diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e3de69f..db13d78 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,7 +35,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        nextcloud_version: ["31", "32", "33"]
+        mode: ["single-user", "multi-user-basic", "oauth", "login-flow"]
         include:
+          # Version-specific image pins — Renovate updates these via customManagers
+          # renovate: datasource=docker depName=docker.io/library/nextcloud
+          - nextcloud_version: "31"
+            nextcloud_image: "docker.io/library/nextcloud:31.0.8@sha256:92bc503ea0c19789f402b0469ecfb8df1ffea81e2bf90a45bba39063a626aa00"
+          # renovate: datasource=docker depName=docker.io/library/nextcloud
+          - nextcloud_version: "32"
+            nextcloud_image: "docker.io/library/nextcloud:32.0.6@sha256:5c4e09f72f096cd68379a8ae69f71e61d13da5a07430fc4a17c702a14e6a4267"
+          # renovate: datasource=docker depName=docker.io/library/nextcloud
+          - nextcloud_version: "33"
+            nextcloud_image: "docker.io/library/nextcloud:33.0.0@sha256:ff2cbaab14c85e587b5541e3aff4216a8a484e06424ebae661581937c0c8da0c"
+
+          # Mode-specific properties
           - mode: single-user
             profile: single-user
             markers: "(smoke and not oauth and not keycloak and not login_flow and not multi_user_basic) or (integration and not oauth and not keycloak and not login_flow and not multi_user_basic)"
@@ -72,7 +86,7 @@ jobs:
             needs-playwright: true
             extra-args: ""
 
-    name: integration (${{ matrix.mode }})
+    name: integration (${{ matrix.mode }} / nc${{ matrix.nextcloud_version }})
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -111,6 +125,7 @@ jobs:
           up-flags: "--build"
         env:
           MCP_SERVER_URL: ${{ matrix.mcp-internal-url }}
+          NEXTCLOUD_IMAGE: ${{ matrix.nextcloud_image }}
 
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
@@ -193,7 +208,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
-          name: debug-${{ matrix.mode }}
+          name: debug-${{ matrix.mode }}-nc${{ matrix.nextcloud_version }}
           path: |
             /tmp/*.png
             /tmp/docker-compose-logs.txt
diff --git a/app-hooks/post-installation/20-install-astrolabe-app.sh b/app-hooks/post-installation/20-install-astrolabe-app.sh
index 3e532b8..ea51fc2 100755
--- a/app-hooks/post-installation/20-install-astrolabe-app.sh
+++ b/app-hooks/post-installation/20-install-astrolabe-app.sh
@@ -2,12 +2,30 @@
 
 set -euox pipefail
 
-echo "Installing Astrolabe app from app store..."
+echo "Installing Astrolabe app..."
 
-if [ -d /var/www/html/custom_apps/astrolabe ]; then
+# Check if development astrolabe app is mounted at /opt/apps/astrolabe
+if [ -d /opt/apps/astrolabe ]; then
+    echo "Development astrolabe app found at /opt/apps/astrolabe"
+
+    # Remove any existing astrolabe app in custom_apps (from app store or old symlink)
+    if [ -e /var/www/html/custom_apps/astrolabe ]; then
+        echo "Removing existing astrolabe in custom_apps..."
+        rm -rf /var/www/html/custom_apps/astrolabe
+    fi
+
+    # Create symlink from custom_apps to the mounted development version
+    # Per Nextcloud docs: apps outside server root need symlinks in server root
+    echo "Creating symlink: custom_apps/astrolabe -> /opt/apps/astrolabe"
+    ln -sf /opt/apps/astrolabe /var/www/html/custom_apps/astrolabe
+
+    echo "Enabling astrolabe app from /opt/apps (development mode via symlink)"
+    php /var/www/html/occ app:enable astrolabe
+elif [ -d /var/www/html/custom_apps/astrolabe ]; then
     echo "astrolabe app directory found in custom_apps (already installed)"
     php /var/www/html/occ app:enable astrolabe
 else
+    echo "astrolabe app not found, installing from app store..."
     php /var/www/html/occ app:install astrolabe
     php /var/www/html/occ app:enable astrolabe
 fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 7ba1d8a..19cdb30 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,7 +23,7 @@ services:
     restart: always
 
   app:
-    image: docker.io/library/nextcloud:32.0.6@sha256:5c4e09f72f096cd68379a8ae69f71e61d13da5a07430fc4a17c702a14e6a4267
+    image: ${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud:32.0.6@sha256:5c4e09f72f096cd68379a8ae69f71e61d13da5a07430fc4a17c702a14e6a4267}
     restart: always
     ports:
       - 127.0.0.1:8080:80
diff --git a/renovate.json b/renovate.json
index 7ad33c2..bcfa4ed 100644
--- a/renovate.json
+++ b/renovate.json
@@ -10,5 +10,15 @@
       "matchPackageNames": ["pillow"],
       "allowedVersions": "<12.0.0"
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.github/workflows/test\\.yml$"],
+      "matchStrings": [
+        "nextcloud_image:\\s*\"(?<depName>[^:]+):(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\""
+      ],
+      "datasourceTemplate": "docker"
+    }
   ]
 }
diff --git a/third_party/astrolabe b/third_party/astrolabe
index 5189670..672f572 160000
--- a/third_party/astrolabe
+++ b/third_party/astrolabe
@@ -1 +1 @@
-Subproject commit 518967002265df0cfdad35a61feba0b4b968259f
+Subproject commit 672f572d5f2d6ece5c33c9c703164c78b3b9a395