diff --git a/playbooks/nextcloud-upgrade.yml b/playbooks/nextcloud-upgrade.yml
index 7706d76..302e57a 100644
--- a/playbooks/nextcloud-upgrade.yml
+++ b/playbooks/nextcloud-upgrade.yml
@@ -1,7 +1,7 @@
 ---
-- name: Upgrade Nextcloud via CLI on Rocky Linux
-  become: yes
+- name: Safe Nextcloud upgrade on Rocky Linux
   hosts: all
+  become: yes
   vars:
     nextcloud_dir: /var/www/nextcloud
     web_user: apache
@@ -9,60 +9,151 @@
     service_name: httpd
 
   tasks:
-    - name: Reminder to ensure backups
+
+    - name: Reminder - ensure backups exist
       debug:
-        msg: "⚠️ Ensure database and data directory backups are taken before running upgrade!"
+        msg: "⚠️ Ensure you have valid DB + data directory backups before upgrade!"
 
-    - name: Enable maintenance mode
-      command: "{{ php_cli }} occ maintenance:mode --on"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-
-    - name: Run Nextcloud CLI updater (non-interactive)
-      command: "{{ php_cli }} updater/updater.phar --no-interaction"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-
-    - name: Perform Nextcloud database upgrade
-      command: "{{ php_cli }} occ upgrade"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-
-    - name: Run DB maintenance - add missing indices
-      command: "{{ php_cli }} occ db:add-missing-indices"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-      ignore_errors: yes
-
-    - name: Run DB maintenance - convert bigint fields
-      command: "{{ php_cli }} occ db:convert-filecache-bigint --no-interaction"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-      ignore_errors: yes
-
-    - name: Disable maintenance mode
-      command: "{{ php_cli }} occ maintenance:mode --off"
-      args:
-        chdir: "{{ nextcloud_dir }}"
-      become_user: "{{ web_user }}"
-
-    - name: Restart Apache (httpd)
-      service:
-        name: "{{ service_name }}"
-        state: restarted
-
-    - name: Verify Nextcloud version and status
+    # ----------------------------------------------------------------------
+    # Step 1: Check current version
+    # ----------------------------------------------------------------------
+    - name: Get current Nextcloud version
       command: "{{ php_cli }} occ status"
       args:
         chdir: "{{ nextcloud_dir }}"
       become_user: "{{ web_user }}"
       register: occ_status
+      changed_when: false
+      failed_when: occ_status.rc != 0 and "'installed: true'" not in occ_status.stdout
 
-    - name: Display Nextcloud version info
+    - name: Parse current version
+      set_fact:
+        current_version: "{{ occ_status.stdout | regex_search('versionstring: (.*)', '\\1') | first | default('unknown') }}"
+      when: occ_status.stdout is defined
+
+    - name: Show current version
       debug:
-        var: occ_status.stdout
+        msg: "Current Nextcloud version: {{ current_version }}"
+
+    # ----------------------------------------------------------------------
+    # Step 2: Enable maintenance mode
+    # ----------------------------------------------------------------------
+    - name: Enable maintenance mode
+      command: "{{ php_cli }} occ maintenance:mode --on"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+
+    # ----------------------------------------------------------------------
+    # Step 3: Run updater safely with retry
+    # ----------------------------------------------------------------------
+    - name: Run Nextcloud CLI updater (non-interactive)
+      block:
+
+        - name: Execute updater (first attempt)
+          command: "{{ php_cli }} updater/updater.phar --no-interaction"
+          args:
+            chdir: "{{ nextcloud_dir }}"
+          become_user: "{{ web_user }}"
+          environment:
+            TMPDIR: /tmp
+          register: updater_result
+          failed_when: false
+
+        - name: Detect signature verification failure
+          debug:
+            msg: "Signature verification failed, cleaning downloads before retry."
+          when: "'Signature of update is not valid' in updater_result.stdout"
+
+        - name: Clean failed update downloads if signature invalid
+          file:
+            path: "{{ nextcloud_dir }}/data"
+            state: directory
+          when: "'Signature of update is not valid' in updater_result.stdout"
+
+        - name: Retry updater if signature invalid
+          command: "{{ php_cli }} updater/updater.phar --no-interaction"
+          args:
+            chdir: "{{ nextcloud_dir }}"
+          become_user: "{{ web_user }}"
+          environment:
+            TMPDIR: /tmp
+          when: "'Signature of update is not valid' in updater_result.stdout"
+          register: updater_result_retry
+          failed_when: false
+
+        - name: Check updater success
+          fail:
+            msg: "Nextcloud updater failed. Check updater log or rerun manually."
+          when:
+            - updater_result.rc != 0
+            - "'Nextcloud is already latest version' not in updater_result.stdout"
+            - "'Update successful' not in updater_result.stdout"
+            - "'Update successful' not in (updater_result_retry.stdout | default(''))"
+
+    # ----------------------------------------------------------------------
+    # Step 4: Run database upgrade + cleanup
+    # ----------------------------------------------------------------------
+    - name: Run occ upgrade
+      command: "{{ php_cli }} occ upgrade"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+
+    - name: Add missing indices (optional)
+      command: "{{ php_cli }} occ db:add-missing-indices"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+      ignore_errors: yes
+
+    - name: Convert filecache bigint fields (optional)
+      command: "{{ php_cli }} occ db:convert-filecache-bigint --no-interaction"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+      ignore_errors: yes
+
+    # ----------------------------------------------------------------------
+    # Step 5: Disable maintenance mode
+    # ----------------------------------------------------------------------
+    - name: Disable maintenance mode
+      command: "{{ php_cli }} occ maintenance:mode --off"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+      ignore_errors: yes
+
+    # ----------------------------------------------------------------------
+    # Step 6: Restart web service
+    # ----------------------------------------------------------------------
+    - name: Restart Apache httpd
+      service:
+        name: "{{ service_name }}"
+        state: restarted
+
+    # ----------------------------------------------------------------------
+    # Step 7: Verify upgrade result
+    # ----------------------------------------------------------------------
+    - name: Check new Nextcloud version
+      command: "{{ php_cli }} occ status"
+      args:
+        chdir: "{{ nextcloud_dir }}"
+      become_user: "{{ web_user }}"
+      environment:
+        TMPDIR: /tmp
+      register: occ_status_after
+
+    - name: Display new version info
+      debug:
+        var: occ_status_after.stdout