diff --git a/src/receive_imf.rs b/src/receive_imf.rs
index 4a9d8311b..e8f6afe67 100644
--- a/src/receive_imf.rs
+++ b/src/receive_imf.rs
@@ -1731,6 +1731,22 @@ async fn apply_group_changes(
         false
     };
 
+    if mime_parser.get_header(HeaderDef::ChatVerified).is_some() {
+        if let VerifiedEncryption::NotVerified(err) =
+            has_verified_encryption(context, mime_parser, from_id, to_ids, chat.typ).await?
+        {
+            warn!(context, "Verification problem: {err:#}.");
+            let s = format!("{err}. See 'Info' for more details");
+            mime_parser.repl_msg_by_error(&s);
+        }
+
+        if !chat.is_protected() {
+            chat_id
+                .inner_set_protection(context, ProtectionStatus::Protected)
+                .await?;
+        }
+    }
+
     if let Some(removed_addr) = mime_parser.get_header(HeaderDef::ChatGroupMemberRemoved) {
         removed_id = Contact::lookup_id_by_addr(context, removed_addr, Origin::Unknown).await?;
 
diff --git a/src/securejoin.rs b/src/securejoin.rs
index 34de7b658..df045ad4c 100644
--- a/src/securejoin.rs
+++ b/src/securejoin.rs
@@ -8,7 +8,7 @@ use percent_encoding::{utf8_percent_encode, AsciiSet, NON_ALPHANUMERIC};
 use crate::aheader::EncryptPreference;
 use crate::chat::{self, Chat, ChatId, ChatIdBlocked, ProtectionStatus};
 use crate::config::Config;
-use crate::constants::Blocked;
+use crate::constants::{Blocked, Chattype};
 use crate::contact::{Contact, ContactId, Origin, VerifiedStatus};
 use crate::context::Context;
 use crate::e2ee::ensure_secret_key_exists;
@@ -701,14 +701,22 @@ async fn secure_connection_established(
     let contact = Contact::get_by_id(context, contact_id).await?;
     let msg = stock_str::contact_verified(context, &contact).await;
     chat::add_info_msg(context, chat_id, &msg, time()).await?;
-    chat_id
-        .set_protection(
-            context,
-            ProtectionStatus::Protected,
-            time(),
-            Some(contact_id),
-        )
-        .await?;
+    if context
+        .get_config_bool(Config::VerifiedOneOnOneChats)
+        .await?
+    {
+        let chat = Chat::load_from_db(context, chat_id).await?;
+        if chat.typ == Chattype::Single {
+            chat_id
+                .set_protection(
+                    context,
+                    ProtectionStatus::Protected,
+                    time(),
+                    Some(contact_id),
+                )
+                .await?;
+        }
+    }
     context.emit_event(EventType::ChatModified(chat_id));
     Ok(())
 }
@@ -786,7 +794,6 @@ mod tests {
     use crate::chat;
     use crate::chat::ProtectionStatus;
     use crate::chatlist::Chatlist;
-    use crate::constants::Chattype;
     use crate::contact::ContactAddress;
     use crate::contact::VerifiedStatus;
     use crate::peerstate::Peerstate;
@@ -801,6 +808,14 @@ mod tests {
         let mut tcm = TestContextManager::new();
         let alice = tcm.alice().await;
         let bob = tcm.bob().await;
+        alice
+            .set_config(Config::VerifiedOneOnOneChats, Some("1"))
+            .await
+            .unwrap();
+        bob.set_config(Config::VerifiedOneOnOneChats, Some("1"))
+            .await
+            .unwrap();
+
         assert_eq!(
             Chatlist::try_load(&alice, 0, None, None)
                 .await
diff --git a/src/securejoin/bob.rs b/src/securejoin/bob.rs
index c824a5367..73903e2ce 100644
--- a/src/securejoin/bob.rs
+++ b/src/securejoin/bob.rs
@@ -9,6 +9,7 @@ use super::bobstate::{BobHandshakeStage, BobState};
 use super::qrinvite::QrInvite;
 use super::HandshakeMessage;
 use crate::chat::{is_contact_in_chat, ChatId, ProtectionStatus};
+use crate::config::Config;
 use crate::constants::{Blocked, Chattype};
 use crate::contact::Contact;
 use crate::context::Context;
@@ -222,14 +223,22 @@ impl BobState {
         let msg = stock_str::contact_verified(context, &contact).await;
         let chat_id = self.joining_chat_id(context).await?;
         chat::add_info_msg(context, chat_id, &msg, time()).await?;
-        chat_id
-            .set_protection(
-                context,
-                ProtectionStatus::Protected,
-                time(),
-                Some(contact.id),
-            )
-            .await?;
+
+        if context
+            .get_config_bool(Config::VerifiedOneOnOneChats)
+            .await?
+            && chat_id == self.alice_chat()
+        {
+            chat_id
+                .set_protection(
+                    context,
+                    ProtectionStatus::Protected,
+                    time(),
+                    Some(contact.id),
+                )
+                .await?;
+        }
+
         context.emit_event(EventType::ChatModified(chat_id));
         Ok(())
     }