diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml
index 267424d..3181028 100644
--- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml
+++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml
@@ -111,15 +111,30 @@
   # ---------------------------------------------------------------
   # 4. PHP + extensions
   # ---------------------------------------------------------------
+  #
+  #  Ubuntu 24.04 ships PHP 8.3, Ubuntu 26.04 ships PHP 8.5. Two
+  #  packaging changes had to be accounted for between these releases:
+  #
+  #  1. php{v}-opcache no longer exists from PHP 8.5 onward — opcache
+  #     is compiled into core/-common. Omit that package name on 8.5+.
+  #
+  #  2. libapache2-mod-php{v} was missing from the original package
+  #     list entirely. Without it, Apache has no PHP handler and none
+  #     of the /etc/php/{v}/apache2/ SAPI files (php.ini, conf.d/)
+  #     get created by the packaging scripts in the first place —
+  #     this is what caused the opcache.ini blockinfile task to have
+  #     nothing to attach to. Added explicitly below.
+  #
     - name: Build PHP package list
       ansible.builtin.set_fact:
         nc_php_packages: >-
           {{
             [
-              'php{v}', 'php{v}-cli', 'php{v}-common', 'php{v}-curl', 'php{v}-gd',
-              'php{v}-gmp', 'php{v}-imagick', 'php{v}-intl', 'php{v}-mbstring',
-              'php{v}-mysql', 'php{v}-readline', 'php{v}-redis', 'php{v}-xml',
-              'php{v}-zip', 'php{v}-bcmath', 'php{v}-apcu'
+              'php{v}', 'php{v}-cli', 'php{v}-common', 'libapache2-mod-php{v}',
+              'php{v}-curl', 'php{v}-gd', 'php{v}-gmp', 'php{v}-imagick',
+              'php{v}-intl', 'php{v}-mbstring', 'php{v}-mysql', 'php{v}-readline',
+              'php{v}-redis', 'php{v}-xml', 'php{v}-zip', 'php{v}-bcmath',
+              'php{v}-apcu'
             ] | map('replace', '{v}', nc_php_version) | list
             + (['php{v}-opcache'.replace('{v}', nc_php_version)] if nc_php_version is version('8.5', '<') else [])
           }}
@@ -130,6 +145,14 @@
         state: present
       notify: Restart Apache
 
+    - name: Ensure PHP Apache SAPI conf.d directory exists
+      ansible.builtin.file:
+        path: "/etc/php/{{ nc_php_version }}/apache2/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
     - name: Configure PHP for Nextcloud (php.ini tweaks)
       ansible.builtin.lineinfile:
         path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
@@ -165,6 +188,15 @@
   # ---------------------------------------------------------------
   # 5. MariaDB
   # ---------------------------------------------------------------
+  #
+  #  Note: Ubuntu 26.04 moves MariaDB's data directory from
+  #  /var/lib/mysql to /var/lib/mariadb, and mariadb-server becomes
+  #  a thin compatibility metapackage over the "mariadb" packaging.
+  #  Neither of these changes affects this playbook: we never
+  #  reference the data directory path directly, and the client
+  #  socket path (/var/run/mysqld/mysqld.sock) is unchanged across
+  #  24.04–26.04, so login_unix_socket below still works as-is.
+  #
     - name: Install MariaDB server
       ansible.builtin.apt:
         name: