diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c937b089..07c99cb26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* **role:nextcloud**: The `support` app is enabled by default, as Nextcloud ships it, so an Enterprise instance keeps its subscription record current.
 * **role:postgresql_server**: A changed `pg_hba.conf` or `postgresql_server__conf_password_encryption` reloads PostgreSQL instead of restarting it, so open connections are kept; the first run after the update still restarts it once.
 * **role:postgresql_server**: The configuration is checked before PostgreSQL is restarted, so a broken setting in `postgresql.conf` or `pg_hba.conf` aborts the run with the error message instead of leaving PostgreSQL down after the restart.
 * **role:postfix**: The SMTP greeting banner no longer names Postfix or the OS (`<hostname> ESMTP LFOps`), which satisfies the Lynis check MAIL-8818.
@@ -146,6 +147,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **role:nextcloud**: A Nextcloud upgrade no longer logs an error from a repair step of the `dav` app and no longer rebuilds the calendar search index every time.
+* **role:nextcloud**: The admin section of the `support` app is hidden again.
 * **role:monitoring_plugins**: The package install works on SLE, where it failed with `No provider of 'linuxfabrik-monitoring-plugins-<version>*' found`.
 * **role:postgresql_server**: `postgresql-dump` also saves the roles and tablespaces (`globals.sql.gz`), without which a restored database fails on every object owner, no longer skips the `postgres` database and databases whose name starts with `template`, and uses the client tools of the installed PostgreSQL version.
 * **role:postgresql_server**: Clients connecting to `localhost` are accepted over IPv6 as well, where they were rejected with `no pg_hba.conf entry for host "::1"`.
diff --git a/extensions/molecule/setup_nextcloud/verify.yml b/extensions/molecule/setup_nextcloud/verify.yml
index 54ed7b941..48e5dc39e 100644
--- a/extensions/molecule/setup_nextcloud/verify.yml
+++ b/extensions/molecule/setup_nextcloud/verify.yml
@@ -37,6 +37,54 @@
           - '(__molecule__nextcloud_statusphp_result["content"] | from_json)["installed"] | bool'
         fail_msg: 'status.php did not report installed. response: {{ __molecule__nextcloud_statusphp_result["content"] | d("") }}'
 
+    # The support app keeps the subscription record of an Enterprise instance current. Its admin
+    # section stays hidden only while `hide-app` holds the literal string `yes`, a boolean `1`
+    # shows it again.
+    - name: 'php occ app:list --output=json (as the web server user)'
+      ansible.builtin.command: 'php /var/www/html/nextcloud/occ app:list --output=json'
+      args:
+        chdir: '/var/www/html/nextcloud/'
+      become_user: 'apache'
+      register: '__molecule__nextcloud_app_list_result'
+      changed_when: false
+
+    - name: 'Assert the support app is enabled'
+      ansible.builtin.assert:
+        that:
+          - '"support" in (__molecule__nextcloud_app_list_result["stdout"] | from_json)["enabled"]'
+        fail_msg: 'The support app is not enabled, so the subscription record of an Enterprise instance is never renewed.'
+
+    - name: 'php occ config:app:get support hide-app (as the web server user)'
+      ansible.builtin.command: 'php /var/www/html/nextcloud/occ config:app:get support hide-app'
+      args:
+        chdir: '/var/www/html/nextcloud/'
+      become_user: 'apache'
+      register: '__molecule__nextcloud_support_hide_app_result'
+      changed_when: false
+
+    - name: 'Assert the support admin section is hidden'
+      ansible.builtin.assert:
+        that:
+          - '__molecule__nextcloud_support_hide_app_result["stdout"] | trim == "yes"'
+        fail_msg: 'support hide-app is "{{ __molecule__nextcloud_support_hide_app_result["stdout"] | trim }}", the support app hides its admin section only on "yes".'
+
+    # The dav repair step that queues the calendar search index rebuild skips itself only on the
+    # literal string `yes`. A boolean `1` makes it queue the rebuild on every upgrade and then
+    # fail with a type conflict when it writes `yes` back.
+    - name: 'php occ config:app:get dav buildCalendarSearchIndex (as the web server user)'
+      ansible.builtin.command: 'php /var/www/html/nextcloud/occ config:app:get dav buildCalendarSearchIndex'
+      args:
+        chdir: '/var/www/html/nextcloud/'
+      become_user: 'apache'
+      register: '__molecule__nextcloud_dav_search_index_result'
+      changed_when: false
+
+    - name: 'Assert the calendar search index repair step is marked as done'
+      ansible.builtin.assert:
+        that:
+          - '__molecule__nextcloud_dav_search_index_result["stdout"] | trim == "yes"'
+        fail_msg: 'dav buildCalendarSearchIndex is "{{ __molecule__nextcloud_dav_search_index_result["stdout"] | trim }}", the dav repair step skips itself only on "yes".'
+
 
 # The role installs mysql-selinux so mariadbd gets `mysqld_exec_t` (MDEV-30520). Assert the domain
 # of the running process, not the label on the file: only that tells `mysqld_t` apart from
diff --git a/roles/nextcloud/README.md b/roles/nextcloud/README.md
index 8e8554288..5777807ab 100644
--- a/roles/nextcloud/README.md
+++ b/roles/nextcloud/README.md
@@ -142,6 +142,7 @@ nextcloud__users:
 * List of dictionaries containing key-value pairs for configuring apps in Nextcloud.
 * Type: List of dictionaries.
 * Default: Have a look at [defaults/main.yml](https://github.com/Linuxfabrik/lfops/blob/main/roles/nextcloud/defaults/main.yml)
+* Deviates from the upstream default `'no'` for `support hide-app`: the Support section is hidden from the administration settings. Set it to `'no'` to enter an Enterprise subscription key there. The `support` app only accepts the string `'yes'`, not a boolean.
 * Subkeys:
 
     * `key`:
diff --git a/roles/nextcloud/defaults/main.yml b/roles/nextcloud/defaults/main.yml
index ab7d39d9a..0f643ed79 100644
--- a/roles/nextcloud/defaults/main.yml
+++ b/roles/nextcloud/defaults/main.yml
@@ -23,8 +23,7 @@ nextcloud__app_configs__role_var:
     type: 'integer'
     state: 'present'
   - key: 'dav buildCalendarSearchIndex'
-    value: true
-    type: 'boolean'
+    value: 'yes'
     state: 'present'
   - key: 'password_policy enforceHaveIBeenPwned'
     value: true
@@ -38,8 +37,7 @@ nextcloud__app_configs__role_var:
     value: 'ch'
     state: 'present'
   - key: 'support hide-app'
-    value: true
-    type: 'boolean'
+    value: 'yes'  # upstream default: 'no'
     state: 'present'
   - key: 'text workspace_available'
     value: false
@@ -142,7 +140,7 @@ nextcloud__apps__role_var:
   - name: 'sharebymail'
     state: 'enabled'
   - name: 'support'
-    state: 'disabled'
+    state: 'enabled'
   - name: 'survey_client'
     state: 'disabled'
   - name: 'systemtags'