diff --git a/templates/nextcloud/.felhom.yml b/templates/nextcloud/.felhom.yml
index 61e3ea0..d8a660c 100644
--- a/templates/nextcloud/.felhom.yml
+++ b/templates/nextcloud/.felhom.yml
@@ -10,7 +10,7 @@ subdomain: "cloud"
 slug: "nextcloud"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-22"
+catalog_since: "2026-09-23"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -175,3 +175,4 @@ i18n:
 # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
 update_ladder:
   - {"from": {"nextcloud": "nextcloud:34.0.1-apache", "nextcloud-db": "mariadb:11.6", "nextcloud-redis": "redis:7-alpine"}, "to": {"nextcloud": "nextcloud:34.0.1-apache", "nextcloud-db": "mariadb:12.3", "nextcloud-redis": "redis:7-alpine"}, "digest": {"nextcloud": "sha256:b52f7bc0e496f227b0e85e3b88571a42c68b6245ccde29d577e733227715dcf5", "nextcloud-db": "sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1", "nextcloud-redis": "sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499"}, "verdict": "proven", "tested_at": "2026-09-21T19:37:10.235635+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/nextcloud-engine-mariadb/verdict.json", "memory_peak_pct": null, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit 39374d5; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image; the commit cited no record — this one was named by the backfill because its from/to refs are the commit's and the commit describes the same walk"}
+  - {"from": {"nextcloud": "nextcloud:34.0.1-apache", "nextcloud-db": "mariadb:12.3", "nextcloud-redis": "redis:7-alpine"}, "to": {"nextcloud": "nextcloud:34.0.4-apache", "nextcloud-db": "mariadb:12.3", "nextcloud-redis": "redis:7-alpine"}, "digest": {"nextcloud": "sha256:a5ace30c695afe48c2c406e940ee7886a81e13fa382e57cd68b2416d1a66914c", "nextcloud-db": "sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1", "nextcloud-redis": "sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499"}, "verdict": "proven", "tested_at": "2026-09-23T20:16:04Z", "harness_version": 3, "evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/nextcloud/bench/evidence/MV-nextcloud/verdict.json", "box_evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/nextcloud/verdict.json", "memory_peak_pct": 24.2, "marks": {"files_may_change": true, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0}
diff --git a/templates/nextcloud/docker-compose.yml b/templates/nextcloud/docker-compose.yml
index e546d9a..5990547 100644
--- a/templates/nextcloud/docker-compose.yml
+++ b/templates/nextcloud/docker-compose.yml
@@ -13,7 +13,7 @@
 
 services:
   nextcloud:
-    image: nextcloud:34.0.1-apache
+    image: nextcloud:34.0.4-apache
     container_name: nextcloud
     restart: unless-stopped
     depends_on: