diff --git a/docs/API_v3.md b/docs/API_v3.md
index a3b127b07..4797da48a 100644
--- a/docs/API_v3.md
+++ b/docs/API_v3.md
@@ -92,7 +92,9 @@ Returns condensed objects of all Forms beeing owned by the authenticated user.
       "submit"
     ],
     "partial": true,
-    "state": 0
+    "state": 0,
+    "lockedBy": null,
+    "lockedUntil": null
   },
   {
     "id": 3,
@@ -105,7 +107,9 @@ Returns condensed objects of all Forms beeing owned by the authenticated user.
       "submit"
     ],
     "partial": true,
-    "state": 0
+    "state": 0,
+    "lockedBy": "someUser"
+    "lockedUntil": 123456789
   }
 ]
 ```
@@ -169,6 +173,8 @@ Returns the full-depth object of the requested form (without submissions).
   "showExpiration": false,
   "canSubmit": true,
   "state": 0,
+  "lockedBy": null,
+  "lockedUntil": null,
   "permissions": [
     "edit",
     "results",
diff --git a/docs/DataStructure.md b/docs/DataStructure.md
index bd9490585..ffd0cf42f 100644
--- a/docs/DataStructure.md
+++ b/docs/DataStructure.md
@@ -26,6 +26,8 @@ This document describes the Object-Structure, that is used within the Forms App
 | expires              | unix-timestamp                       |                                         | When the form should expire. Timestamp `0` indicates _never_                                                                     |
 | isAnonymous          | Boolean                              |                                         | If Answers will be stored anonymously                                                                                            |
 | state                | Integer                              | [Form state](#form-state)               | The state of the form                                                                                                            |
+| lockedBy             | String                               |                                         | The user ID for who has exclusive edit access at the moment                                                                      |
+| lockedUntil          | unix timestamp                       |                                         | When the form lock will expire                                                                                                   |
 | submitMultiple       | Boolean                              |                                         | If users are allowed to submit multiple times to the form                                                                        |
 | allowEditSubmissions | Boolean                              |                                         | If users are allowed to edit or delete their response                                                                            |
 | showExpiration       | Boolean                              |                                         | If the expiration date will be shown on the form                                                                                 |
@@ -59,6 +61,8 @@ This document describes the Object-Structure, that is used within the Forms App
   ],
   "questions": [],
   "state": 0,
+  "lockedBy": null,
+  "lockedUntil": null,
   "shares": []
   "submissions": [],
   "submissionCount": 0,
diff --git a/img/lock_open.svg b/img/lock_open.svg
new file mode 100644
index 000000000..e6d74fcfe
--- /dev/null
+++ b/img/lock_open.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="20px" viewBox="0 -960 960 960" width="20px" fill="#222222"><path d="M264-624h336v-96q0-50-35-85t-85-35q-50 0-85 35t-35 85h-72q0-80 56.23-136 56.22-56 136-56Q560-912 616-855.84q56 56.16 56 135.84v96h24q29.7 0 50.85 21.15Q768-581.7 768-552v384q0 29.7-21.16 50.85Q725.68-96 695.96-96H263.72Q234-96 213-117.15T192-168v-384q0-29.7 21.15-50.85Q234.3-624 264-624Zm216.21 336Q510-288 531-309.21t21-51Q552-390 530.79-411t-51-21Q450-432 429-410.79t-21 51Q408-330 429.21-309t51 21Z"/></svg>
\ No newline at end of file
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
index dc0208340..c23f8efc0 100644
--- a/lib/Controller/ApiController.php
+++ b/lib/Controller/ApiController.php
@@ -22,7 +22,6 @@
 use OCA\Forms\Db\SubmissionMapper;
 use OCA\Forms\Db\UploadedFile;
 use OCA\Forms\Db\UploadedFileMapper;
-use OCA\Forms\Exception\NoSuchFormException;
 use OCA\Forms\ResponseDefinitions;
 use OCA\Forms\Service\ConfigService;
 use OCA\Forms\Service\FormsService;
@@ -180,7 +179,7 @@ public function newForm(?int $fromId = null): DataResponse {
 
 			$this->formMapper->insert($form);
 		} else {
-			$oldForm = $this->getFormIfAllowed($fromId);
+			$oldForm = $this->formsService->getFormIfAllowed($fromId, Constants::PERMISSION_EDIT);
 
 			// Read old form, (un)set new form specific data, extend title
 			$formData = $oldForm->read();
@@ -190,6 +189,8 @@ public function newForm(?int $fromId = null): DataResponse {
 			unset($formData['state']);
 			unset($formData['fileId']);
 			unset($formData['fileFormat']);
+			unset($formData['lockedBy']);
+			unset($formData['lockedUntil']);
 			$formData['hash'] = $this->formsService->generateFormHash();
 			// TRANSLATORS Appendix to the form Title of a duplicated/copied form.
 			$formData['title'] .= ' - ' . $this->l10n->t('Copy');
@@ -238,7 +239,7 @@ public function newForm(?int $fromId = null): DataResponse {
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'GET', url: '/api/v3/forms/{formId}')]
 	public function getForm(int $formId): DataResponse {
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_SUBMIT);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_SUBMIT);
 
 		return new DataResponse($this->formsService->getForm($form));
 	}
@@ -267,72 +268,45 @@ public function updateForm(int $formId, array $keyValuePairs): DataResponse {
 			'keyValuePairs' => $keyValuePairs
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
-		if (
-			$this->formsService->isFormArchived($form)
-			&& !(
-				sizeof($keyValuePairs) === 1
-				&& key_exists('state', $keyValuePairs)
-				&& $keyValuePairs['state'] === Constants::FORM_STATE_CLOSED
-			)
-		) {
-			$this->logger->debug('This form is archived and can not be modified except to change state to closed.');
-			throw new OCSForbiddenException('This form is archived and can not be modified except to change state to closed.');
-		}
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$currentUserId = $this->currentUser->getUID();
 
-		// Don't allow empty array
-		if (sizeof($keyValuePairs) === 0) {
+		if (empty($keyValuePairs)) {
 			$this->logger->info('Empty keyValuePairs, will not update.');
 			throw new OCSForbiddenException('Empty keyValuePairs, will not update.');
 		}
 
-		// Process owner transfer
-		if (sizeof($keyValuePairs) === 1 && key_exists('ownerId', $keyValuePairs)) {
-			$this->logger->debug('Updating owner: formId: {formId}, userId: {uid}', [
-				'formId' => $formId,
-				'uid' => $keyValuePairs['ownerId']
-			]);
+		// Only allow the form owner to set/unset the "archived" state
+		$this->checkArchivePermission($form, $currentUserId, $keyValuePairs);
 
-			$user = $this->userManager->get($keyValuePairs['ownerId']);
-			if ($user == null) {
-				$this->logger->debug('Could not find new form owner');
-				throw new OCSBadRequestException('Could not find new form owner');
-			}
-
-			// update form owner
-			$form->setOwnerId($keyValuePairs['ownerId']);
+		// Handle form locking/unlocking
+		if ($this->isLockingRequest($keyValuePairs)) {
+			return $this->handleFormLocking($form, $currentUserId);
+		}
+		if ($this->isUnlockingRequest($keyValuePairs)) {
+			return $this->handleFormUnlocking($form, $currentUserId);
+		}
 
-			// Update changed Columns in Db.
-			$this->formMapper->update($form);
+		// Lock form temporary
+		$this->formsService->obtainFormLock($form);
 
-			return new DataResponse($form->getOwnerId());
+		// Handle owner transfer
+		if ($this->isOwnerTransferRequest($keyValuePairs)) {
+			return $this->handleOwnerTransfer($form, $formId, $currentUserId, $keyValuePairs);
 		}
 
-		// Don't allow to change params id, hash, ownerId, created, lastUpdated, fileId
-		if (
-			key_exists('id', $keyValuePairs) || key_exists('hash', $keyValuePairs)
-			|| key_exists('ownerId', $keyValuePairs) || key_exists('created', $keyValuePairs)
-			|| isset($keyValuePairs['fileId']) || key_exists('lastUpdated', $keyValuePairs)
-		) {
-			$this->logger->info('Not allowed to update id, hash, ownerId, created, fileId or lastUpdated');
-			throw new OCSForbiddenException('Not allowed to update id, hash, ownerId, created, fileId or lastUpdated');
-		}
+		// Don't allow to change the following attributes
+		$this->checkForbiddenKeys($keyValuePairs);
 
-		// Do not allow changing showToAllUsers if disabled
-		if (isset($keyValuePairs['access'])) {
-			$showAll = $keyValuePairs['access']['showToAllUsers'] ?? false;
-			$permitAll = $keyValuePairs['access']['permitAllUsers'] ?? false;
-			if (($showAll && !$this->configService->getAllowShowToAll())
-				|| ($permitAll && !$this->configService->getAllowPermitAll())) {
-				$this->logger->info('Not allowed to update showToAllUsers or permitAllUsers');
-				throw new OCSForbiddenException();
-			}
-		}
+		// Don't allow to change fileId
+		$this->checkFileIdUpdate($keyValuePairs);
+
+		// Do not allow changing showToAllUsers or permitAllUsers if disabled
+		$this->checkAccessUpdate($keyValuePairs);
 
 		// Process file linking
 		if (isset($keyValuePairs['path']) && isset($keyValuePairs['fileFormat'])) {
 			$file = $this->submissionService->writeFileToCloud($form, $keyValuePairs['path'], $keyValuePairs['fileFormat']);
-
 			$form->setFileId($file->getId());
 			$form->setFileFormat($keyValuePairs['fileFormat']);
 		}
@@ -378,7 +352,7 @@ public function deleteForm(int $formId): DataResponse {
 			'formId' => $formId,
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId);
 		$this->formMapper->deleteForm($form);
 
 		return new DataResponse($formId);
@@ -488,7 +462,9 @@ public function getQuestion(int $formId, int $questionId): DataResponse {
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'POST', url: '/api/v3/forms/{formId}/questions')]
 	public function newQuestion(int $formId, ?string $type = null, string $text = '', ?int $fromId = null): DataResponse {
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -619,7 +595,9 @@ public function updateQuestion(int $formId, int $questionId, array $keyValuePair
 
 		// Make sure we query the form first to check the user has permissions
 		// So the user does not get information about "questions" if they do not even have permissions to the form
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -693,7 +671,9 @@ public function deleteQuestion(int $formId, int $questionId): DataResponse {
 		]);
 
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -759,7 +739,9 @@ public function reorderQuestions(int $formId, array $newOrder): DataResponse {
 			'newOrder' => $newOrder
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -858,7 +840,9 @@ public function newOption(int $formId, int $questionId, array $optionTexts): Dat
 			'text' => $optionTexts,
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -940,7 +924,9 @@ public function updateOption(int $formId, int $questionId, int $optionId, array
 			'keyValuePairs' => $keyValuePairs
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -1007,7 +993,9 @@ public function deleteOption(int $formId, int $questionId, int $optionId): DataR
 			'optionId' => $optionId
 		]);
 
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -1063,7 +1051,9 @@ public function deleteOption(int $formId, int $questionId, int $optionId): DataR
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'PATCH', url: '/api/v3/forms/{formId}/questions/{questionId}/options')]
 	public function reorderOptions(int $formId, int $questionId, array $newOrder) {
-		$form = $this->getFormIfAllowed($formId);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_EDIT);
+		$this->formsService->obtainFormLock($form);
+
 		if ($this->formsService->isFormArchived($form)) {
 			$this->logger->debug('This form is archived and can not be modified');
 			throw new OCSForbiddenException('This form is archived and can not be modified');
@@ -1164,7 +1154,7 @@ public function reorderOptions(int $formId, int $questionId, array $newOrder) {
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'GET', url: '/api/v3/forms/{formId}/submissions')]
 	public function getSubmissions(int $formId, ?string $query = null, ?int $limit = null, int $offset = 0, ?string $fileFormat = null): DataResponse|DataDownloadResponse {
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
 
 		if ($fileFormat !== null) {
 			$submissionsData = $this->submissionService->getSubmissionsData($form, $fileFormat);
@@ -1237,7 +1227,7 @@ public function getSubmissions(int $formId, ?string $query = null, ?int $limit =
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'GET', url: '/api/v3/forms/{formId}/submissions/{submissionId}')]
 	public function getSubmission(int $formId, int $submissionId): DataResponse|DataDownloadResponse {
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
 
 		$submission = $this->submissionService->getSubmission($submissionId);
 		if ($submission === null) {
@@ -1282,7 +1272,7 @@ public function getSubmission(int $formId, int $submissionId): DataResponse|Data
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'DELETE', url: '/api/v3/forms/{formId}/submissions')]
 	public function deleteAllSubmissions(int $formId): DataResponse {
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS_DELETE);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS_DELETE);
 
 		// Delete all submissions (incl. Answers)
 		$this->submissionMapper->deleteByForm($formId);
@@ -1319,7 +1309,7 @@ public function newSubmission(int $formId, array $answers, string $shareHash = '
 			'shareHash' => $shareHash,
 		]);
 
-		$form = $this->loadFormForSubmission($formId, $shareHash);
+		$form = $this->formsService->loadFormForSubmission($formId, $shareHash);
 
 		$questions = $this->formsService->getQuestions($formId);
 		try {
@@ -1405,7 +1395,7 @@ public function updateSubmission(int $formId, int $submissionId, array $answers)
 		]);
 
 		// submissions can't be updated on public shares, so passing empty shareHash
-		$form = $this->loadFormForSubmission($formId, '');
+		$form = $this->formsService->loadFormForSubmission($formId, '');
 
 		if (!$form->getAllowEditSubmissions()) {
 			throw new OCSBadRequestException('Can only update if allowEditSubmissions is set');
@@ -1480,7 +1470,7 @@ public function deleteSubmission(int $formId, int $submissionId): DataResponse {
 			'submissionId' => $submissionId,
 		]);
 
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS_DELETE);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS_DELETE);
 		try {
 			$submission = $this->submissionMapper->findById($submissionId);
 		} catch (IMapperException $e) {
@@ -1524,7 +1514,7 @@ public function deleteSubmission(int $formId, int $submissionId): DataResponse {
 	#[BruteForceProtection(action: 'form')]
 	#[ApiRoute(verb: 'POST', url: '/api/v3/forms/{formId}/submissions/export')]
 	public function exportSubmissionsToCloud(int $formId, string $path, string $fileFormat = Constants::DEFAULT_FILE_FORMAT) {
-		$form = $this->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
+		$form = $this->formsService->getFormIfAllowed($formId, Constants::PERMISSION_RESULTS);
 		$file = $this->submissionService->writeFileToCloud($form, $path, $fileFormat);
 
 		return new DataResponse($file->getName());
@@ -1570,7 +1560,7 @@ public function uploadFiles(int $formId, int $questionId, string $shareHash = ''
 			throw new OCSBadRequestException('No files provided');
 		}
 
-		$form = $this->loadFormForSubmission($formId, $shareHash);
+		$form = $this->formsService->loadFormForSubmission($formId, $shareHash);
 
 		if (!$this->formsService->canSubmit($form)) {
 			throw new OCSForbiddenException('Already submitted');
@@ -1738,84 +1728,148 @@ private function storeAnswersForQuestion(Form $form, $submissionId, array $quest
 		}
 	}
 
-	private function loadFormForSubmission(int $formId, string $shareHash): Form {
-		try {
-			$form = $this->formMapper->findById($formId);
-		} catch (IMapperException $e) {
-			$this->logger->debug('Could not find form');
-			throw new NoSuchFormException('Could not find form');
+	/**
+	 * Throws if forbidden keys are present in update
+	 */
+	private function checkForbiddenKeys(array $keyValuePairs): void {
+		$forbiddenKeys = [
+			'id', 'hash', 'ownerId', 'created', 'lastUpdated', 'lockedBy', 'lockedUntil'
+		];
+		foreach ($forbiddenKeys as $key) {
+			if (array_key_exists($key, $keyValuePairs)) {
+				$this->logger->info("Not allowed to update {$key}");
+				throw new OCSForbiddenException("Not allowed to update {$key}");
+			}
 		}
+	}
 
-		// Does the user have access to the form (Either by logged-in user, or by providing public share-hash.)
-		try {
-			$isPublicShare = false;
-
-			// If hash given, find the corresponding share & check if hash corresponds to given formId.
-			if ($shareHash !== '') {
-				// Public link share
-				$share = $this->shareMapper->findPublicShareByHash($shareHash);
-				if ($share->getFormId() === $formId) {
-					$isPublicShare = true;
-				}
-			}
-		} catch (DoesNotExistException $e) {
-			// $isPublicShare already false.
-		} finally {
-			// Now forbid, if no public share and no direct share.
-			if (!$isPublicShare && !$this->formsService->hasUserAccess($form)) {
-				throw new NoSuchFormException('Not allowed to access this form', Http::STATUS_FORBIDDEN);
+	/**
+	 * Throws if fileId is present in update
+	 */
+	private function checkFileIdUpdate(array $keyValuePairs): void {
+		if (isset($keyValuePairs['fileId'])) {
+			$this->logger->info('Not allowed to update fileId');
+			throw new OCSForbiddenException('Not allowed to update fileId');
+		}
+	}
+
+	/**
+	 * Throws if access keys are being updated when not allowed
+	 */
+	private function checkAccessUpdate(array $keyValuePairs): void {
+		if (isset($keyValuePairs['access'])) {
+			$showAll = $keyValuePairs['access']['showToAllUsers'] ?? false;
+			$permitAll = $keyValuePairs['access']['permitAllUsers'] ?? false;
+			if (($showAll && !$this->configService->getAllowShowToAll())
+				|| ($permitAll && !$this->configService->getAllowPermitAll())) {
+				$this->logger->info('Not allowed to update showToAllUsers or permitAllUsers');
+				throw new OCSForbiddenException();
 			}
 		}
+	}
 
-		// Not allowed if form has expired.
-		if ($this->formsService->hasFormExpired($form)) {
-			throw new OCSForbiddenException('This form is no longer taking answers');
+	/**
+	 * Checks if the current user is allowed to archive/unarchive the form
+	 */
+	private function checkArchivePermission(Form $form, string $currentUserId, array $keyValuePairs): void {
+		$isArchived = $this->formsService->isFormArchived($form);
+		$owner = $currentUserId === $form->getOwnerId();
+		$onlyState = sizeof($keyValuePairs) === 1 && key_exists('state', $keyValuePairs);
+
+		// Only check if the request is trying to change the archived state
+		if ($onlyState && $keyValuePairs['state'] === Constants::FORM_STATE_ARCHIVED) {
+			// Trying to archive
+			if (!$owner || $isArchived) {
+				$this->logger->debug('Only the form owner can archive the form, and only if it is not already archived');
+				throw new OCSForbiddenException('Only the form owner can archive the form, and only if it is not already archived');
+			}
+		} elseif ($onlyState && $keyValuePairs['state'] === Constants::FORM_STATE_CLOSED) {
+			// Trying to unarchive
+			if (!$owner || !$isArchived) {
+				$this->logger->debug('Only the form owner can unarchive the form, and only if it is currently archived');
+				throw new OCSForbiddenException('Only the form owner can unarchive the form, and only if it is currently archived');
+			}
 		}
+		// All other updates are allowed (including updates that do not touch the state)
+	}
+
+	private function isLockingRequest(array $keyValuePairs): bool {
+		return sizeof($keyValuePairs) === 1
+			&& array_key_exists('lockedUntil', $keyValuePairs)
+			&& $keyValuePairs['lockedUntil'] === 0;
+	}
+
+	private function isUnlockingRequest(array $keyValuePairs): bool {
+		return sizeof($keyValuePairs) === 1
+			&& array_key_exists('lockedUntil', $keyValuePairs)
+			&& is_null($keyValuePairs['lockedUntil']);
+	}
 
-		return $form;
+	private function isOwnerTransferRequest(array $keyValuePairs): bool {
+		return sizeof($keyValuePairs) === 1 && key_exists('ownerId', $keyValuePairs);
 	}
 
 	/**
-	 * Helper that retrieves a form if the current user is allowed to edit it
-	 * This throws an exception in case either the form is not found or permissions are missing.
-	 * @param int $formId The form ID to retrieve
-	 * @throws NoSuchFormException If the form was not found or the current user has no permission to edit
+	 * @return DataResponse<Http::STATUS_OK, int, array{}>
 	 */
-	private function getFormIfAllowed(int $formId, string $permissions = 'all'): Form {
-		try {
-			$form = $this->formMapper->findById($formId);
-		} catch (IMapperException $e) {
-			$this->logger->debug('Could not find form');
-			throw new NoSuchFormException('Could not find form');
+	private function handleFormLocking(Form $form, string $currentUserId): DataResponse {
+		if ($currentUserId !== $form->getOwnerId() || ($form->getLockedBy() !== null && $currentUserId !== $form->getLockedBy())) {
+			$this->logger->debug('Only the form owner can lock the form permanently');
+			throw new OCSForbiddenException('Only the form owner can lock the form permanently');
 		}
+		if (
+			$form->getLockedBy() !== null
+			&& $form->getLockedBy() !== $currentUserId
+			&& $form->getLockedUntil() >= time()
+		) {
+			$this->logger->debug('Form is currently locked by another user.');
+			throw new OCSForbiddenException('Form is currently locked by another user.');
+		}
+		if ($form->getLockedUntil() === 0) {
+			$this->logger->debug('Form is already locked completely.');
+			throw new OCSBadRequestException('Form is already locked completely.');
+		}
+		$form->setLockedBy($form->getOwnerId());
+		$form->setLockedUntil(0);
+		$this->formMapper->update($form);
+		return new DataResponse($form->getId());
+	}
 
-		switch ($permissions) {
-			case Constants::PERMISSION_SUBMIT:
-				if (!$this->formsService->hasUserAccess($form)) {
-					$this->logger->debug('User has no permissions to get this form');
-					throw new NoSuchFormException('User has no permissions to get this form', Http::STATUS_FORBIDDEN);
-				}
-				break;
-			case Constants::PERMISSION_RESULTS:
-				if (!$this->formsService->canSeeResults($form)) {
-					$this->logger->debug('The current user has no permission to get the results for this form');
-					throw new NoSuchFormException('The current user has no permission to get the results for this form', Http::STATUS_FORBIDDEN);
-				}
-				break;
-			case Constants::PERMISSION_RESULTS_DELETE:
-				if (!$this->formsService->canDeleteResults($form)) {
-					$this->logger->debug('This form is not owned by the current user and user has no `results_delete` permission');
-					throw new NoSuchFormException('This form is not owned by the current user and user has no `results_delete` permission', Http::STATUS_FORBIDDEN);
-				}
-				break;
-			default:
-				// By default we request full permissions
-				if ($form->getOwnerId() !== $this->currentUser->getUID()) {
-					$this->logger->debug('This form is not owned by the current user');
-					throw new NoSuchFormException('This form is not owned by the current user', Http::STATUS_FORBIDDEN);
-				}
-				break;
+	/**
+	 * @return DataResponse<Http::STATUS_OK, int, array{}>
+	 */
+	private function handleFormUnlocking(Form $form, string $currentUserId): DataResponse {
+		if ($currentUserId !== $form->getOwnerId() && $currentUserId !== $form->getLockedBy() && $form->getLockedUntil() !== 0) {
+			$this->logger->debug('Only the form owner or the user who obtained the lock can unlock the form');
+			throw new OCSForbiddenException('Only the form owner or the user who obtained the lock can unlock the form');
+		}
+		$form->setLockedBy(null);
+		$form->setLockedUntil(null);
+		$this->formMapper->update($form);
+		return new DataResponse($form->getId());
+	}
+
+	/**
+	 * @return DataResponse<Http::STATUS_OK, string, array{}>
+	 */
+	private function handleOwnerTransfer(Form $form, int $formId, string $currentUserId, array $keyValuePairs): DataResponse {
+		if ($currentUserId !== $form->getOwnerId()) {
+			$this->logger->debug('Only the form owner can transfer ownership');
+			throw new OCSForbiddenException('Only the form owner can transfer ownership');
 		}
-		return $form;
+		$this->logger->debug('Updating owner: formId: {formId}, userId: {uid}', [
+			'formId' => $formId,
+			'uid' => $keyValuePairs['ownerId']
+		]);
+		$user = $this->userManager->get($keyValuePairs['ownerId']);
+		if ($user == null) {
+			$this->logger->debug('Could not find new form owner');
+			throw new OCSBadRequestException('Could not find new form owner');
+		}
+		$form->setOwnerId($keyValuePairs['ownerId']);
+		$form->setLockedBy(null);
+		$form->setLockedUntil(null);
+		$this->formMapper->update($form);
+		return new DataResponse($form->getOwnerId());
 	}
 }
diff --git a/lib/Controller/ShareApiController.php b/lib/Controller/ShareApiController.php
index 067c171a1..21b15753f 100644
--- a/lib/Controller/ShareApiController.php
+++ b/lib/Controller/ShareApiController.php
@@ -104,6 +104,12 @@ public function newShare(int $formId, int $shareType, string $shareWith = '', ar
 			'permissions' => $permissions,
 		]);
 
+		$form = $this->formsService->getFormIfAllowed($formId);
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		// Only accept usable shareTypes
 		if (array_search($shareType, Constants::SHARE_TYPES_USED) === false) {
 			$this->logger->debug('Invalid shareType');
@@ -116,24 +122,6 @@ public function newShare(int $formId, int $shareType, string $shareWith = '', ar
 			throw new OCSForbiddenException('Link share not allowed.');
 		}
 
-		try {
-			$form = $this->formMapper->findById($formId);
-		} catch (IMapperException $e) {
-			$this->logger->debug('Could not find form', ['exception' => $e]);
-			throw new OCSNotFoundException('Could not find form');
-		}
-
-		if ($this->formsService->isFormArchived($form)) {
-			$this->logger->debug('This form is archived and can not be modified');
-			throw new OCSForbiddenException('This form is archived and can not be modified');
-		}
-
-		// Check for permission to share form
-		if ($form->getOwnerId() !== $this->currentUser->getUID()) {
-			$this->logger->debug('This form is not owned by the current user');
-			throw new OCSForbiddenException('This form is not owned by the current user');
-		}
-
 		if (!$this->validatePermissions($permissions, $shareType)) {
 			throw new OCSBadRequestException('Invalid permission given');
 		}
@@ -194,6 +182,8 @@ public function newShare(int $formId, int $shareType, string $shareWith = '', ar
 				throw new OCSBadRequestException('Unknown shareType.');
 		}
 
+		$this->formsService->obtainFormLock($form);
+
 		$share = new Share();
 		$share->setFormId($formId);
 		$share->setShareType($shareType);
@@ -240,29 +230,24 @@ public function updateShare(int $formId, int $shareId, array $keyValuePairs): Da
 			'keyValuePairs' => $keyValuePairs
 		]);
 
+		$form = $this->formsService->getFormIfAllowed($formId);
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		try {
 			$formShare = $this->shareMapper->findById($shareId);
-			$form = $this->formMapper->findById($formId);
 		} catch (IMapperException $e) {
 			$this->logger->debug('Could not find share', ['exception' => $e]);
 			throw new OCSNotFoundException('Could not find share');
 		}
 
-		if ($this->formsService->isFormArchived($form)) {
-			$this->logger->debug('This form is archived and can not be modified');
-			throw new OCSForbiddenException('This form is archived and can not be modified');
-		}
-
 		if ($formId !== $formShare->getFormId()) {
 			$this->logger->debug('This share doesn\'t belong to the given Form');
 			throw new OCSBadRequestException('Share doesn\'t belong to given Form');
 		}
 
-		if ($form->getOwnerId() !== $this->currentUser->getUID()) {
-			$this->logger->debug('This form is not owned by the current user');
-			throw new OCSForbiddenException('This form is not owned by the current user');
-		}
-
 		// Don't allow empty array
 		if (sizeof($keyValuePairs) === 0) {
 			$this->logger->info('Empty keyValuePairs, will not update.');
@@ -279,6 +264,8 @@ public function updateShare(int $formId, int $shareId, array $keyValuePairs): Da
 			throw new OCSBadRequestException('Invalid permission given');
 		}
 
+		$this->formsService->obtainFormLock($form);
+
 		$formShare->setPermissions($keyValuePairs['permissions']);
 		$formShare = $this->shareMapper->update($formShare);
 
@@ -338,28 +325,25 @@ public function deleteShare(int $formId, int $shareId): DataResponse {
 			'shareId' => $shareId,
 		]);
 
+		$form = $this->formsService->getFormIfAllowed($formId);
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		try {
 			$share = $this->shareMapper->findById($shareId);
-			$form = $this->formMapper->findById($formId);
 		} catch (IMapperException $e) {
 			$this->logger->debug('Could not find share', ['exception' => $e]);
 			throw new OCSNotFoundException('Could not find share');
 		}
 
-		if ($this->formsService->isFormArchived($form)) {
-			$this->logger->debug('This form is archived and can not be modified');
-			throw new OCSForbiddenException('This form is archived and can not be modified');
-		}
-
 		if ($formId !== $share->getFormId()) {
 			$this->logger->debug('This share doesn\'t belong to the given Form');
 			throw new OCSBadRequestException('Share doesn\'t belong to given Form');
 		}
 
-		if ($form->getOwnerId() !== $this->currentUser->getUID()) {
-			$this->logger->debug('This form is not owned by the current user');
-			throw new OCSForbiddenException('This form is not owned by the current user');
-		}
+		$this->formsService->obtainFormLock($form);
 
 		$this->shareMapper->delete($share);
 		$this->formMapper->update($form);
diff --git a/lib/Db/Form.php b/lib/Db/Form.php
index a49181be6..fe1637eda 100644
--- a/lib/Db/Form.php
+++ b/lib/Db/Form.php
@@ -47,6 +47,10 @@
  * @psalm-method 0|1|2 getState()
  * @method void setState(int|null $value)
  * @psalm-method void setState(0|1|2|null $value)
+ * @method string getLockedBy()
+ * @method void setLockedBy(string|null $value)
+ * @method int getLockedUntil()
+ * @method void setLockedUntil(int|null $value)
  */
 class Form extends Entity {
 	protected $hash;
@@ -65,6 +69,8 @@ class Form extends Entity {
 	protected $submissionMessage;
 	protected $lastUpdated;
 	protected $state;
+	protected $lockedBy;
+	protected $lockedUntil;
 
 	/**
 	 * Form constructor.
@@ -78,6 +84,8 @@ public function __construct() {
 		$this->addType('showExpiration', 'boolean');
 		$this->addType('lastUpdated', 'integer');
 		$this->addType('state', 'integer');
+		$this->addType('lockedBy', 'string');
+		$this->addType('lockedUntil', 'integer');
 	}
 
 	// JSON-Decoding of access-column.
@@ -149,6 +157,8 @@ public function setAccess(array $access): void {
 	 *   lastUpdated: int,
 	 *   submissionMessage: ?string,
 	 *   state: 0|1|2,
+	 *   lockedBy: ?string,
+	 *   lockedUntil: ?int,
 	 *  }
 	 */
 	public function read() {
@@ -170,6 +180,8 @@ public function read() {
 			'lastUpdated' => (int)$this->getLastUpdated(),
 			'submissionMessage' => $this->getSubmissionMessage(),
 			'state' => $this->getState(),
+			'lockedBy' => $this->getLockedBy(),
+			'lockedUntil' => $this->getLockedUntil(),
 		];
 	}
 }
diff --git a/lib/Migration/Version050200Date20250512004000.php b/lib/Migration/Version050200Date20250512004000.php
new file mode 100644
index 000000000..d8cbf762c
--- /dev/null
+++ b/lib/Migration/Version050200Date20250512004000.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Forms\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version050200Date20250512004000 extends SimpleMigrationStep {
+
+	/**
+	 * @param IOutput $output
+	 * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+	 * @param array $options
+	 * @return null|ISchemaWrapper
+	 */
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		/** @var ISchemaWrapper $schema */
+		$schema = $schemaClosure();
+		$table = $schema->getTable('forms_v2_forms');
+
+		if (!$table->hasColumn('locked_by')) {
+			$table->addColumn('locked_by', Types::STRING, [
+				'notnull' => false,
+				'default' => null,
+			]);
+		}
+
+		if (!$table->hascolumn('locked_until')) {
+			$table->addColumn('locked_until', Types::INTEGER, [
+				'notnull' => false,
+				'default' => null,
+				'comment' => 'unix-timestamp',
+			]);
+		}
+
+		return $schema;
+	}
+}
diff --git a/lib/ResponseDefinitions.php b/lib/ResponseDefinitions.php
index 05e8e08cc..b4fc22e70 100644
--- a/lib/ResponseDefinitions.php
+++ b/lib/ResponseDefinitions.php
@@ -104,7 +104,9 @@
  *   expires: int,
  *   permissions: list<FormsPermission>,
  *   partial: true,
- *   state: int
+ *   state: int,
+ *   lockedBy: ?string,
+ *   lockedUntil: ?int,
  * }
  *
  * @psalm-type FormsForm = array{
@@ -128,6 +130,8 @@
  *   permissions: list<FormsPermission>,
  *   questions: list<FormsQuestion>,
  *   state: 0|1|2,
+ *   lockedBy: ?string,
+ *   lockedUntil: ?int,
  *   shares: list<FormsShare>,
  *   submissionCount?: int,
  *   submissionMessage: ?string,
diff --git a/lib/Service/FormsService.php b/lib/Service/FormsService.php
index f25837ad2..9a4c2d546 100644
--- a/lib/Service/FormsService.php
+++ b/lib/Service/FormsService.php
@@ -19,9 +19,12 @@
 use OCA\Forms\Db\Submission;
 use OCA\Forms\Db\SubmissionMapper;
 use OCA\Forms\Events\FormSubmittedEvent;
+use OCA\Forms\Exception\NoSuchFormException;
 use OCA\Forms\ResponseDefinitions;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\IMapperException;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\OCS\OCSForbiddenException;
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\Files\IRootFolder;
 use OCP\Files\NotFoundException;
@@ -62,8 +65,8 @@ public function __construct(
 		private CirclesService $circlesService,
 		private IRootFolder $rootFolder,
 		private IL10N $l10n,
-		private IEventDispatcher $eventDispatcher,
 		private LoggerInterface $logger,
+		private IEventDispatcher $eventDispatcher,
 	) {
 		$this->currentUser = $userSession->getUser();
 	}
@@ -243,6 +246,8 @@ public function getPartialFormArray(Form $form): array {
 			'permissions' => $this->getPermissions($form),
 			'partial' => true,
 			'state' => $form->getState(),
+			'lockedBy' => $form->getLockedBy(),
+			'lockedUntil' => $form->getLockedUntil(),
 		];
 
 		// Append submissionCount if currentUser has permissions to see results
@@ -281,6 +286,112 @@ public function getPublicForm(Form $form): array {
 		return $formData;
 	}
 
+	/**
+	 * Helper that retrieves a form if the current user is allowed to edit it
+	 * This throws an exception in case either the form is not found or permissions are missing.
+	 * @param int $formId The form ID to retrieve
+	 * @throws NoSuchFormException If the form was not found or the current user has no permission to edit
+	 */
+	public function getFormIfAllowed(int $formId, string $permissions = 'all'): Form {
+		try {
+			$form = $this->formMapper->findById($formId);
+		} catch (IMapperException $e) {
+			$this->logger->debug('Could not find form');
+			throw new NoSuchFormException('Could not find form');
+		}
+
+		switch ($permissions) {
+			case Constants::PERMISSION_SUBMIT:
+				if (!$this->hasUserAccess($form)) {
+					$this->logger->debug('User has no permissions to get this form');
+					throw new NoSuchFormException('User has no permissions to get this form', Http::STATUS_FORBIDDEN);
+				}
+				break;
+			case Constants::PERMISSION_RESULTS:
+				if (!$this->canSeeResults($form)) {
+					$this->logger->debug('The current user has no permission to get the results for this form');
+					throw new NoSuchFormException('The current user has no permission to get the results for this form', Http::STATUS_FORBIDDEN);
+				}
+				break;
+			case Constants::PERMISSION_RESULTS_DELETE:
+				if (!$this->canDeleteResults($form)) {
+					$this->logger->debug('This form is not owned by the current user and user has no `results_delete` permission');
+					throw new NoSuchFormException('This form is not owned by the current user and user has no `results_delete` permission', Http::STATUS_FORBIDDEN);
+				}
+				break;
+			case Constants::PERMISSION_EDIT:
+				if (!$this->canEditForm($form)) {
+					$this->logger->debug('This form is not owned by the current user and user has no `edit` permission');
+					throw new NoSuchFormException('This form is not owned by the current user and user has no `edit` permission', Http::STATUS_FORBIDDEN);
+				}
+				break;
+			default:
+				// By default we request full permissions
+				if ($form->getOwnerId() !== $this->currentUser->getUID()) {
+					$this->logger->debug('This form is not owned by the current user');
+					throw new NoSuchFormException('This form is not owned by the current user', Http::STATUS_FORBIDDEN);
+				}
+				break;
+		}
+		return $form;
+	}
+
+	public function loadFormForSubmission(int $formId, string $shareHash): Form {
+		try {
+			$form = $this->formMapper->findById($formId);
+		} catch (IMapperException $e) {
+			$this->logger->debug('Could not find form');
+			throw new NoSuchFormException('Could not find form');
+		}
+
+		// Does the user have access to the form (Either by logged-in user, or by providing public share-hash.)
+		try {
+			$isPublicShare = false;
+
+			// If hash given, find the corresponding share & check if hash corresponds to given formId.
+			if ($shareHash !== '') {
+				// Public link share
+				$share = $this->shareMapper->findPublicShareByHash($shareHash);
+				if ($share->getFormId() === $formId) {
+					$isPublicShare = true;
+				}
+			}
+		} catch (DoesNotExistException $e) {
+			// $isPublicShare already false.
+		} finally {
+			// Now forbid, if no public share and no direct share.
+			if (!$isPublicShare && !$this->hasUserAccess($form)) {
+				throw new NoSuchFormException('Not allowed to access this form', Http::STATUS_FORBIDDEN);
+			}
+		}
+
+		// Not allowed if form has expired.
+		if ($this->hasFormExpired($form)) {
+			throw new OCSForbiddenException('This form is no longer taking answers');
+		}
+
+		return $form;
+	}
+
+	/**
+	 * Locks the given form for the current user for a duration of 15 minutes.
+	 *
+	 * @param Form $form The form instance to lock.
+	 */
+	public function obtainFormLock(Form $form): void {
+		// Only lock if not locked or locked by current user, or lock has expired
+		if (
+			$form->getLockedBy() !== null
+			&& $form->getLockedBy() !== $this->currentUser->getUID()
+			&& ($form->getLockedUntil() >= time() || $form->getLockedUntil() === 0)
+		) {
+			throw new OCSForbiddenException('Form is currently locked by another user.');
+		}
+
+		$form->setLockedBy($this->currentUser->getUID());
+		$form->setLockedUntil(time() + 15 * 60);
+	}
+
 	/**
 	 * Get current users permissions on a form
 	 *
diff --git a/openapi.json b/openapi.json
index be4bcbb84..3ed422c89 100644
--- a/openapi.json
+++ b/openapi.json
@@ -111,6 +111,8 @@
                     "permissions",
                     "questions",
                     "state",
+                    "lockedBy",
+                    "lockedUntil",
                     "shares",
                     "submissionMessage"
                 ],
@@ -195,6 +197,15 @@
                             2
                         ]
                     },
+                    "lockedBy": {
+                        "type": "string",
+                        "nullable": true
+                    },
+                    "lockedUntil": {
+                        "type": "integer",
+                        "format": "int64",
+                        "nullable": true
+                    },
                     "shares": {
                         "type": "array",
                         "items": {
@@ -291,7 +302,9 @@
                     "expires",
                     "permissions",
                     "partial",
-                    "state"
+                    "state",
+                    "lockedBy",
+                    "lockedUntil"
                 ],
                 "properties": {
                     "id": {
@@ -323,6 +336,15 @@
                     "state": {
                         "type": "integer",
                         "format": "int64"
+                    },
+                    "lockedBy": {
+                        "type": "string",
+                        "nullable": true
+                    },
+                    "lockedUntil": {
+                        "type": "integer",
+                        "format": "int64",
+                        "nullable": true
                     }
                 }
             },
diff --git a/src/components/AppNavigationForm.vue b/src/components/AppNavigationForm.vue
index 0862bbd93..02c196593 100644
--- a/src/components/AppNavigationForm.vue
+++ b/src/components/AppNavigationForm.vue
@@ -25,10 +25,13 @@
 		<template v-if="hasSubtitle" #subname>
 			{{ formSubtitle }}
 		</template>
-		<template v-if="!loading && !readOnly" #actions>
+		<template
+			v-if="!loading && (!readOnly || canEdit || canSeeResults)"
+			#actions>
 			<NcActionRouter
-				v-if="!isArchived"
+				v-if="!isArchived && canEdit"
 				close-after-click
+				:disabled="isFormLocked"
 				exact
 				:to="{ name: 'edit', params: { hash: form.hash } }"
 				@click="mobileCloseNavigation">
@@ -38,7 +41,7 @@
 				{{ t('forms', 'Edit form') }}
 			</NcActionRouter>
 			<NcActionButton
-				v-if="!isArchived"
+				v-if="!isArchived && !readOnly"
 				close-after-click
 				@click="onShareForm">
 				<template #icon>
@@ -47,6 +50,7 @@
 				{{ t('forms', 'Share form') }}
 			</NcActionButton>
 			<NcActionRouter
+				v-if="canSeeResults"
 				close-after-click
 				exact
 				:to="{ name: 'results', params: { hash: form.hash } }"
@@ -62,10 +66,11 @@
 				</template>
 				{{ t('forms', 'Copy form') }}
 			</NcActionButton>
-			<NcActionSeparator v-if="canEdit" />
+			<NcActionSeparator v-if="canEdit && !readOnly" />
 			<NcActionButton
-				v-if="canEdit"
+				v-if="canEdit && !readOnly"
 				close-after-click
+				:disabled="isFormLocked"
 				@click="onToggleArchive">
 				<template #icon>
 					<IconArchiveOff v-if="isArchived" :size="20" />
@@ -78,8 +83,9 @@
 				}}
 			</NcActionButton>
 			<NcActionButton
-				v-if="canEdit"
+				v-if="canEdit && !readOnly"
 				close-after-click
+				:disabled="isFormLocked"
 				@click="showDeleteDialog = true">
 				<template #icon>
 					<IconDelete :size="20" />
@@ -100,6 +106,7 @@
 </template>
 
 <script>
+import { getCurrentUser } from '@nextcloud/auth'
 import { generateOcsUrl } from '@nextcloud/router'
 import { showError } from '@nextcloud/dialogs'
 import NcActionButton from '@nextcloud/vue/components/NcActionButton'
@@ -190,6 +197,14 @@ export default {
 			)
 		},
 
+		canSeeResults() {
+			return (
+				this.form.permissions.includes(
+					this.PERMISSION_TYPES.PERMISSION_RESULTS,
+				) || this.form.submissionCount > 0
+			)
+		},
+
 		/**
 		 * Check if form is current form and set active
 		 */
@@ -211,6 +226,17 @@ export default {
 			return this.form.expires && moment().unix() > this.form.expires
 		},
 
+		/**
+		 * Check if form is locked
+		 */
+		isFormLocked() {
+			return (
+				this.form.lockedUntil === 0
+				|| (this.form.lockedUntil > moment().unix()
+					&& this.form.lockedBy !== getCurrentUser().uid)
+			)
+		},
+
 		/**
 		 * Return form title, or placeholder if not set
 		 *
diff --git a/src/components/PillMenu.vue b/src/components/PillMenu.vue
index 20fee38e7..f650e8475 100644
--- a/src/components/PillMenu.vue
+++ b/src/components/PillMenu.vue
@@ -10,7 +10,7 @@
 			:key="option.id"
 			:aria-label="isMobile ? option.ariaLabel : null"
 			:checked="active.id"
-			:disabled="disabled"
+			:disabled="disabled || option.disabled"
 			class="pill-menu__toggle"
 			:class="{ 'pill-menu__toggle--icon-only': isMobile && option.icon }"
 			button-variant
diff --git a/src/components/SidebarTabs/SettingsSidebarTab.vue b/src/components/SidebarTabs/SettingsSidebarTab.vue
index 831f5ead0..4c40727b4 100644
--- a/src/components/SidebarTabs/SettingsSidebarTab.vue
+++ b/src/components/SidebarTabs/SettingsSidebarTab.vue
@@ -5,9 +5,31 @@
 
 <template>
 	<div class="sidebar-tabs__content">
+		<NcNoteCard
+			v-if="locked"
+			type="info"
+			:heading="t('forms', 'Form is locked')"
+			:text="
+				t('forms', 'Lock by {lockedBy}, expires: {lockedUntil}', {
+					lockedBy: form.lockedBy ? form.lockedBy : form.ownerId,
+					lockedUntil:
+						lockedUntil === '' ? t('forms', 'never') : lockedUntil,
+				})
+			" />
+		<NcButton
+			v-if="locked && isCurrentUserOwner"
+			wide
+			@click="onFormLockChange(false)">
+			<template #icon>
+				<NcIconSvgWrapper
+					:svg="svgLockOpen"
+					:name="t('forms', 'Open lock')" />
+			</template>
+			{{ t('forms', 'Unlock form') }}
+		</NcButton>
 		<NcCheckboxRadioSwitch
 			:checked="form.isAnonymous"
-			:disabled="formArchived"
+			:disabled="formArchived || locked"
 			type="switch"
 			@update:checked="onAnonChange">
 			<!-- TRANSLATORS Checkbox to select whether responses will be stored anonymously or not -->
@@ -16,21 +38,21 @@
 		<NcCheckboxRadioSwitch
 			v-tooltip="disableSubmitMultipleExplanation"
 			:checked="submitMultiple"
-			:disabled="disableSubmitMultiple || formArchived"
+			:disabled="disableSubmitMultiple || formArchived || locked"
 			type="switch"
 			@update:checked="onSubmitMultipleChange">
 			{{ t('forms', 'Allow multiple responses per person') }}
 		</NcCheckboxRadioSwitch>
 		<NcCheckboxRadioSwitch
 			:model-value="form.allowEditSubmissions"
-			:disabled="formArchived"
+			:disabled="formArchived || locked"
 			type="switch"
 			@update:model-value="onAllowEditSubmissionsChange">
 			{{ t('forms', 'Allow editing own responses') }}
 		</NcCheckboxRadioSwitch>
 		<NcCheckboxRadioSwitch
 			:checked="formExpires"
-			:disabled="formArchived"
+			:disabled="formArchived || locked"
 			type="switch"
 			@update:checked="onFormExpiresChange">
 			{{ t('forms', 'Set expiration date') }}
@@ -39,6 +61,7 @@
 			<NcDateTimePicker
 				id="expiresDatetimePicker"
 				:clearable="false"
+				:disabled="locked"
 				:disabled-date="notBeforeToday"
 				:disabled-time="notBeforeNow"
 				:editable="false"
@@ -50,6 +73,7 @@
 				@change="onExpirationDateChange" />
 			<NcCheckboxRadioSwitch
 				:checked="form.showExpiration"
+				:disabled="locked"
 				type="switch"
 				@update:checked="onShowExpirationChange">
 				{{ t('forms', 'Show expiration date on form') }}
@@ -57,7 +81,7 @@
 		</div>
 		<NcCheckboxRadioSwitch
 			:checked="formClosed"
-			:disabled="formArchived"
+			:disabled="formArchived || locked"
 			aria-describedby="forms-settings__close-form"
 			type="switch"
 			@update:checked="onFormClosedChange">
@@ -66,9 +90,21 @@
 		<p id="forms-settings__close-form" class="settings-hint">
 			{{ t('forms', 'Closed forms do not accept new submissions.') }}
 		</p>
+		<NcCheckboxRadioSwitch
+			:model-value="isFormLockedPermanently"
+			:disabled="
+				formArchived
+				|| (locked && form.lockedUntil !== 0)
+				|| !isCurrentUserOwner
+			"
+			type="switch"
+			@update:model-value="onFormLockChange">
+			{{ t('forms', 'Lock form permanently') }}
+		</NcCheckboxRadioSwitch>
 		<NcCheckboxRadioSwitch
 			:checked="formArchived"
 			aria-describedby="forms-settings__archive-form"
+			:disabled="locked"
 			type="switch"
 			@update:checked="onFormArchivedChange">
 			{{ t('forms', 'Archive form') }}
@@ -83,7 +119,7 @@
 		</p>
 		<NcCheckboxRadioSwitch
 			:checked="hasCustomSubmissionMessage"
-			:disabled="formArchived"
+			:disabled="formArchived || locked"
 			type="switch"
 			@update:checked="onUpdateHasCustomSubmissionMessage">
 			{{ t('forms', 'Custom submission message') }}
@@ -103,6 +139,7 @@
 				aria-describedby="forms-submission-message-description"
 				:aria-label="t('forms', 'Custom submission message')"
 				:value="form.submissionMessage"
+				:disabled="locked"
 				:maxlength="maxStringLengths.submissionMessage"
 				:placeholder="
 					t(
@@ -132,25 +169,33 @@
 			</div>
 		</div>
 
-		<TransferOwnership :form="form" />
+		<TransferOwnership :locked="locked" :form="form" />
 	</div>
 </template>
 
 <script>
+import { getCurrentUser } from '@nextcloud/auth'
 import moment from '@nextcloud/moment'
+import NcButton from '@nextcloud/vue/components/NcButton'
 import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
 import NcDateTimePicker from '@nextcloud/vue/components/NcDateTimePicker'
+import NcIconSvgWrapper from '@nextcloud/vue/components/NcIconSvgWrapper'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import ShareTypes from '../../mixins/ShareTypes.js'
 import TransferOwnership from './TransferOwnership.vue'
 
 import { directive as ClickOutside } from 'v-click-outside'
 import { loadState } from '@nextcloud/initial-state'
 import { FormState } from '../../models/Constants.ts'
+import svgLockOpen from '../../../img/lock_open.svg?raw'
 
 export default {
 	components: {
+		NcButton,
 		NcCheckboxRadioSwitch,
 		NcDateTimePicker,
+		NcIconSvgWrapper,
+		NcNoteCard,
 		TransferOwnership,
 	},
 
@@ -167,6 +212,16 @@ export default {
 			type: Object,
 			required: true,
 		},
+
+		locked: {
+			type: Boolean,
+			required: true,
+		},
+
+		lockedUntil: {
+			type: String,
+			default: '',
+		},
 	},
 
 	data() {
@@ -178,10 +233,19 @@ export default {
 			maxStringLengths: loadState('forms', 'maxStringLengths'),
 			/** If custom submission message is shown as input or rendered markdown */
 			editMessage: false,
+			svgLockOpen,
 		}
 	},
 
 	computed: {
+		isCurrentUserOwner() {
+			return getCurrentUser().uid === this.form.ownerId
+		},
+
+		isFormLockedPermanently() {
+			return this.locked && this.form.lockedUntil === 0
+		},
+
 		/**
 		 * If the form has a custom submission message or the user wants to add one (settings switch)
 		 */
@@ -297,6 +361,10 @@ export default {
 			)
 		},
 
+		onFormLockChange(locked) {
+			this.$emit('update:formProp', 'lockedUntil', locked ? 0 : null)
+		},
+
 		onFormArchivedChange(isArchived) {
 			this.$emit(
 				'update:formProp',
@@ -386,7 +454,6 @@ export default {
 .sidebar-tabs__content {
 	display: flex;
 	flex-direction: column;
-	gap: 8px;
 }
 .submission-message {
 	&__description {
diff --git a/src/components/SidebarTabs/SharingSearchDiv.vue b/src/components/SidebarTabs/SharingSearchDiv.vue
index 2c1e52358..bf6193094 100644
--- a/src/components/SidebarTabs/SharingSearchDiv.vue
+++ b/src/components/SidebarTabs/SharingSearchDiv.vue
@@ -9,6 +9,7 @@
 			:clear-search-on-select="false"
 			:close-on-select="false"
 			:loading="showLoadingCircle"
+			:disabled="locked"
 			:get-option-key="(option) => option.key"
 			:options="options"
 			:placeholder="t('forms', 'Search for user, group or team …')"
@@ -46,6 +47,10 @@ export default {
 			type: Boolean,
 			default: false,
 		},
+		locked: {
+			type: Boolean,
+			required: true,
+		},
 	},
 
 	computed: {
diff --git a/src/components/SidebarTabs/SharingShareDiv.vue b/src/components/SidebarTabs/SharingShareDiv.vue
index abad47654..946f83216 100644
--- a/src/components/SidebarTabs/SharingShareDiv.vue
+++ b/src/components/SidebarTabs/SharingShareDiv.vue
@@ -17,18 +17,25 @@
 		<NcActions class="share-div__actions">
 			<NcActionCaption :name="t('forms', 'Permissions')" />
 			<NcActionCheckbox
-				:checked="canAccessResults"
-				@update:checked="updatePermissionResults">
+				:model-value="canEditForm"
+				:disabled="locked"
+				@update:model-value="updatePermissionEdit">
+				{{ t('forms', 'Edit form') }}
+			</NcActionCheckbox>
+			<NcActionCheckbox
+				:model-value="canAccessResults"
+				:disabled="locked"
+				@update:model-value="updatePermissionResults">
 				{{ t('forms', 'View responses') }}
 			</NcActionCheckbox>
 			<NcActionCheckbox
-				:checked="canDeleteResults"
-				:disabled="!canAccessResults"
-				@update:checked="updatePermissionDeleteResults">
+				:model-value="canDeleteResults"
+				:disabled="!canAccessResults || locked"
+				@update:model-value="updatePermissionDeleteResults">
 				{{ t('forms', 'Delete responses') }}
 			</NcActionCheckbox>
 			<NcActionSeparator />
-			<NcActionButton @click="removeShare">
+			<NcActionButton :disabled="locked" @click="removeShare">
 				<template #icon>
 					<IconClose :size="20" />
 				</template>
@@ -68,6 +75,11 @@ export default {
 			type: Object,
 			required: true,
 		},
+
+		locked: {
+			type: Boolean,
+			required: true,
+		},
 	},
 
 	computed: {
@@ -81,6 +93,11 @@ export default {
 				this.PERMISSION_TYPES.PERMISSION_RESULTS_DELETE,
 			)
 		},
+		canEditForm() {
+			return this.share.permissions.includes(
+				this.PERMISSION_TYPES.PERMISSION_EDIT,
+			)
+		},
 		isNoUser() {
 			return this.share.shareType !== this.SHARE_TYPES.SHARE_TYPE_USER
 		},
@@ -133,6 +150,16 @@ export default {
 			)
 		},
 
+		/**
+		 * @param {boolean} hasPermission If the results_delete permission should be granted
+		 */
+		updatePermissionEdit(hasPermission) {
+			return this.updatePermission(
+				this.PERMISSION_TYPES.PERMISSION_EDIT,
+				hasPermission,
+			)
+		},
+
 		/**
 		 * Grant or remove permission from share
 		 *
diff --git a/src/components/SidebarTabs/SharingSidebarTab.vue b/src/components/SidebarTabs/SharingSidebarTab.vue
index 5dc8af5e8..51328b76d 100644
--- a/src/components/SidebarTabs/SharingSidebarTab.vue
+++ b/src/components/SidebarTabs/SharingSidebarTab.vue
@@ -5,9 +5,21 @@
 
 <template>
 	<div class="sidebar-tabs__content">
+		<NcNoteCard
+			v-if="locked"
+			type="info"
+			:heading="t('forms', 'Form is locked')"
+			:text="
+				t('forms', 'Lock by {lockedBy}, expires: {lockedUntil}', {
+					lockedBy: form.lockedBy ? form.lockedBy : form.ownerId,
+					lockedUntil:
+						lockedUntil === '' ? t('forms', 'never') : lockedUntil,
+				})
+			" />
 		<SharingSearchDiv
 			:current-shares="form.shares"
 			:show-loading="isLoading"
+			:locked="locked"
 			@add-share="addShare" />
 
 		<!-- Public Link -->
@@ -19,7 +31,7 @@
 			</div>
 			<span class="share-div__desc">{{ t('forms', 'Share link') }}</span>
 			<NcActions>
-				<NcActionButton @click="addPublicLink">
+				<NcActionButton :disabled="locked" @click="addPublicLink">
 					<template #icon>
 						<IconPlus :size="20" />
 					</template>
@@ -66,14 +78,17 @@
 						</template>
 						{{ t('forms', 'Copy embedding code') }}
 					</NcActionButton>
-					<NcActionButton v-else @click="makeEmbeddable(share)">
+					<NcActionButton
+						v-else
+						:disabled="locked"
+						@click="makeEmbeddable(share)">
 						<template #icon>
 							<IconLinkBoxVariantOutline :size="20" />
 						</template>
 						<!-- TRANSLATORS: This means the link can be embedded into external websites -->
 						{{ t('forms', 'Convert to embeddable link') }}
 					</NcActionButton>
-					<NcActionButton @click="removeShare(share)">
+					<NcActionButton :disabled="locked" @click="removeShare(share)">
 						<template #icon>
 							<IconDelete :size="20" />
 						</template>
@@ -82,6 +97,7 @@
 					<NcActionButton
 						v-if="appConfig.allowPublicLink"
 						close-after-click
+						:disabled="locked"
 						@click="addPublicLink">
 						<template #icon>
 							<IconPlus :size="20" />
@@ -144,6 +160,7 @@
 				<NcCheckboxRadioSwitch
 					id="share-switch__permit-all"
 					:checked="form.access.permitAllUsers"
+					:disabled="locked"
 					type="switch"
 					@update:checked="onPermitAllUsersChange" />
 			</div>
@@ -159,6 +176,7 @@
 				<NcCheckboxRadioSwitch
 					id="share-switch__show-to-all"
 					:checked="form.access.showToAllUsers"
+					:disabled="locked"
 					type="switch"
 					@update:checked="onShowToAllUsersChange" />
 			</div>
@@ -170,6 +188,7 @@
 				v-for="share in sortedShares"
 				:key="'share-' + share.shareType + '-' + share.shareWith"
 				:share="share"
+				:locked="locked"
 				@remove-share="removeShare"
 				@update:share="updateShare" />
 		</TransitionGroup>
@@ -186,6 +205,7 @@ import NcActions from '@nextcloud/vue/components/NcActions'
 import NcActionButton from '@nextcloud/vue/components/NcActionButton'
 import NcActionLink from '@nextcloud/vue/components/NcActionLink'
 import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import IconAccountMultiple from 'vue-material-design-icons/AccountMultiple.vue'
 import IconCodeBrackets from 'vue-material-design-icons/CodeBrackets.vue'
 import IconDelete from 'vue-material-design-icons/Delete.vue'
@@ -220,6 +240,7 @@ export default {
 		NcActionButton,
 		NcActionLink,
 		NcCheckboxRadioSwitch,
+		NcNoteCard,
 		QRDialog,
 		SharingSearchDiv,
 		SharingShareDiv,
@@ -232,6 +253,16 @@ export default {
 			type: Object,
 			required: true,
 		},
+
+		locked: {
+			type: Boolean,
+			required: true,
+		},
+
+		lockedUntil: {
+			type: String,
+			default: '',
+		},
 	},
 
 	data() {
@@ -434,6 +465,11 @@ export default {
 </script>
 
 <style lang="scss" scoped>
+.sidebar-tabs__content {
+	display: flex;
+	flex-direction: column;
+}
+
 .share-div {
 	display: flex;
 	min-height: var(--default-clickable-area);
diff --git a/src/components/SidebarTabs/TransferOwnership.vue b/src/components/SidebarTabs/TransferOwnership.vue
index ebe9cfe4b..1fc320ee1 100644
--- a/src/components/SidebarTabs/TransferOwnership.vue
+++ b/src/components/SidebarTabs/TransferOwnership.vue
@@ -10,6 +10,7 @@
 			alignment="start"
 			variant="tertiary"
 			wide
+			:disabled="locked"
 			@click="openModal">
 			<span class="transfer-button__text">{{
 				t('forms', 'Transfer ownership')
@@ -120,6 +121,11 @@ export default {
 			type: Object,
 			required: true,
 		},
+
+		locked: {
+			type: Boolean,
+			required: true,
+		},
 	},
 
 	data() {
diff --git a/src/components/TopBar.vue b/src/components/TopBar.vue
index df5bf1c87..28d71328a 100644
--- a/src/components/TopBar.vue
+++ b/src/components/TopBar.vue
@@ -53,6 +53,7 @@ const editView = {
 	icon: mdiPencil,
 	title: t('forms', 'Edit'),
 	id: 'edit',
+	disabled: false,
 }
 const resultsView = {
 	ariaLabel: t('forms', 'Show results'),
@@ -78,6 +79,11 @@ export default {
 			default: false,
 		},
 
+		locked: {
+			type: Boolean,
+			required: true,
+		},
+
 		sidebarOpened: {
 			type: Boolean,
 			default: false,
@@ -112,7 +118,10 @@ export default {
 				views.push(submitView)
 			}
 			if (this.canEdit) {
-				views.push(editView)
+				views.push({
+					...editView,
+					disabled: this.locked,
+				})
 			}
 			if (this.canSeeResults) {
 				views.push(resultsView)
diff --git a/src/mixins/ViewsMixin.js b/src/mixins/ViewsMixin.js
index 9b4bd69e5..85f135f59 100644
--- a/src/mixins/ViewsMixin.js
+++ b/src/mixins/ViewsMixin.js
@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 
+import { getCurrentUser } from '@nextcloud/auth'
 import { generateOcsUrl } from '@nextcloud/router'
 import { showError } from '@nextcloud/dialogs'
 import { emit } from '@nextcloud/event-bus'
@@ -12,6 +13,7 @@ import MarkdownIt from 'markdown-it'
 import CancelableRequest from '../utils/CancelableRequest.js'
 import OcsResponse2Data from '../utils/OcsResponse2Data.js'
 import logger from '../utils/Logger.js'
+import moment from '@nextcloud/moment'
 
 export default {
 	provide() {
@@ -92,6 +94,14 @@ export default {
 				|| this.form.description
 			)
 		},
+
+		isFormLocked() {
+			return (
+				this.form.lockedUntil === 0
+				|| (this.form.lockedUntil > moment().unix()
+					&& this.form.lockedBy !== getCurrentUser().uid)
+			)
+		},
 	},
 
 	methods: {
diff --git a/src/views/Create.vue b/src/views/Create.vue
index dd31e9a66..2ee0781c4 100644
--- a/src/views/Create.vue
+++ b/src/views/Create.vue
@@ -11,6 +11,7 @@
 		<!-- Show results & sidebar button -->
 		<TopBar
 			:archived="isFormArchived"
+			:locked="isFormLocked"
 			:permissions="form?.permissions"
 			:sidebar-opened="sidebarOpened"
 			:submission-count="form?.submissionCount"
@@ -39,6 +40,29 @@
 			</template>
 		</NcEmptyContent>
 
+		<NcEmptyContent
+			v-else-if="isFormLocked"
+			class="emtpycontent"
+			:name="t('forms', 'Form is locked')"
+			:description="
+				t(
+					'forms',
+					'Form \'{title}\' is locked by {lockedBy} and cannot be modified. The lock expires: {lockedUntil}',
+					{
+						title: form.title,
+						lockedBy: form.lockedBy,
+						lockedUntil:
+							form.lockedUntil === 0
+								? t('forms', 'never')
+								: lockedUntilFormatted,
+					},
+				)
+			">
+			<template #icon>
+				<IconLock :size="64" />
+			</template>
+		</NcEmptyContent>
+
 		<template v-else>
 			<!-- Forms title & description-->
 			<header>
@@ -279,6 +303,10 @@ export default {
 			const { datetime, ...filteredAnswerTypes } = answerTypes
 			return filteredAnswerTypes
 		},
+
+		lockedUntilFormatted() {
+			return moment(this.form.lockedUntil, 'X').fromNow()
+		},
 	},
 
 	watch: {
diff --git a/src/views/Results.vue b/src/views/Results.vue
index 25c178f46..06d1ee6d7 100644
--- a/src/views/Results.vue
+++ b/src/views/Results.vue
@@ -20,6 +20,7 @@
 
 		<TopBar
 			:archived="isFormArchived"
+			:locked="isFormLocked"
 			:permissions="form?.permissions"
 			:sidebar-opened="sidebarOpened"
 			:submission-count="form?.submissionCount"
@@ -66,7 +67,7 @@
 						@close="isDownloadActionOpened = false">
 						<template v-if="!isDownloadActionOpened">
 							<NcActionButton
-								v-if="canEditForm && !form.fileId"
+								v-if="canEditForm && !form.fileId && !isFormLocked"
 								@click="onLinkFile">
 								<template #icon>
 									<IconLink :size="20" />
@@ -92,6 +93,7 @@
 								</NcActionButton>
 								<NcActionButton
 									close-after-click
+									:disabled="isFormLocked"
 									@click="onUnlinkFile">
 									<template #icon>
 										<IconLinkVariantOff :size="20" />
@@ -482,7 +484,12 @@ export default {
 			if (this.form.partial) {
 				return false
 			}
-			return this.canEditForm && this.form.fileId && !this.form.filePath
+			return (
+				this.canEditForm
+				&& this.form.fileId
+				&& !this.form.filePath
+				&& !this.isFormLocked
+			)
 		},
 	},
 
diff --git a/src/views/Sidebar.vue b/src/views/Sidebar.vue
index 0d33c7cc7..643fa6225 100644
--- a/src/views/Sidebar.vue
+++ b/src/views/Sidebar.vue
@@ -16,6 +16,8 @@
 			</template>
 			<SharingSidebarTab
 				:form="form"
+				:locked="isFormLocked"
+				:locked-until="lockedUntilFormatted"
 				@update:formProp="onPropertyChange"
 				@add-share="onAddShare"
 				@remove-share="onRemoveShare"
@@ -29,13 +31,18 @@
 			<template #icon>
 				<IconSettings :size="20" />
 			</template>
-			<SettingsSidebarTab :form="form" @update:formProp="onPropertyChange" />
+			<SettingsSidebarTab
+				:form="form"
+				:locked="isFormLocked"
+				:locked-until="lockedUntilFormatted"
+				@update:formProp="onPropertyChange" />
 		</NcAppSidebarTab>
 	</NcAppSidebar>
 </template>
 
 <script>
 import { emit } from '@nextcloud/event-bus'
+import moment from '@nextcloud/moment'
 import NcAppSidebar from '@nextcloud/vue/components/NcAppSidebar'
 import NcAppSidebarTab from '@nextcloud/vue/components/NcAppSidebarTab'
 import IconSettings from 'vue-material-design-icons/Cog.vue'
@@ -66,6 +73,15 @@ export default {
 		},
 	},
 
+	computed: {
+		lockedUntilFormatted() {
+			if (this.form.lockedUntil === 0 || this.form.lockedUntil === null) {
+				return ''
+			}
+			return moment(this.form.lockedUntil, 'X').fromNow()
+		},
+	},
+
 	methods: {
 		onUpdateActive(active) {
 			this.$emit('update:active', active)
@@ -114,10 +130,6 @@ export default {
 	box-shadow: none;
 }
 
-.sidebar-tabs__content {
-	margin: 4px;
-}
-
 h3 {
 	font-weight: bold;
 	margin-inline-start: 8px;
diff --git a/src/views/Submit.vue b/src/views/Submit.vue
index a5a15fd6e..e0f29cd97 100644
--- a/src/views/Submit.vue
+++ b/src/views/Submit.vue
@@ -10,6 +10,7 @@
 		<TopBar
 			v-if="!publicView"
 			:archived="isArchived"
+			:locked="isFormLocked"
 			:permissions="form?.permissions"
 			:sidebar-opened="sidebarOpened"
 			:submission-count="form?.submissionCount"
diff --git a/tests/Integration/Api/ApiV3Test.php b/tests/Integration/Api/ApiV3Test.php
index f1b051edf..262679cd2 100644
--- a/tests/Integration/Api/ApiV3Test.php
+++ b/tests/Integration/Api/ApiV3Test.php
@@ -39,6 +39,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -163,6 +165,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -201,6 +205,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -288,6 +294,8 @@ public function dataGetForms() {
 						'permissions' => Constants::PERMISSION_ALL,
 						'partial' => true,
 						'submissionCount' => 3,
+						'lockedBy' => null,
+						'lockedUntil' => null,
 					],
 					[
 						'hash' => 'zyxwvutsrq654321',
@@ -298,6 +306,8 @@ public function dataGetForms() {
 						'permissions' => Constants::PERMISSION_ALL,
 						'partial' => true,
 						'submissionCount' => 0,
+						'lockedBy' => null,
+						'lockedUntil' => null,
 					]
 				]
 			]
@@ -331,7 +341,9 @@ public function dataGetSharedForms() {
 						'permissions' => [
 							'submit'
 						],
-						'partial' => true
+						'partial' => true,
+						'lockedBy' => null,
+						'lockedUntil' => null,
 					],
 				]
 			]
@@ -367,6 +379,8 @@ public function dataGetNewForm() {
 					],
 					'expires' => 0,
 					'state' => 0,
+					'lockedBy' => null,
+					'lockedUntil' => null,
 					'isAnonymous' => false,
 					'submitMultiple' => false,
 					'allowEditSubmissions' => false,
@@ -427,6 +441,8 @@ public function dataGetFullForm() {
 					],
 					'expires' => 0,
 					'state' => 0,
+					'lockedBy' => null,
+					'lockedUntil' => null,
 					'isAnonymous' => false,
 					'submitMultiple' => false,
 					'allowEditSubmissions' => false,
@@ -651,6 +667,8 @@ public function testUpdateFormProperties(array $expected): void {
 		$this->assertEquals($this->testForms[0]['id'], $data);
 
 		$expected['lastUpdated'] = time();
+		$expected['lockedBy'] = 'test';
+		$expected['lockedUntil'] = time() + 900;
 
 		// Check if form equals updated form.
 		$this->testGetFullForm($expected);
@@ -763,6 +781,8 @@ public function testUpdateQuestionProperties(array $fullFormExpected): void {
 		$this->assertEquals($this->testForms[0]['questions'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		// Check if form equals updated form.
 		$this->testGetFullForm($fullFormExpected);
@@ -809,6 +829,8 @@ public function testReorderQuestions(array $fullFormExpected): void {
 		], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		// Check if form equals updated form.
 		$this->testGetFullForm($fullFormExpected);
@@ -839,6 +861,8 @@ public function testDeleteQuestion(array $fullFormExpected) {
 		$this->assertEquals($this->testForms[0]['questions'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		$this->testGetFullForm($fullFormExpected);
 	}
@@ -924,6 +948,8 @@ public function testUpdateOptionProperties(array $fullFormExpected): void {
 		$this->assertEquals($this->testForms[0]['questions'][1]['options'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		// Check if form equals updated form.
 		$this->testGetFullForm($fullFormExpected);
@@ -952,6 +978,8 @@ public function testDeleteOption(array $fullFormExpected) {
 		$this->assertEquals($this->testForms[0]['questions'][1]['options'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 		$fullFormExpected['questions'][1]['options'][0]['order'] = 1;
 		$fullFormExpected['questions'][1]['options'][1]['order'] = 2;
 
@@ -1025,6 +1053,8 @@ public function testUpdateShare(array $fullFormExpected) {
 		$this->assertEquals($this->testForms[0]['shares'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		$this->testGetFullForm($fullFormExpected);
 	}
@@ -1052,6 +1082,8 @@ public function testDeleteShare(array $fullFormExpected) {
 		$this->assertEquals($this->testForms[0]['shares'][0]['id'], $data);
 
 		$fullFormExpected['lastUpdated'] = time();
+		$fullFormExpected['lockedBy'] = 'test';
+		$fullFormExpected['lockedUntil'] = time() + 900;
 
 		$this->testGetFullForm($fullFormExpected);
 	}
diff --git a/tests/Integration/Api/RespectAdminSettingsTest.php b/tests/Integration/Api/RespectAdminSettingsTest.php
index 135d10366..375fa5939 100644
--- a/tests/Integration/Api/RespectAdminSettingsTest.php
+++ b/tests/Integration/Api/RespectAdminSettingsTest.php
@@ -40,6 +40,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -61,6 +63,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -82,6 +86,8 @@ private function setTestForms() {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'is_anonymous' => false,
 				'submit_multiple' => false,
 				'allowEditSubmissions' => false,
@@ -112,6 +118,8 @@ private static function sharedTestForms(): array {
 				'created' => 12345,
 				'expires' => 0,
 				'state' => 0,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 				'questions' => [],
 				'shares' => [],
 				'ownerId' => 'test',
@@ -196,9 +204,11 @@ public function testAllowUpdate(): void {
 		// we do not know the ID and the update time is flaky
 		unset($data['id']);
 		unset($data['lastUpdated']);
+		$data['lockedUntil'] = null;
 
 		$expected = self::sharedTestForms()[0];
 		$expected['access'] = ['permitAllUsers' => true, 'showToAllUsers' => true];
+		$expected['lockedBy'] = 'test';
 
 		$this->assertEquals(200, $resp->getStatusCode());
 		$this->assertEquals($expected, $data);
@@ -235,6 +245,7 @@ public function testForbidUpdate(array $accessValue, array $adminConfigKeys): vo
 		// we do not know the ID or the update
 		unset($data['id']);
 		unset($data['lastUpdated']);
+		$data['lockedUntil'] = null;
 
 		$this->assertEquals(200, $resp->getStatusCode());
 		$this->assertEquals(self::sharedTestForms()[0], $data);
diff --git a/tests/Unit/Activity/ProviderTest.php b/tests/Unit/Activity/ProviderTest.php
index f0bffe25f..6b3d3f22b 100644
--- a/tests/Unit/Activity/ProviderTest.php
+++ b/tests/Unit/Activity/ProviderTest.php
@@ -67,7 +67,7 @@ public function setUp(): void {
 		$this->formMapper = $this->createMock(FormMapper::class);
 		$this->eventMerger = $this->createMock(IEventMerger::class);
 		$this->groupManager = $this->createMock(IGroupManager::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
 		$this->userManager = $this->createMock(IUserManager::class);
 		$this->l10nFactory = $this->createMock(IFactory::class);
diff --git a/tests/Unit/BackgroundJob/CleanupUploadedFilesJobTest.php b/tests/Unit/BackgroundJob/CleanupUploadedFilesJobTest.php
index a7c3093e3..18cdbba5e 100644
--- a/tests/Unit/BackgroundJob/CleanupUploadedFilesJobTest.php
+++ b/tests/Unit/BackgroundJob/CleanupUploadedFilesJobTest.php
@@ -40,7 +40,7 @@ public function setUp(): void {
 		$this->formMapper = $this->createMock(FormMapper::class);
 		$this->uploadedFileMapper = $this->createMock(UploadedFileMapper::class);
 		$time = $this->createMock(ITimeFactory::class);
-		$this->logger = $this->getMockBuilder(LoggerInterface::class)->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->cleanupUploadedFilesJob = new CleanupUploadedFilesJob(
 			$this->rootFolder,
 			$this->formMapper,
diff --git a/tests/Unit/BackgroundJob/UserDeletedJobTest.php b/tests/Unit/BackgroundJob/UserDeletedJobTest.php
index 3642caa0f..aaf48728f 100644
--- a/tests/Unit/BackgroundJob/UserDeletedJobTest.php
+++ b/tests/Unit/BackgroundJob/UserDeletedJobTest.php
@@ -31,7 +31,7 @@ public function setUp(): void {
 		parent::setUp();
 		$this->formMapper = $this->createMock(FormMapper::class);
 		$time = $this->createMock(ITimeFactory::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->userDeletedJob = new UserDeletedJob($this->formMapper, $time, $this->logger);
 	}
 
diff --git a/tests/Unit/Controller/ApiControllerTest.php b/tests/Unit/Controller/ApiControllerTest.php
index 9f4d1735c..e41f349b7 100644
--- a/tests/Unit/Controller/ApiControllerTest.php
+++ b/tests/Unit/Controller/ApiControllerTest.php
@@ -47,7 +47,6 @@ function is_uploaded_file(string|bool|null $filename) {
 use OCA\Forms\Service\ConfigService;
 use OCA\Forms\Service\FormsService;
 use OCA\Forms\Service\SubmissionService;
-use OCA\Forms\Tests\Unit\MockedMapperException;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataDownloadResponse;
@@ -80,8 +79,6 @@ class ApiControllerTest extends TestCase {
 	private $formMapper;
 	/** @var OptionMapper|MockObject */
 	private $optionMapper;
-	/** @var Question|MockObject */
-	private $question;
 	/** @var QuestionMapper|MockObject */
 	private $questionMapper;
 	/** @var ShareMapper|MockObject */
@@ -115,7 +112,6 @@ public function setUp(): void {
 		$this->answerMapper = $this->createMock(AnswerMapper::class);
 		$this->formMapper = $this->createMock(FormMapper::class);
 		$this->optionMapper = $this->createMock(OptionMapper::class);
-		$this->question = $this->createMock(Question::class);
 		$this->questionMapper = $this->createMock(QuestionMapper::class);
 		$this->shareMapper = $this->createMock(ShareMapper::class);
 		$this->submissionMapper = $this->createMock(SubmissionMapper::class);
@@ -197,11 +193,12 @@ public function throwMockedException(string $class) {
 	}
 
 	public function testGetSubmissions_invalidForm() {
-		$exception = $this->createMock(MapperException::class);
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willThrowException($exception);
+		// Simulate the service throwing the correct exception type
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('Could not find form'));
+
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmissions(1);
 	}
@@ -211,15 +208,10 @@ public function testGetSubmissions_noPermissions() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
-		$this->formsService->expects(($this->once()))
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(false);
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('The current user has no permission to get the results for this form'));
 
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmissions(1);
@@ -280,16 +272,11 @@ public function testGetSubmissions(array $submissions, array $questions, array $
 		$form->setId(1);
 		$form->setOwnerId('otherUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
 			->willReturn($form);
 
-		$this->formsService->expects(($this->once()))
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
-
 		$this->submissionService->expects($this->once())
 			->method('getSubmissions')
 			->with(1)
@@ -309,11 +296,11 @@ public function testGetSubmissions(array $submissions, array $questions, array $
 	}
 
 	public function testExportSubmissions_invalidForm() {
-		$exception = $this->createMock(MapperException::class);
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(99)
-			->willThrowException($exception);
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(99, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('Could not find form'));
+
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmissions(99, 'csv');
 	}
@@ -323,15 +310,10 @@ public function testExportSubmissions_noPermissions() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
-		$this->formsService->expects(($this->once()))
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(false);
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('The current user has no permission to get the results for this form'));
 
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmissions(1, 'csv');
@@ -342,16 +324,11 @@ public function testExportSubmissions() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
 			->willReturn($form);
 
-		$this->formsService->expects(($this->once()))
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
-
 		$csv = 'foo,bar';
 		$this->submissionService->expects($this->once())
 			->method('getSubmissionsData')
@@ -368,11 +345,10 @@ public function testExportSubmissions() {
 	}
 
 	public function testExportSubmissionsToCloud_invalidForm() {
-		$exception = $this->createMock(MapperException::class);
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willThrowException($exception);
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('Could not find form'));
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->exportSubmissionsToCloud(1, '');
 	}
@@ -407,7 +383,9 @@ public function dataTestCreateNewForm() {
 				'submissionMessage' => null,
 				'fileId' => null,
 				'fileFormat' => null,
-				'allowEditSubmissions' => false
+				'allowEditSubmissions' => false,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 			]]
 		];
 	}
@@ -446,17 +424,12 @@ public function dataCloneForm_exceptions() {
 			],
 			'not found' => [
 				'canCreate' => true,
-				'callback' => fn ($id): Form => $this->throwMockedException(MockedMapperException::class),
+				'callback' => fn ($id): Form => throw new NoSuchFormException('Could not find form'),
 				'exception' => NoSuchFormException::class
 			],
 			'not owned' => [
 				'canCreate' => true,
-				'callback' => function ($id): Form {
-					$form = new Form();
-					$form->setId($id);
-					$form->setOwnerId('otherUser');
-					return $form;
-				},
+				'callback' => fn ($id): Form => throw new NoSuchFormException('This form is not owned by the current user and user has no `edit` permission'),
 				'exception' => NoSuchFormException::class
 			]
 		];
@@ -469,9 +442,9 @@ public function testCloneForm_exceptions(bool $canCreate, $callback, string $exc
 		$this->configService->expects($this->once())
 			->method('canCreateForms')
 			->willReturn($canCreate);
-		$this->formMapper->expects($canCreate ? $this->once() : $this->never())
-			->method('findById')
-			->with(7)
+		$this->formsService->expects($canCreate ? $this->once() : $this->never())
+			->method('getFormIfAllowed')
+			->with(7, Constants::PERMISSION_EDIT)
 			->willReturnCallback($callback);
 		$this->expectException($exception);
 		$this->apiController->newForm(7);
@@ -524,8 +497,8 @@ public function testCloneForm($old, $new) {
 			->willReturn(true);
 
 		$oldForm = Form::fromParams($old);
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with(7)
 			->willReturn($oldForm);
 
@@ -574,8 +547,8 @@ public function testUploadFiles() {
 		$form->setOwnerId('currentUser');
 		$question = Question::fromParams(['formId' => 1]);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
 			->with(1)
 			->willReturn($form);
 
@@ -594,11 +567,6 @@ public function testUploadFiles() {
 				'error' => [0],
 			]);
 
-		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->with($form)
-			->willReturn(true);
-
 		$this->formsService->expects($this->once())
 			->method('canSubmit')
 			->with($form)
@@ -687,8 +655,8 @@ public function testNewSubmission_answers() {
 			5 => ['ignore unknown question'],
 		];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
 			->with(1)
 			->willReturn($form);
 
@@ -767,11 +735,10 @@ public function testNewSubmission_answers() {
 	}
 
 	public function testNewSubmission_formNotFound() {
-		$exception = $this->createMock(MapperException::class);
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
 			->with(1)
-			->willThrowException($exception);
+			->willThrowException(new NoSuchFormException('Could not find form'));
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->newSubmission(1, [], '');
 	}
@@ -795,10 +762,10 @@ public function testNewSubmission_forbiddenException($hasUserAccess, $hasFormExp
 		$form->setId(1);
 		$form->setOwnerId('admin');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
 			->with(1)
-			->willReturn($form);
+			->willThrowException(new $exception);
 
 		$this->formAccess($hasUserAccess, $hasFormExpired, $canSubmit);
 
@@ -812,8 +779,8 @@ public function testNewSubmission_validateSubmission() {
 		$form->setId(1);
 		$form->setOwnerId('admin');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
 			->with(1)
 			->willReturn($form);
 
@@ -841,15 +808,10 @@ public function testDeleteSubmissionNotFound() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects(self::once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects(self::once())
-			->method('canDeleteResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS_DELETE)
+			->willReturn($form);
 
 		$this->submissionMapper
 			->expects($this->once())
@@ -874,18 +836,12 @@ public function testDeleteSubmissionNoPermission($submissionData, $formData) {
 			->with(42)
 			->willReturn($submission);
 
-		$this->formMapper
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService
-			->expects($this->once())
-			->method('canDeleteResults')
-			->with($form)
-			->willReturn(false);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS_DELETE)
+			->willReturn($form);
 
-		$this->expectException(NoSuchFormException::class);
+		$this->expectException(OCSForbiddenException::class);
 		$this->apiController->deleteSubmission(1, 42);
 	}
 
@@ -901,16 +857,10 @@ public function testDeleteSubmission($submissionData, $formData) {
 			->with(42)
 			->willReturn($submission);
 
-		$this->formMapper
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService
-			->expects($this->once())
-			->method('canDeleteResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS_DELETE)
+			->willReturn($form);
 
 		$this->formsService
 			->expects($this->once())
@@ -957,12 +907,12 @@ public function testTransferOwnerNotOwner() {
 		$form->setHash('hash');
 		$form->setOwnerId('otherUser');
 
-		$this->formMapper
-			->method('findById')
-			->with(1)
+		$this->formsService
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_EDIT)
 			->willReturn($form);
 
-		$this->expectException(NoSuchFormException::class);
+		$this->expectException(OCSForbiddenException::class);
 		$this->apiController->updateForm(1, ['ownerId' => 'newOwner']);
 	}
 
@@ -972,11 +922,16 @@ public function testTransferNewOwnerNotFound() {
 		$form->setHash('hash');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper
-			->method('findById')
-			->with(1)
+		$this->formsService
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_EDIT)
 			->willReturn($form);
 
+		$this->formsService
+			->method('canEditForm')
+			->with($form)
+			->willReturn(true);
+
 		$this->userManager->expects($this->once())
 			->method('get')
 			->with('newOwner')
@@ -992,11 +947,16 @@ public function testTransferOwner() {
 		$form->setHash('hash');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper
-			->method('findById')
-			->with(1)
+		$this->formsService
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_EDIT)
 			->willReturn($form);
 
+		$this->formsService
+			->method('canEditForm')
+			->with($form)
+			->willReturn(true);
+
 		$newOwner = $this->createMock(IUser::class);
 		$this->userManager->expects($this->once())
 			->method('get')
@@ -1008,10 +968,10 @@ public function testTransferOwner() {
 	}
 
 	public function testGetSubmission_invalidForm() {
-		$exception = $this->createMock(MapperException::class);
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
+		$exception = $this->createMock(NoSuchFormException::class);
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
 			->willThrowException($exception);
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmission(1, 42);
@@ -1022,15 +982,10 @@ public function testGetSubmission_noPermissions() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(false);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willThrowException(new NoSuchFormException('The current user has no permission to get the results for this form'));
 
 		$this->expectException(NoSuchFormException::class);
 		$this->apiController->getSubmission(1, 42);
@@ -1041,15 +996,10 @@ public function testGetSubmission_notFound() {
 		$form->setId(1);
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willReturn($form);
 
 		$this->submissionService->expects($this->once()) // Changed from submissionMapper
 			->method('getSubmission')
@@ -1075,15 +1025,10 @@ public function testGetSubmission_success() {
 			'timestamp' => 1234567890
 		];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willReturn($form);
 
 		$this->submissionService->expects($this->once()) // Changed from submissionMapper
 			->method('getSubmission')
@@ -1115,15 +1060,10 @@ public function testGetSubmission_mismatchedFormId() {
 			'timestamp' => 1234567890
 		];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willReturn($form);
 
 		$this->submissionService->expects($this->once()) // Changed from submissionMapper
 			->method('getSubmission')
@@ -1148,15 +1088,10 @@ public function testGetSubmission_anonymousUser() {
 			'timestamp' => 1234567890
 		];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willReturn($form);
 
 		$this->submissionService->expects($this->once()) // Changed from submissionMapper
 			->method('getSubmission')
@@ -1186,15 +1121,10 @@ public function testGetSubmission_userNotFound() {
 			'timestamp' => 1234567890
 		];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with(1)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('canSeeResults')
-			->with($form)
-			->willReturn(true);
+			->method('getFormIfAllowed')
+			->with(1, Constants::PERMISSION_RESULTS)
+			->willReturn($form);
 
 		$this->submissionService->expects($this->once()) // Changed from submissionMapper
 			->method('getSubmission')
@@ -1227,19 +1157,10 @@ public function testUpdateSubmission_success() {
 		$submission->setFormId($formId);
 		$submission->setUserId($userId);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->with($form)
-			->willReturn(true);
-		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->with($form)
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
@@ -1284,17 +1205,10 @@ public function testUpdateSubmission_formNotEditable() {
 		$form->setOwnerId('formOwner');
 		$form->setAllowEditSubmissions(false); // Form does not allow edits
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->willReturn(true);
-		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->expectException(OCSBadRequestException::class);
 		$this->expectExceptionMessage('Can only update if allowEditSubmissions is set');
@@ -1311,17 +1225,10 @@ public function testUpdateSubmission_invalidAnswers() {
 		$form->setOwnerId('formOwner');
 		$form->setAllowEditSubmissions(true);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
-		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->willReturn(true);
 		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
@@ -1347,17 +1254,10 @@ public function testUpdateSubmission_submissionNotFound() {
 		$form->setOwnerId('formOwner');
 		$form->setAllowEditSubmissions(true);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
-		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->willReturn(true);
 		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
@@ -1393,17 +1293,10 @@ public function testUpdateSubmission_mismatchedFormId() {
 		$submission->setFormId(2); // Belongs to a different form
 		$submission->setUserId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
-		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->willReturn(true);
 		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
@@ -1439,17 +1332,10 @@ public function testUpdateSubmission_notOwnSubmission() {
 		$submission->setFormId($formId);
 		$submission->setUserId('anotherUser'); // Submission belongs to another user
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
 		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->willReturn(true);
-		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
 
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
@@ -1475,10 +1361,10 @@ public function testUpdateSubmission_loadForm_notFound() {
 		$submissionId = 42;
 		$answers = ['q1' => ['answer1']];
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willThrowException(new DoesNotExistException('Form not found by mapper')); // Corrected Exception
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
+			->with(1)
+			->willThrowException(new NoSuchFormException('Could not find form'));
 
 		$this->expectException(NoSuchFormException::class);
 		$this->expectExceptionMessage('Could not find form');
@@ -1493,16 +1379,10 @@ public function testUpdateSubmission_loadForm_noAccess_noShare() {
 		$form = new Form();
 		$form->setId($formId);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
-		// No share hash provided, so hasUserAccess will be checked
 		$this->formsService->expects($this->once())
-			->method('hasUserAccess')
-			->with($form)
-			->willReturn(false);
+			->method('loadFormForSubmission')
+			->with(1)
+			->willThrowException(new NoSuchFormException('Not allowed to access this form'));
 
 		$this->expectException(NoSuchFormException::class);
 		$this->expectExceptionMessage('Not allowed to access this form');
@@ -1517,21 +1397,10 @@ public function testUpdateSubmission_loadForm_formExpired() {
 		$form = new Form();
 		$form->setId($formId);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($formId)
-			->willReturn($form);
-
-		// Assuming access is granted (e.g., via user access or a valid share)
-		$this->formsService->expects($this->once())
-			->method('hasUserAccess') // Or shareMapper would be mocked if shareHash was used
-			->with($form)
-			->willReturn(true);
-
 		$this->formsService->expects($this->once())
-			->method('hasFormExpired')
-			->with($form)
-			->willReturn(true); // Form has expired
+			->method('loadFormForSubmission')
+			->with(1)
+			->willThrowException(new OCSForbiddenException('This form is no longer taking answers'));
 
 		$this->expectException(OCSForbiddenException::class);
 		$this->expectExceptionMessage('This form is no longer taking answers');
diff --git a/tests/Unit/Controller/ConfigControllerTest.php b/tests/Unit/Controller/ConfigControllerTest.php
index 47d18f037..ef6a46b5b 100644
--- a/tests/Unit/Controller/ConfigControllerTest.php
+++ b/tests/Unit/Controller/ConfigControllerTest.php
@@ -41,7 +41,7 @@ public function setUp(): void {
 
 		$this->configService = $this->createMock(ConfigService::class);
 		$this->config = $this->createMock(IConfig::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->request = $this->createMock(IRequest::class);
 
 		$this->configController = new ConfigController(
diff --git a/tests/Unit/Controller/ShareApiControllerTest.php b/tests/Unit/Controller/ShareApiControllerTest.php
index 83a4d4d4b..806f96d57 100644
--- a/tests/Unit/Controller/ShareApiControllerTest.php
+++ b/tests/Unit/Controller/ShareApiControllerTest.php
@@ -15,6 +15,7 @@
 use OCA\Forms\Db\FormMapper;
 use OCA\Forms\Db\Share;
 use OCA\Forms\Db\ShareMapper;
+use OCA\Forms\Exception\NoSuchFormException;
 use OCA\Forms\Service\CirclesService;
 use OCA\Forms\Service\ConfigService;
 use OCA\Forms\Service\FormsService;
@@ -94,7 +95,7 @@ public function setUp(): void {
 		$this->configService = $this->createMock(ConfigService::class);
 		$this->formsService = $this->createMock(FormsService::class);
 		$this->groupManager = $this->createMock(IGroupManager::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->request = $this->createMock(IRequest::class);
 		$this->userManager = $this->createMock(IUserManager::class);
 		$userSession = $this->createMock(IUserSession::class);
@@ -186,8 +187,8 @@ public function testValidNewShare(int $shareType, string $shareWith, array $perm
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -270,8 +271,8 @@ public function testNewLinkShare(int $shareType, string $shareWith, array $permi
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -326,8 +327,8 @@ public function testNewLinkShare_ExistingHash() {
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -388,8 +389,8 @@ public function testBadUserShare() {
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -412,8 +413,8 @@ public function testBadGroupShare() {
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -436,8 +437,8 @@ public function testBadCircleShare() {
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -463,8 +464,8 @@ public function testCirclesShare_circlesAppDisabled() {
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -483,10 +484,10 @@ public function testCirclesShare_circlesAppDisabled() {
 	 * Sharing a non-existing form.
 	 */
 	public function testShareUnknownForm() {
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
-			->will($this->throwException(new DoesNotExistException('Form not found')));
+			->willThrowException(new OCSNotFoundException('Form not found'));
 		;
 
 		$this->expectException(OCSNotFoundException::class);
@@ -501,12 +502,12 @@ public function testShareForeignForm() {
 		$form->setId('5');
 		$form->setOwnerId('someOtherUser');
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
-			->willReturn($form);
+			->willThrowException(new NoSuchFormException('This form is not owned by the current user'));
 
-		$this->expectException(OCSForbiddenException::class);
+		$this->expectException(NoSuchFormException::class);
 		$this->shareApiController->newShare(5, 0, 'user1');
 	}
 
@@ -525,8 +526,8 @@ public function testDeleteShare() {
 		$form = new Form();
 		$form->setId('5');
 		$form->setOwnerId('currentUser');
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
 			->willReturn($form);
 
@@ -559,20 +560,17 @@ public function testDeleteForeignShare() {
 		$share = new Share();
 		$share->setId(8);
 		$share->setFormId(5);
-		$this->shareMapper->expects($this->once())
-			->method('findById')
-			->with('8')
-			->willReturn($share);
 
 		$form = new Form();
 		$form->setId('5');
 		$form->setOwnerId('someOtherUser');
-		$this->formMapper->expects($this->once())
-			->method('findById')
+
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with('5')
-			->willReturn($form);
+			->willThrowException(new NoSuchFormException('This form is not owned by the current user'));
 
-		$this->expectException(OCSForbiddenException::class);
+		$this->expectException(NoSuchFormException::class);
 		$this->shareApiController->deleteShare(5, 8);
 	}
 
@@ -636,7 +634,7 @@ public function dataUpdateShare() {
 					'permissions' => []
 				],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSBadRequestException'
+				'exception' => OCSBadRequestException::class,
 			],
 			'invalid-permission-missing-submit' => [
 				'share' => [
@@ -651,7 +649,7 @@ public function dataUpdateShare() {
 					'permissions' => [Constants::PERMISSION_RESULTS_DELETE],
 				],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSBadRequestException'
+				'exception' => OCSBadRequestException::class,
 			],
 			// PERMISSION_RESULTS_DELETE is only allowed if PERMISSION_RESULTS is set
 			'invalid-permission-missing-results' => [
@@ -667,7 +665,7 @@ public function dataUpdateShare() {
 					'permissions' => [Constants::PERMISSION_SUBMIT, Constants::PERMISSION_RESULTS_DELETE],
 				],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSBadRequestException'
+				'exception' => OCSBadRequestException::class,
 			],
 			'invalid-permission' => [
 				'share' => [
@@ -682,7 +680,7 @@ public function dataUpdateShare() {
 					'permissions' => ['invalid']
 				],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSBadRequestException'
+				'exception' => OCSBadRequestException::class,
 			],
 			'invalid-share-type-permission' => [
 				'share' => [
@@ -698,7 +696,7 @@ public function dataUpdateShare() {
 					'permissions' => [Constants::PERMISSION_SUBMIT, Constants::PERMISSION_RESULTS]
 				],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSBadRequestException'
+				'exception' => OCSBadRequestException::class,
 			],
 			'form-not-owned' => [
 				'share' => [
@@ -711,7 +709,7 @@ public function dataUpdateShare() {
 				'formOwner' => 'otherUser',
 				'keyValuePairs' => ['permissions' => [Constants::PERMISSION_SUBMIT]],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSForbiddenException'
+				'exception' => NoSuchFormException::class,
 			],
 			'empty-key-value-pairs' => [
 				'share' => [
@@ -724,7 +722,7 @@ public function dataUpdateShare() {
 				'formOwner' => 'otherUser',
 				'keyValuePairs' => [],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSForbiddenException'
+				'exception' => OCSForbiddenException::class,
 			],
 			'invalid-key-value-pairs' => [
 				'share' => [
@@ -737,7 +735,7 @@ public function dataUpdateShare() {
 				'formOwner' => 'otherUser',
 				'keyValuePairs' => ['formId' => 6],
 				'expected' => null,
-				'exception' => '\OCP\AppFramework\OCS\OCSForbiddenException'
+				'exception' => OCSForbiddenException::class,
 			],
 		];
 	}
@@ -750,10 +748,17 @@ public function testUpdateShare(array $share, string $formOwner, array $keyValue
 		$form->setId($share['formId']);
 		$form->setOwnerId($formOwner);
 
-		$this->formMapper->expects($this->once())
-			->method('findById')
-			->with($share['formId'])
-			->willReturn($form);
+		if ($exception === NoSuchFormException::class) {
+			$this->formsService->expects($this->once())
+				->method('getFormIfAllowed')
+				->with($share['formId'])
+				->willThrowException(new NoSuchFormException('This form is not owned by the current user'));
+		} else {
+			$this->formsService->expects($this->once())
+				->method('getFormIfAllowed')
+				->with($share['formId'])
+				->willReturn($form);
+		}
 
 		$this->userManager->expects($this->any())
 			->method('get')
@@ -794,10 +799,13 @@ public function testUpdateShare(array $share, string $formOwner, array $keyValue
 		$shareEntity->setShareType($share['shareType']);
 		$shareEntity->setShareWith($share['shareWith']);
 		$shareEntity->setPermissions($share['permissions']);
-		$this->shareMapper->expects($this->once())
-			->method('findById')
-			->with($share['id'])
-			->willReturn($shareEntity);
+
+		if ($exception !== NoSuchFormException::class) {
+			$this->shareMapper->expects($this->once())
+				->method('findById')
+				->with($share['id'])
+				->willReturn($shareEntity);
+		}
 
 		$this->shareMapper->expects($exception === null ? $this->once() : $this->any())
 			->method('update')
@@ -837,8 +845,6 @@ public function testUpdateShare_NotExistingShare() {
 	 * Test update a share
 	 */
 	public function testUpdateShare_NotExistingForm() {
-		$exception = $this->createMock(MapperException::class);
-
 		$share = new Share();
 		$share->setId(1337);
 		$share->setFormId(7331);
@@ -846,20 +852,12 @@ public function testUpdateShare_NotExistingForm() {
 		$share->setShareWith('hash');
 		$share->setPermissions([]);
 
-		$this->shareMapper->expects($this->once())
-			->method('findById')
-			->with(1337)
-			->willReturn($share);
-
-		$this->formMapper->expects($this->once())
-			->method('findById')
+		$this->formsService->expects($this->once())
+			->method('getFormIfAllowed')
 			->with(7331)
-			->willThrowException($exception);
-
-		$this->logger->expects($this->exactly(2))
-			->method('debug');
+			->willThrowException(new NoSuchFormException('Could not find form'));
 
-		$this->expectException(OCSNotFoundException::class);
+		$this->expectException(NoSuchFormException::class);
 		$this->shareApiController->updateShare(7331, 1337, [Constants::PERMISSION_SUBMIT]);
 	}
 }
diff --git a/tests/Unit/FormsMigratorTest.php b/tests/Unit/FormsMigratorTest.php
index e9f22cfb5..1e7fd97b5 100644
--- a/tests/Unit/FormsMigratorTest.php
+++ b/tests/Unit/FormsMigratorTest.php
@@ -9,15 +9,11 @@
 
 use OCA\Forms\Db\AnswerMapper;
 
-// use OCA\Forms\Db\Answer;
 use OCA\Forms\Db\Form;
 use OCA\Forms\Db\FormMapper;
 use OCA\Forms\Db\OptionMapper;
-// use OCA\Forms\Db\Option;
 use OCA\Forms\Db\QuestionMapper;
-// use OCA\Forms\Db\Question;
 use OCA\Forms\Db\SubmissionMapper;
-// use OCA\Forms\Db\Submission;
 use OCA\Forms\FormsMigrator;
 use OCA\Forms\Service\FormsService;
 use OCA\Forms\Service\SubmissionService;
@@ -106,6 +102,8 @@ public function dataExport() {
     },
     "expires": 0,
 	"state": 0,
+	"lockedBy": null,
+	"lockedUntil": null,
     "isAnonymous": false,
     "submitMultiple": false,
     "allowEditSubmissions": false,
@@ -168,6 +166,8 @@ public function testExport(string $expectedJson) {
 		$form = new Form();
 		$form->setId(42);
 		$form->setState(0);
+		$form->setLockedBy(null);
+		$form->setLockedBy(null);
 		$form->setHash('abcdefg');
 		$form->setTitle('Link');
 		$form->setDescription('');
@@ -253,7 +253,7 @@ public function testExport(string $expectedJson) {
 	public function dataImport() {
 		return [
 			'exactlyOneOfEach' => [
-				'$inputJson' => '[{"title":"Link","description":"","created":1646251830,"access":{"permitAllUsers":false,"showToAllUsers":false},"expires":0,"state":0,"isAnonymous":false,"submitMultiple":false,"allowEditSubmissions":false,"showExpiration":false,"lastUpdated":123456789,"questions":[{"id":14,"order":2,"type":"multiple","isRequired":false,"text":"checkbox","description":"huhu","extraSettings":{},"options":[{"text":"ans1"}]}],"submissions":[{"userId":"anyUser@localhost","timestamp":1651354059,"answers":[{"questionId":14,"text":"ans1"}]}]}]'
+				'$inputJson' => '[{"title":"Link","description":"","created":1646251830,"access":{"permitAllUsers":false,"showToAllUsers":false},"expires":0,"state":0,"lockedBy":null,"lockedUntil":null,"isAnonymous":false,"submitMultiple":false,"allowEditSubmissions":false,"showExpiration":false,"lastUpdated":123456789,"questions":[{"id":14,"order":2,"type":"multiple","isRequired":false,"text":"checkbox","description":"huhu","extraSettings":{},"options":[{"text":"ans1"}]}],"submissions":[{"userId":"anyUser@localhost","timestamp":1651354059,"answers":[{"questionId":14,"text":"ans1"}]}]}]'
 			]
 		];
 	}
diff --git a/tests/Unit/Listener/UserDeletedListenerTest.php b/tests/Unit/Listener/UserDeletedListenerTest.php
index e120a6675..d9b4ffb65 100644
--- a/tests/Unit/Listener/UserDeletedListenerTest.php
+++ b/tests/Unit/Listener/UserDeletedListenerTest.php
@@ -32,7 +32,7 @@ class UserDeletedListenerTest extends TestCase {
 	public function setUp(): void {
 		parent::setUp();
 		$this->jobList = $this->createMock(IJobList::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->userDeletedListener = new UserDeletedListener($this->jobList, $this->logger);
 	}
 
diff --git a/tests/Unit/Service/FormsServiceTest.php b/tests/Unit/Service/FormsServiceTest.php
index f759eb45a..8953cdd86 100644
--- a/tests/Unit/Service/FormsServiceTest.php
+++ b/tests/Unit/Service/FormsServiceTest.php
@@ -106,6 +106,7 @@ class FormsServiceTest extends TestCase {
 
 	/** @var IL10N|MockObject */
 	private $l10n;
+
 	/** @var LoggerInterface|MockObject */
 	private $logger;
 
@@ -118,12 +119,11 @@ public function setUp(): void {
 		$this->shareMapper = $this->createMock(ShareMapper::class);
 		$this->submissionMapper = $this->createMock(SubmissionMapper::class);
 		$this->configService = $this->createMock(ConfigService::class);
-
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->groupManager = $this->createMock(IGroupManager::class);
 		$this->userManager = $this->createMock(IUserManager::class);
 		$this->secureRandom = $this->createMock(ISecureRandom::class);
 		$this->circlesService = $this->createMock(CirclesService::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
 		$userSession = $this->createMock(IUserSession::class);
 
 		$user = $this->createMock(IUser::class);
@@ -158,6 +158,7 @@ public function setUp(): void {
 			$this->circlesService,
 			$this->storage,
 			$this->l10n,
+			$this->logger,
 			\OCP\Server::get(IEventDispatcher::class),
 			$this->logger,
 		);
@@ -249,7 +250,9 @@ public function dataGetForm() {
 				'fileId' => null,
 				'fileFormat' => null,
 				'permissions' => Constants::PERMISSION_ALL,
-				'allowEditSubmissions' => false
+				'allowEditSubmissions' => false,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 			]]
 		];
 	}
@@ -363,6 +366,8 @@ public function dataGetPartialForm() {
 				'permissions' => Constants::PERMISSION_ALL,
 				'submissionCount' => 123,
 				'partial' => true,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 			]]
 		];
 	}
@@ -402,6 +407,8 @@ public function dataGetPartialFormShared() {
 				'submissionCount' => 123,
 				'state' => 0,
 				'partial' => true,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 			]]
 		];
 	}
@@ -463,6 +470,8 @@ public function dataGetPublicForm() {
 				],
 				'submissionMessage' => null,
 				'allowEditSubmissions' => false,
+				'lockedBy' => null,
+				'lockedUntil' => null,
 			]]
 		];
 	}
@@ -636,6 +645,7 @@ public function testGetPermissions_NotLoggedIn() {
 			$this->circlesService,
 			$this->storage,
 			$this->l10n,
+			$this->logger,
 			\OCP\Server::get(IEventDispatcher::class),
 			$this->logger,
 		);
@@ -876,6 +886,7 @@ public function testPublicCanSubmit() {
 			$this->circlesService,
 			$this->storage,
 			$this->l10n,
+			$this->logger,
 			\OCP\Server::get(IEventDispatcher::class),
 			$this->logger,
 		);
@@ -988,6 +999,7 @@ public function testHasUserAccess_NotLoggedIn() {
 			$this->circlesService,
 			$this->storage,
 			$this->l10n,
+			$this->logger,
 			\OCP\Server::get(IEventDispatcher::class),
 			$this->logger,
 		);
@@ -1220,6 +1232,7 @@ public function testNotifyNewSubmission($shares, $shareNotifications) {
 				$this->circlesService,
 				$this->storage,
 				$this->l10n,
+				$this->logger,
 				$eventDispatcher,
 				$this->logger,
 			])
diff --git a/tests/Unit/Service/SubmissionServiceTest.php b/tests/Unit/Service/SubmissionServiceTest.php
index 42b48cfe2..e02a890a0 100644
--- a/tests/Unit/Service/SubmissionServiceTest.php
+++ b/tests/Unit/Service/SubmissionServiceTest.php
@@ -93,7 +93,7 @@ public function setUp(): void {
 		$this->storage = $this->createMock(IRootFolder::class);
 		$this->config = $this->createMock(IConfig::class);
 		$this->l10n = $this->createMock(IL10N::class);
-		$this->logger = $this->getMockBuilder('Psr\Log\LoggerInterface')->getMock();
+		$this->logger = $this->createMock(LoggerInterface::class);
 		$this->mailer = $this->getMockBuilder(IMailer::class)->getMock();
 		$this->userManager = $this->createMock(IUserManager::class);
 		$userSession = $this->createMock(IUserSession::class);