diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml
index 3b870ba..fc0f723 100644
--- a/.forgejo/workflows/build_keycloak.yml
+++ b/.forgejo/workflows/build_keycloak.yml
@@ -19,7 +19,7 @@ jobs:
       matrix:
         keycloak-version:
           # renovate: datasource=docker depName=quay.io/keycloak/keycloak
-          - 26.8.2
+          - 26.7.2
     steps:
       - name: Install required system packages
         run: apk add --no-cache nodejs
diff --git a/.forgejo/workflows/build_nextcloud.yml b/.forgejo/workflows/build_nextcloud.yml
index 4d2e866..cdf5a23 100644
--- a/.forgejo/workflows/build_nextcloud.yml
+++ b/.forgejo/workflows/build_nextcloud.yml
@@ -10,16 +10,40 @@ on:
     - cron: "@daily"
 
 jobs:
-  build-container:
-    name: Build Nextcloud ${{ matrix.nextcloud-version }} Image
+  get-versions:
+    name: Determine viable Nextcloud versions
     runs-on: docker
+    container:
+      image: docker.io/library/python:3.14-slim
+
+    outputs:
+      versions: ${{ steps.matrix.outputs.versions }}
+
+    steps:
+      - name: Install required system package
+        run: apt-get update; apt-get install -y --no-install-recommends --no-install-suggests nodejs
+
+      - name: Install required pip package
+        run: pip install requests
+
+      - name: Checkout source code
+        uses: actions/checkout@v7
+
+      - name: Generate Nextcloud version matrix
+        id: matrix
+        shell: sh
+        run: python3 ${{ forgejo.workspace }}/nextcloud/get_versions_to_be_built.py
+
+  build-container:
+    name: Build Nextcloud Image
+    runs-on: docker
+    needs: get-versions
     container:
       image: ghcr.io/osscontainertools/kaniko:alpine
     strategy:
       matrix:
-        nextcloud-version:
-          # renovate: datasource=docker depName=docker.io/library/nextcloud
-          - 34
+        nextcloud-version: ${{ fromJSON(needs.get-versions.outputs.versions) }}
+
     steps:
       - name: Install required system packages
         run: apk add --no-cache nodejs git
diff --git a/nextcloud/99-security-hardening.ini b/nextcloud/99-security-hardening.ini
deleted file mode 100644
index 80c7593..0000000
--- a/nextcloud/99-security-hardening.ini
+++ /dev/null
@@ -1,16 +0,0 @@
-; Whether to use strict session mode.
-; Strict session mode does not accept an uninitialized session ID, and
-; regenerates the session ID if the browser sends an uninitialized session ID.
-; Strict mode protects applications from session fixation via a session adoption
-; vulnerability. It is disabled by default for maximum compatibility, but
-; enabling it is encouraged.
-; https://wiki.php.net/rfc/strict_sessions
-session.use_strict_mode = 1\
-
-; Enable upload progress tracking in $_SESSION
-; Default Value: On
-; Development Value: On
-; Production Value: On
-; https://php.net/session.upload-progress.enabled
-; Warum, siehe hier: https://www.php.net/archive/2026.php#2026-10-23-1
-session.upload_progress.enabled = Off
diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile
index a1fa572..d76a998 100644
--- a/nextcloud/Containerfile
+++ b/nextcloud/Containerfile
@@ -1,8 +1,6 @@
 ARG TAG
 FROM git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${TAG}
 
-COPY 99-security-hardening.ini /usr/local/etc/php/conf.d/99-security-hardening.ini
-
 RUN apt-get update \
     && apt-get install -y supervisor \
     && rm -rf /var/lib/apt/lists/* \
diff --git a/nextcloud/get_versions_to_be_built.py b/nextcloud/get_versions_to_be_built.py
new file mode 100644
index 0000000..8ddc752
--- /dev/null
+++ b/nextcloud/get_versions_to_be_built.py
@@ -0,0 +1,51 @@
+import datetime
+import json
+import os
+import re
+
+import requests
+
+endoflife_nextcloud_url = "https://endoflife.date/api/v1/products/nextcloud/"
+ansible_nextcloud_vars_url =  "https://git.hamburg.ccc.de/CCCHH/ansible-infra/raw/branch/main/inventories/chaosknoten/host_vars/cloud.yaml"
+ansible_nextcloud_vars_regex = r"(?m)^\s*nextcloud__version:\s*(\d+)\s*$"
+
+releases_to_be_built = []
+
+
+# get the currently installed Nextcloud version
+nc_vars = requests.get(ansible_nextcloud_vars_url).text
+match = re.search(ansible_nextcloud_vars_regex, nc_vars)
+if match:
+    current_version = int(match.group(1))
+    releases_to_be_built.append(current_version)
+else:
+    raise ValueError("nextcloud__version not found")
+
+
+# determine the current Nextcloud versions
+eol_data = requests.get(endoflife_nextcloud_url).text
+eol_json = json.loads(eol_data)
+
+now = datetime.datetime.now()
+format_string = '%Y-%m-%d'
+viable_releases = []
+
+for release in eol_json["result"]["releases"]:
+    # only check releases which are not EOL
+    if release['isEol'] is True:
+        continue
+    # parse release date
+    release_datetime = datetime.datetime.strptime(release['releaseDate'], format_string)
+
+    # only consider releases older than half a year
+    if release_datetime < now - datetime.timedelta(days=180):
+        version = int(release['name'])
+        print(f"{version} released on {release['releaseDate']}")
+        if version > current_version:
+            releases_to_be_built.append(version)
+
+versions = [str(v) for v in releases_to_be_built]
+print(versions)
+
+with open(os.environ["FORGEJO_OUTPUT"], "a") as output:
+    output.write(f"versions={json.dumps(versions)}\n")