diff --git a/.woodpecker/keycloak.yaml b/.woodpecker/keycloak.yaml
index 2f76bd8..06eed66 100644
--- a/.woodpecker/keycloak.yaml
+++ b/.woodpecker/keycloak.yaml
@@ -19,8 +19,7 @@ workspace:
 # Also because global environment variables aren't a thing.
 matrix:
   KEYCLOAK_VERSION:
-    # renovate: datasource=docker depName=quay.io/keycloak/keycloak
-    - 26.6.0
+    - 25.0
   IMAGE_NAME:
   - git.hamburg.ccc.de/ccchh/oci-images/keycloak
 
@@ -30,15 +29,6 @@ steps:
     commands:
       - mkdir /woodpecker/images
 
-  - name: build-attribute-endpoints-provider
-    image: alpine
-    commands:
-      - apk -u add maven git
-      - git clone https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider.git
-      - cd keycloak-attribute-endpoints-provider
-      - mvn -f attribute-endpoints-provider verify
-      - cp attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar /woodpecker/src/keycloak/attribute-endpoints-provider.jar
-
   - name: build-image
     image: gcr.io/kaniko-project/executor
     entrypoint:
@@ -52,9 +42,8 @@ steps:
 
   - name: publish-image
     image: alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -64,9 +53,8 @@ steps:
     image: alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -76,9 +64,9 @@ steps:
     image: alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+        evaluate: 'KEYCLOAK_VERSION == "25.0"'
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
diff --git a/.woodpecker/nextcloud.yaml b/.woodpecker/nextcloud.yaml
index 4639448..feea22e 100644
--- a/.woodpecker/nextcloud.yaml
+++ b/.woodpecker/nextcloud.yaml
@@ -19,9 +19,8 @@ workspace:
 # Also because global environment variables aren't a thing.
 matrix:
   NEXTCLOUD_VERSION:
-    - 30
-    - 31
-    - 32
+    - 28
+    - 29
   IMAGE_NAME:
     - git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 
@@ -44,9 +43,8 @@ steps:
 
   - name: publish-image
     image: docker.io/library/alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -56,9 +54,8 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -68,10 +65,9 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-        evaluate: 'NEXTCLOUD_VERSION == "29"'
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+        evaluate: 'NEXTCLOUD_VERSION == "28"'
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
diff --git a/.woodpecker/penpot.yaml b/.woodpecker/penpot.yaml
index 8cedcbe..6bb8e0a 100644
--- a/.woodpecker/penpot.yaml
+++ b/.woodpecker/penpot.yaml
@@ -44,10 +44,7 @@ steps:
       # https://github.com/penpot/penpot/pull/4945
       # https://github.com/penpot/penpot/pull/4945/commits/752574bac789cc90cc218004bb9545cc6239895d
       - curl https://github.com/penpot/penpot/commit/752574bac789cc90cc218004bb9545cc6239895d.patch > 0001-move-entire-image-build-process-into-Dockerfiles.patch
-      # Get patch disallowing registration with invitation token, when disable-login-with-password flag is set.
-      # https://github.com/penpot/penpot/issues/4975
-      # https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0
-      - curl https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0.patch > 0002-hotfix-dont-allow-registration-with-invite-if-password-login-is-disabled.patch
+      - curl https://github.com/june128/penpot/commit/4d5c787478ddc612aec4d25b2f059d63a226a6d1.patch > 0002-testing.patch
       - git config user.name "Woodpecker"
       - git config user.email "woodpecker@woodpecker.invalid"
       - git am *.patch
@@ -64,9 +61,8 @@ steps:
 
   - name: publish-image
     image: docker.io/library/alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -76,9 +72,8 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -89,9 +84,8 @@ steps:
     when:
       - branch: main
         evaluate: 'PENPOT_VERSION == "2.1.2"'
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
diff --git a/keycloak/Containerfile b/keycloak/Containerfile
index f3f6c1e..7f5fa4c 100644
--- a/keycloak/Containerfile
+++ b/keycloak/Containerfile
@@ -2,10 +2,8 @@ ARG TAG=latest
 FROM quay.io/keycloak/keycloak:${TAG} as builder
 
 ENV KC_DB=postgres
-ENV KC_FEATURES=declarative-ui
 
 WORKDIR /opt/keycloak
-ADD --chown=keycloak:keycloak --chmod=644 attribute-endpoints-provider.jar /opt/keycloak/providers/attribute-endpoints-provider.jar
 RUN /opt/keycloak/bin/kc.sh build
 
 FROM quay.io/keycloak/keycloak:${TAG}
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index 7f0cc8d..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ],
-  "customManagers": [
-    // Custom manager using regex for letting Renovate find dependencies in woodpecker Matrix variables.
-    {
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/^\\.woodpecker/.*\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: packageName=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?\\s*-\\s*[\"']?(?<currentValue>.+?)[\"']?\\s"
-      ]
-    }
-  ]
-}