diff --git a/extension/src/shared/messages.ts b/extension/src/shared/messages.ts
index 3c59bc4..8bd1744 100644
--- a/extension/src/shared/messages.ts
+++ b/extension/src/shared/messages.ts
@@ -65,7 +65,7 @@ export type PopupMessage =
   | { type: 'generate_recovery_qr'; passphrase: string }
   | { type: 'unwrap_recovery_qr'; payload_b64: string; passphrase: string }
   | { type: 'create_vault'; config: VaultConfig; passphrase: string;
-      carrierImageBytes: ArrayBuffer; deviceName: string }
+      secondFactor?: 'image' | 'keyfile'; carrierImageBytes: ArrayBuffer; deviceName: string }
   | { type: 'attach_vault'; config: VaultConfig; passphrase: string;
       referenceImageBytes: ArrayBuffer; deviceName: string }
   | { type: 'get_vault_status' };
@@ -208,7 +208,10 @@ export interface ImportLastPassCommitResponse extends Extract<Response, { ok: tr
 }
 
 export interface CreateVaultResponse extends Extract<Response, { ok: true }> {
-  data: { referenceImageBytes: Uint8Array; deviceName: string;
+  // Image-mode vaults return referenceImageBytes (the stego JPEG); key-file-mode
+  // vaults return relkeyBytes (the armored .relkey) for the wizard to download.
+  // Exactly one is present per the chosen second factor.
+  data: { referenceImageBytes?: Uint8Array; relkeyBytes?: Uint8Array; deviceName: string;
           recoveryQrAvailable: true };
 }