
@@ -64,6 +65,11 @@
         options.DisableTelemetry = true;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
index acb5fb8d..c7c05abc 100644
--- a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
+++ b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Duende.IdentityServer.ResponseHandling;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 namespace IdentityServerHost;
@@ -67,6 +68,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
index b3bdf63d..da6a7420 100755
--- a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
+++ b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
 using Serilog.Events;
@@ -106,6 +107,11 @@
         };
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
index 37e36c30..610977f2 100644
--- a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
+++ b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/HostingExtensions.cs
@@ -6,6 +6,7 @@
 using IdentityServerAspNetIdentityPasskeys.Data;
 using IdentityServerAspNetIdentityPasskeys.Models;
 using IdentityServerAspNetIdentityPasskeys.Passkeys;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
diff --git a/IdentityServer/v8/Configuration/IdentityServerHost/HostingExtensions.cs b/IdentityServer/v8/Configuration/IdentityServerHost/HostingExtensions.cs
index a1085980..5031bdbc 100644
--- a/IdentityServer/v8/Configuration/IdentityServerHost/HostingExtensions.cs
+++ b/IdentityServer/v8/Configuration/IdentityServerHost/HostingExtensions.cs
@@ -5,6 +5,7 @@
 using IdentityServer.Pages.Admin.ApiScopes;
 using IdentityServer.Pages.Admin.Clients;
 using IdentityServer.Pages.Admin.IdentityScopes;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
@@ -94,6 +95,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         //builder.Services.Configure<RazorPagesOptions>(options =>
         //    options.Conventions.AuthorizeFolder("/ServerSideSessions", "admin"));
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/IdentityServerHost/src/HostingExtensions.cs b/IdentityServer/v8/IdentityServerHost/src/HostingExtensions.cs
index 8afdb589..bf32a6f1 100644
--- a/IdentityServer/v8/IdentityServerHost/src/HostingExtensions.cs
+++ b/IdentityServer/v8/IdentityServerHost/src/HostingExtensions.cs
@@ -5,6 +5,7 @@
 using Duende.IdentityServer;
 using Duende.IdentityServer.ConformanceReport;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 internal static class HostingExtensions
@@ -62,6 +63,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/MTLS/IdentityServerHost/Program.cs b/IdentityServer/v8/MTLS/IdentityServerHost/Program.cs
index 707d0871..dfad54e1 100644
--- a/IdentityServer/v8/MTLS/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/MTLS/IdentityServerHost/Program.cs
@@ -4,6 +4,7 @@
 
 using System.Security.Cryptography.X509Certificates;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
 using Serilog;
 using Serilog.Events;
@@ -35,6 +36,11 @@
         opt.RevocationMode = X509RevocationMode.NoCheck;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var idsvrBuilder = builder.Services.AddIdentityServer(options =>
 {
     options.Events.RaiseErrorEvents = true;
diff --git a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
index 85eceb27..a7893cfe 100644
--- a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 using Duende.IdentityServer.Configuration;
 using Duende.IdentityServer.Configuration.Validation.DynamicClientRegistration;
 using Duende.IdentityServer.Stores;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
@@ -102,6 +103,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/PAT/IdentityServerHost/Program.cs b/IdentityServer/v8/PAT/IdentityServerHost/Program.cs
index 8e1816ce..4f35745d 100644
--- a/IdentityServer/v8/PAT/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/PAT/IdentityServerHost/Program.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Events;
 using Serilog.Sinks.SystemConsole.Themes;
@@ -44,6 +45,11 @@
 idsvrBuilder.AddInMemoryApiResources(Config.ApiResources);
 idsvrBuilder.AddInMemoryClients(Config.Clients);
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
index 62e55f55..c07fbdd6 100644
--- a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
index 4c72d2fb..ff148b5c 100644
--- a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/HostingExtensions.cs
@@ -6,6 +6,7 @@
 using Duende.IdentityServer.EntityFramework.DbContexts;
 using Duende.IdentityServer.EntityFramework.Mappers;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
@@ -110,6 +111,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
index d0102b8e..d9cb68af 100644
--- a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/HostingExtensions.cs
@@ -59,6 +59,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..116ea937 100644
--- a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Google.Apis.Auth.AspNetCore3;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 
@@ -59,6 +60,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
index 907ef3c8..19ec233b 100644
--- a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
+++ b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/HostingExtensions.cs
@@ -59,6 +59,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                     });
         }
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/ScopesAndResources/IdentityServerHost/Program.cs b/IdentityServer/v8/ScopesAndResources/IdentityServerHost/Program.cs
index 33bb6ed9..ece443a4 100644
--- a/IdentityServer/v8/ScopesAndResources/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/ScopesAndResources/IdentityServerHost/Program.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -35,6 +36,11 @@
 // register the token request validator to access the parsed scope in the pipeline
 idsvrBuilder.AddCustomTokenRequestValidator<TokenRequestValidator>();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 app.UseDeveloperExceptionPage();
diff --git a/IdentityServer/v8/SessionManagement/IdentityServerHost/Program.cs b/IdentityServer/v8/SessionManagement/IdentityServerHost/Program.cs
index 378f725f..2817a560 100644
--- a/IdentityServer/v8/SessionManagement/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/SessionManagement/IdentityServerHost/Program.cs
@@ -4,6 +4,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -60,6 +61,11 @@
         options.DisableTelemetry = true;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/SessionMigration/HostingExtensions.cs b/IdentityServer/v8/SessionMigration/HostingExtensions.cs
index aa26814f..ec323894 100644
--- a/IdentityServer/v8/SessionMigration/HostingExtensions.cs
+++ b/IdentityServer/v8/SessionMigration/HostingExtensions.cs
@@ -1,6 +1,7 @@
 // Copyright (c) Duende Software. All rights reserved.
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 namespace SessionMigration;
@@ -55,6 +56,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         // //** block above without enabling this will invalidate all existing sessions.
         // builder.Services.AddTransient<IPostConfigureOptions<CookieAuthenticationOptions>, SessionMigrationPostConfigureOptions>();
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/TokenExchange/IdentityServerHost/Program.cs b/IdentityServer/v8/TokenExchange/IdentityServerHost/Program.cs
index 8e45c6b8..b655fe29 100644
--- a/IdentityServer/v8/TokenExchange/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/TokenExchange/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -28,6 +29,11 @@
 // register a profile service to emit the act claim
 idsvrBuilder.AddProfileService<ProfileService>();
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 app.UseDeveloperExceptionPage();
diff --git a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/Program.cs b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/Program.cs
index 709082c7..7082f9b2 100644
--- a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/Program.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
 
@@ -34,6 +35,11 @@
 idsvrBuilder.AddInMemoryApiScopes(Resources.ApiScopes);
 idsvrBuilder.AddInMemoryClients(Clients.List);
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
index c140ddb3..07ee7cc4 100644
--- a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
 using Serilog.Sinks.SystemConsole.Themes;
@@ -88,6 +89,11 @@
         };
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/Program.cs b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/Program.cs
index 309c8934..eb81dc01 100644
--- a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 using Serilog.Events;
 using Serilog.Sinks.SystemConsole.Themes;
@@ -64,6 +65,11 @@
         options.DisableTelemetry = true;
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
diff --git a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
index acb5fb8d..c7c05abc 100644
--- a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
+++ b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/HostingExtensions.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using Duende.IdentityServer.ResponseHandling;
+using Microsoft.AspNetCore.DataProtection;
 using Serilog;
 
 namespace IdentityServerHost;
@@ -67,6 +68,11 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
                 };
             });
 
+        // Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+        // See more at https://docs.duendesoftware.com/general/data-protection
+        builder.Services.AddDataProtection()
+            .SetApplicationName("IdentityServer");
+
         return builder.Build();
     }
 
diff --git a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
index b3bdf63d..da6a7420 100755
--- a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
+++ b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/Program.cs
@@ -3,6 +3,7 @@
 
 using Duende.IdentityServer;
 using IdentityServerHost;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
 using Serilog.Events;
@@ -106,6 +107,11 @@
         };
     });
 
+// Add `.PersistKeysTo…()` and `.ProtectKeysWith…()` calls
+// See more at https://docs.duendesoftware.com/general/data-protection
+builder.Services.AddDataProtection()
+    .SetApplicationName("IdentityServer");
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())