diff --git a/dashboard/src/components/PostInstallDialog.vue b/dashboard/src/components/PostInstallDialog.vue
index 92b9b95d0..a3c64d03a 100644
--- a/dashboard/src/components/PostInstallDialog.vue
+++ b/dashboard/src/components/PostInstallDialog.vue
@@ -1,9 +1,8 @@
 <script setup>
 
 import { ref, useTemplateRef } from 'vue';
-import { marked } from 'marked';
 import { Dialog } from '@cloudron/pankow';
-import { stripSsoInfo } from '../utils.js';
+import { renderSafeMarkdown, stripSsoInfo } from '../utils.js';
 
 const dialog = useTemplateRef('dialog');
 const app = ref(null);
@@ -48,13 +47,13 @@ defineExpose({
         </div>
       </div>
 
-      <div v-if="app.manifest.postInstallMessage" v-html="marked.parse(stripSsoInfo(app.manifest.postInstallMessage, app.sso))"></div>
+      <div v-if="app.manifest.postInstallMessage" v-html="renderSafeMarkdown(stripSsoInfo(app.manifest.postInstallMessage, app.sso))"></div>
 
       <div class="app-info-checklist" v-show="hasPendingChecklistItems">
         <label class="control-label">{{ $t('app.appInfo.checklist') }}</label>
         <div v-for="(item, key) in app.checklist" :key="key">
           <div class="checklist-item" v-show="!item.acknowledged">
-            <span v-html="marked.parse(item.message)"></span>
+            <span v-html="renderSafeMarkdown(item.message)"></span>
           </div>
         </div>
       </div>
diff --git a/dashboard/src/components/app/Info.vue b/dashboard/src/components/app/Info.vue
index 65d976118..3b6ef22e6 100644
--- a/dashboard/src/components/app/Info.vue
+++ b/dashboard/src/components/app/Info.vue
@@ -3,8 +3,7 @@
 import { onMounted, ref, useTemplateRef, inject } from 'vue';
 import { Button, ClipboardAction } from '@cloudron/pankow';
 import { prettyDate } from '@cloudron/pankow/utils';
-import { stripSsoInfo } from '../../utils.js';
-import { marked } from 'marked';
+import { renderSafeMarkdown, stripSsoInfo } from '../../utils.js';
 import AppsModel from '../../models/AppsModel.js';
 
 const appsModel = AppsModel.create();
@@ -121,14 +120,14 @@ onMounted(() => {
 
       <div v-for="(item, key) in app.checklist" :key="key">
         <div class="checklist-item" v-if="!item.acknowledged">
-          <span v-html="marked.parse(item.message)"></span>
+          <span v-html="renderSafeMarkdown(item.message)"></span>
           <Button small plain tool style="margin-left: 10px;" @click="onAckChecklistItem(item, key)">{{ $t('main.dialog.done') }}</Button>
         </div>
       </div>
 
       <div v-for="(item, key) in app.checklist" :key="key" v-show="showDoneChecklist">
         <div class="checklist-item checklist-item-acknowledged" v-if="item.acknowledged">
-          <span v-html="marked.parse(item.message)"></span>
+          <span v-html="renderSafeMarkdown(item.message)"></span>
           <span class="text-muted text-small">{{ item.changedBy }} - {{ prettyDate(item.changedAt) }}</span>
         </div>
       </div>
@@ -143,7 +142,7 @@ onMounted(() => {
 
     <div>
       <div v-show="!editing">
-        <div v-if="noteContent" v-html="marked.parse(stripSsoInfo(noteContent, app.sso))"></div>
+        <div v-if="noteContent" v-html="renderSafeMarkdown(stripSsoInfo(noteContent, app.sso))"></div>
         <div v-else class="text-muted hand" @click="onEdit()">{{ placeholder }}</div>
       </div>
       <div v-show="editing">
diff --git a/dashboard/src/utils.js b/dashboard/src/utils.js
index 6d184f3d6..6056b85c8 100644
--- a/dashboard/src/utils.js
+++ b/dashboard/src/utils.js
@@ -1,6 +1,26 @@
 
 import { prettyBinarySize } from '@cloudron/pankow/utils';
 import { RELAY_PROVIDERS, ISTATES, STORAGE_PROVIDERS } from './constants.js';
+import { Marked } from 'marked';
+
+function safeMarked() {
+  const marked = new Marked({
+    renderer: {
+      link({ href, title, text }) {
+        if (href && href.startsWith('mailto:')) return text; // mailto is rendered as text
+        const titleAttr = title ? ` title="${title}"` : '';
+        const isAbsolute = href && (href.startsWith('http://') || href.startsWith('https://') || href.startsWith('//'));
+        const targetAttr = isAbsolute ? ' target="_blank"' : '';
+        return `<a href="${href}"${targetAttr}${titleAttr}>${text}</a>`;
+      }
+    }
+  });
+  return marked;
+}
+
+function renderSafeMarkdown(text) {
+  return safeMarked().parse(text);
+}
 
 function prettyRelayProviderName(provider) {
   if (provider === 'noop') return 'Disabled (no email will be sent)';
@@ -762,6 +782,7 @@ function parseFullBackupPath(fullPath) {
 
 // named exports
 export {
+  renderSafeMarkdown,
   prettyRelayProviderName,
   download,
   mountlike,
@@ -784,6 +805,7 @@ export {
 
 // default export
 export default {
+  renderSafeMarkdown,
   prettyRelayProviderName,
   download,
   mountlike,