diff --git a/src/lib/views/TranscriptNotes.svelte b/src/lib/views/TranscriptNotes.svelte
index e913aac..114fa54 100644
--- a/src/lib/views/TranscriptNotes.svelte
+++ b/src/lib/views/TranscriptNotes.svelte
@@ -6,17 +6,9 @@
   import { meetings } from "../stores/meetings.svelte";
   import { settings } from "../stores/settings.svelte";
   import { api, type SpeakerInfo } from "../api";
-  import { marked } from "marked";
-  import DOMPurify from "dompurify";
+  import { renderMarkdown } from "../markdown";
   import { save, open } from "@tauri-apps/plugin-dialog";
 
-  // Notes can contain pasted/typed Markdown from anywhere; this webview has an
-  // IPC bridge to the Rust backend, so unsanitized `{@html}` here would be a
-  // real local-privilege risk, not just a cosmetic one — sanitize before render.
-  function renderNotes(markdown: string): string {
-    return DOMPurify.sanitize(marked.parse(markdown || "") as string);
-  }
-
   function speakerName(label: string, speakers: SpeakerInfo[] = []): string {
     return speakers.find((s) => s.label === label)?.display_name ?? label;
   }
@@ -159,8 +151,8 @@
             oninput={scheduleSave}
             placeholder="Notes…"
           ></textarea>
-          <!-- eslint-disable-next-line svelte/no-at-html-tags -- sanitized via DOMPurify in renderNotes() -->
-          <div class="preview">{@html renderNotes(notesText)}</div>
+          <!-- eslint-disable-next-line svelte/no-at-html-tags -- sanitized via renderMarkdown() -->
+          <div class="preview">{@html renderMarkdown(notesText)}</div>
         </div>
       </div>
     </div>