diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 05677aca..52813e93 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -59,9 +59,9 @@ jobs:
       fail-fast: false
       matrix:
         nextcloud_version:
-          - "31"
           - "32"
-          # - "33"  # Disabled until all upstream apps support NC 33
+          - "33"
+          # - "34"  # Disabled until all upstream apps support NC 34
         mode:
           - "single-user"
           - "multi-user-basic"
@@ -69,14 +69,14 @@ jobs:
           - "keycloak"
         include:
           # Version-specific image pins — Renovate updates these via customManagers in renovate.json
-          # Each entry is pinned to its major version (e.g., NC 31 only gets 31.x updates)
-          - nextcloud_version: "31"
-            nextcloud_image: "docker.io/library/nextcloud:31.0.14@sha256:07ec73cc816e58d6f45a162cd53ef886462c29271a23fc68d0124cec276e3767"
+          # Each entry is pinned to its major version (e.g., NC 32 only gets 32.x updates)
           - nextcloud_version: "32"
             nextcloud_image: "docker.io/library/nextcloud:32.0.11@sha256:3ae4045d53e890680ec35e3e4349332123d959c72808aceb44930e79f1be9b9b"
-          # Disabled until all upstream apps support NC 33
-          # - nextcloud_version: "33"
-          #   nextcloud_image: "docker.io/library/nextcloud:33.0.5@sha256:56bdc45109067500fd0832fa64832b7c77a167d9394cbf5f0f4b59740b94194d"
+          - nextcloud_version: "33"
+            nextcloud_image: "docker.io/library/nextcloud:33.0.5@sha256:56bdc45109067500fd0832fa64832b7c77a167d9394cbf5f0f4b59740b94194d"
+          # Disabled until all upstream apps support NC 34
+          # - nextcloud_version: "34"
+          #   nextcloud_image: "docker.io/library/nextcloud:34.0.0@sha256:851ca6ef9da101ce3c8a32ec7b6fc65a726b380b5f466307a54c17d32fb77c9a"
 
           # Mode-specific properties
           - mode: single-user
diff --git a/renovate.json b/renovate.json
index 252c5221..2bc84776 100644
--- a/renovate.json
+++ b/renovate.json
@@ -14,10 +14,6 @@
     },
     {
       "description": "Pin each Nextcloud matrix entry to its own major version",
-      "matchDepNames": ["nextcloud-31"],
-      "allowedVersions": "/^31\\./"
-    },
-    {
       "matchDepNames": ["nextcloud-32"],
       "allowedVersions": "/^32\\./"
     },
@@ -25,6 +21,10 @@
       "matchDepNames": ["nextcloud-33"],
       "allowedVersions": "/^33\\./"
     },
+    {
+      "matchDepNames": ["nextcloud-34"],
+      "allowedVersions": "/^34\\./"
+    },
     {
       "description": "Pin docker-compose.yml Nextcloud image to 32.x",
       "matchPackageNames": ["docker.io/library/nextcloud"],
diff --git a/tests/server/login_flow/conftest.py b/tests/server/login_flow/conftest.py
index 2906e9e9..3f6e0d41 100644
--- a/tests/server/login_flow/conftest.py
+++ b/tests/server/login_flow/conftest.py
@@ -246,8 +246,14 @@ async def _complete_login_flow_v2(browser, login_url: str) -> None:
         await page.goto(login_url, wait_until="networkidle", timeout=60000)
         logger.info("Step 1 - Current URL: %s", page.url)
 
-        # Step 1: "Connect to your account" page - click "Log in"
-        login_btn = page.get_by_role("button", name="Log in")
+        # Step 1: "Connect to your account" page - click "Log in".
+        # exact=True is required: NC33's connect page also renders an
+        # "Alternative log in using app password" button, and a non-exact
+        # "Log in" name substring-matches both -> Playwright strict-mode error
+        # that was silently swallowed below, leaving the flow stuck on the
+        # connect page (every login-flow test then times out "Login Flow v2 did
+        # not complete"). NC32 has a single match, so exact=True is safe there.
+        login_btn = page.get_by_role("button", name="Log in", exact=True)
         try:
             await login_btn.wait_for(timeout=10000)
             await login_btn.click()
@@ -803,8 +809,14 @@ async def _complete_login_flow_v2_as_user(
         await page.goto(login_url, wait_until="networkidle", timeout=60000)
         logger.info("[%s] Step 1 - Current URL: %s", username, page.url)
 
-        # Step 1: "Connect to your account" page - click "Log in"
-        login_btn = page.get_by_role("button", name="Log in")
+        # Step 1: "Connect to your account" page - click "Log in".
+        # exact=True is required: NC33's connect page also renders an
+        # "Alternative log in using app password" button, and a non-exact
+        # "Log in" name substring-matches both -> Playwright strict-mode error
+        # that was silently swallowed below, leaving the flow stuck on the
+        # connect page (every login-flow test then times out "Login Flow v2 did
+        # not complete"). NC32 has a single match, so exact=True is safe there.
+        login_btn = page.get_by_role("button", name="Log in", exact=True)
         try:
             await login_btn.wait_for(timeout=10000)
             await login_btn.click()