diff --git a/scripts/taler-monitoring/check_versions.sh b/scripts/taler-monitoring/check_versions.sh
new file mode 100755
index 0000000..eed9e5f
--- /dev/null
+++ b/scripts/taler-monitoring/check_versions.sh
@@ -0,0 +1,469 @@
+#!/usr/bin/env bash
+# Area versions-### — Taler packages vs deb.taler.net (trixie) + repo availability.
+#
+# Checks:
+#   1) deb.taler.net apt endpoints reachable (InRelease / Packages / sample .deb)
+#   2) containers can reach deb.taler.net (install path from inside)
+#   3) installed taler*/libeufin*/libtaler*/libdonau* versions vs suite index
+#
+# Env:
+#   TALER_APT_SUITE=trixie
+#   TALER_APT_BASE=https://deb.taler.net/apt/debian
+#   TALER_APT_INDEX=…/dists/trixie/main/binary-amd64/Packages
+#   TALER_APT_TESTING_INDEX=…/dists/trixie-testing/…
+#   TALER_PKG_BEHIND=warn|error   (default: core packages ERROR if behind, else warn)
+#   SKIP_SSH=1                    skip container install checks
+set -euo pipefail
+ROOT=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=lib.sh
+source "$ROOT/lib.sh"
+
+set_area versions
+
+SUITE="${TALER_APT_SUITE:-trixie}"
+APT_BASE="${TALER_APT_BASE:-https://deb.taler.net/apt/debian}"
+APT_BASE="${APT_BASE%/}"
+INDEX="${TALER_APT_INDEX:-${APT_BASE}/dists/${SUITE}/main/binary-amd64/Packages}"
+INRELEASE="${TALER_APT_INRELEASE:-${APT_BASE}/dists/${SUITE}/InRelease}"
+TESTING_INDEX="${TALER_APT_TESTING_INDEX:-${APT_BASE}/dists/${SUITE}-testing/main/binary-amd64/Packages}"
+BEHIND_MODE="${TALER_PKG_BEHIND:-warn}"
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+http_get() {
+  # usage: http_get URL [outfile]  → prints http_code; body to outfile or /dev/null
+  local url="$1" out="${2:-/dev/null}"
+  curl -sS --max-time 30 -L -o "$out" -w '%{http_code}' "$url" 2>/dev/null || echo 000
+}
+
+# ---------------------------------------------------------------------------
+# 1) OUTSIDE — deb.taler.net install source (runner / laptop, no SSH)
+# ---------------------------------------------------------------------------
+section "versions · outside · deb.taler.net (${SUITE})"
+
+# DNS
+HOST_APT="${APT_BASE#https://}"; HOST_APT="${HOST_APT#http://}"; HOST_APT="${HOST_APT%%/*}"
+if getent hosts "$HOST_APT" >/dev/null 2>&1 \
+  || python3 -c "import socket; socket.getaddrinfo('${HOST_APT}', 443)" >/dev/null 2>&1; then
+  ip=$(python3 -c "import socket; print(socket.getaddrinfo('${HOST_APT}',443)[0][4][0])" 2>/dev/null || true)
+  ok "outside DNS ${HOST_APT}" "${ip:-resolved}"
+else
+  fail "outside DNS ${HOST_APT}" "unresolvable — cannot use as apt source"
+fi
+
+# HTTPS portal / apt root
+code=$(http_get "https://${HOST_APT}/")
+[ "$code" = "200" ] && ok "outside https://${HOST_APT}/" "HTTP $code" \
+  || warn "outside https://${HOST_APT}/" "HTTP $code"
+
+code=$(http_get "${APT_BASE}/")
+case "$code" in
+  200|301|302) ok "outside apt base" "${APT_BASE}/ HTTP $code" ;;
+  *) fail "outside apt base" "${APT_BASE}/ HTTP $code" ;;
+esac
+
+# Suite metadata (what apt update needs)
+code=$(http_get "$INRELEASE" "$tmp/InRelease")
+if [ "$code" = "200" ] && [ -s "$tmp/InRelease" ]; then
+  ok "outside InRelease" "${SUITE} HTTP 200 · $(wc -c <"$tmp/InRelease" | tr -d ' ') bytes"
+else
+  fail "outside InRelease" "HTTP $code — $INRELEASE (apt update will fail)"
+fi
+
+RELEASE_URL="${APT_BASE}/dists/${SUITE}/Release"
+code=$(http_get "$RELEASE_URL" "$tmp/Release")
+[ "$code" = "200" ] && ok "outside Release" "${SUITE} HTTP 200" \
+  || warn "outside Release" "HTTP $code — $RELEASE_URL"
+
+# Packages (plain) — required for version compare
+code=$(http_get "$INDEX" "$tmp/Packages")
+if [ "$code" = "200" ] && [ -s "$tmp/Packages" ] && grep -q '^Package: ' "$tmp/Packages"; then
+  n_pkg=$(grep -c '^Package: ' "$tmp/Packages" || true)
+  ok "outside Packages" "${SUITE} HTTP 200 · ${n_pkg} packages"
+else
+  fail "outside Packages" "HTTP $code — $INDEX"
+  # still try more probes, but cannot compare versions without index
+fi
+
+# Packages.gz (apt often prefers this)
+PKGZ_URL="${APT_BASE}/dists/${SUITE}/main/binary-amd64/Packages.gz"
+code=$(http_get "$PKGZ_URL" "$tmp/Packages.gz")
+if [ "$code" = "200" ] && [ -s "$tmp/Packages.gz" ]; then
+  ok "outside Packages.gz" "${SUITE} HTTP 200 · $(wc -c <"$tmp/Packages.gz" | tr -d ' ') bytes"
+else
+  warn "outside Packages.gz" "HTTP $code — apt may still use plain Packages"
+fi
+
+# Sample pool .deb downloadable (proves packages are installable, not just listed)
+if [ -s "$tmp/Packages" ]; then
+  DEB_PATH=$(awk '
+    /^Package: taler-exchange$/ { p=1 }
+    p && /^Filename: / { sub(/^Filename: /,""); print; exit }
+    p && /^$/ { p=0 }
+  ' "$tmp/Packages")
+  [ -z "$DEB_PATH" ] && DEB_PATH=$(awk '
+    /^Package: taler-merchant$/ { p=1 }
+    p && /^Filename: / { sub(/^Filename: /,""); print; exit }
+    p && /^$/ { p=0 }
+  ' "$tmp/Packages")
+  if [ -n "$DEB_PATH" ]; then
+    DEB_URL="${APT_BASE}/${DEB_PATH}"
+    code=$(curl -sS --max-time 30 -o /dev/null -w '%{http_code}' -r 0-128 "$DEB_URL" 2>/dev/null || echo 000)
+    case "$code" in
+      200|206)
+        ok "outside pool .deb" "$(basename "$DEB_PATH") HTTP $code"
+        ;;
+      *)
+        fail "outside pool .deb" "HTTP $code — $DEB_URL (index ok but debs not fetchable)"
+        ;;
+    esac
+  else
+    warn "outside pool .deb" "no Filename for taler-exchange/merchant in index"
+  fi
+
+  for pkg in taler-exchange taler-merchant libeufin-bank; do
+    ver=$(awk -v p="$pkg" '
+      $0=="Package: "p { hit=1; next }
+      hit && /^Version: / { sub(/^Version: /,""); print; exit }
+      hit && /^$/ { hit=0 }
+    ' "$tmp/Packages")
+    if [ -n "$ver" ]; then
+      ok "outside suite offers ${pkg}" "$ver"
+    else
+      fail "outside suite offers ${pkg}" "missing from ${SUITE} Packages"
+    fi
+  done
+fi
+
+HAVE_TESTING=0
+code=$(http_get "$TESTING_INDEX" "$tmp/Packages-testing")
+if [ "$code" = "200" ] && [ -s "$tmp/Packages-testing" ] && grep -q '^Package: ' "$tmp/Packages-testing"; then
+  HAVE_TESTING=1
+  ok "outside ${SUITE}-testing Packages" "HTTP 200 (optional compare)"
+else
+  info "outside ${SUITE}-testing Packages" "HTTP ${code:-000} (optional)"
+fi
+
+# TLS: certificate verify (curl default) already used above; explicit openssl probe if available
+if command -v openssl >/dev/null 2>&1; then
+  if echo | openssl s_client -servername "$HOST_APT" -connect "${HOST_APT}:443" 2>/dev/null \
+    | grep -q 'Verify return code: 0'; then
+    ok "outside TLS ${HOST_APT}" "verify ok"
+  else
+    # curl succeeded with default CA — soft warn only
+    warn "outside TLS ${HOST_APT}" "openssl verify not clean (curl may still work)"
+  fi
+fi
+
+# Need Packages index for later compare
+if [ ! -s "$tmp/Packages" ] || ! grep -q '^Package: ' "$tmp/Packages"; then
+  fail "outside Packages usable" "cannot continue version compare without suite index"
+  summary
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# 2) INSIDE — containers can reach deb.taler.net (pasta / install path)
+# ---------------------------------------------------------------------------
+section "versions · inside · containers → deb.taler.net"
+
+if [ "${SKIP_SSH}" = "1" ]; then
+  warn "ssh" "SKIP_SSH=1 — skip container reachability + installed package compare"
+  info "outside-only" "deb.taler.net public checks completed above"
+  summary
+  exit 0
+fi
+if ! koopa_ssh_ok; then
+  err "ssh" "cannot reach ${KOOPA_SSH} — set SKIP_SSH=1 to skip container checks"
+  info "outside-only" "deb.taler.net public checks completed above"
+  summary
+  exit 1
+fi
+ok "ssh ${KOOPA_SSH}"
+
+INRELEASE_URL="${APT_BASE}/dists/${SUITE}/InRelease"
+# Write remote script to a file (avoids bash 3.2 parse bugs with case/;; inside $(…)<<heredoc).
+{
+  printf 'INRELEASE_URL=%q\n' "$INRELEASE_URL"
+  cat <<'REMOTE'
+set +e
+resolve_ctr() {
+  local want="$1" c
+  c=$(podman ps --format '{{.Names}}' 2>/dev/null | grep -Fx "$want" | head -1)
+  if [ -n "$c" ]; then echo "$c"; return; fi
+  case "$want" in
+    *exchange*) podman ps --format '{{.Names}}' 2>/dev/null | grep -i exchange | head -1 ;;
+    *bank*)     podman ps --format '{{.Names}}' 2>/dev/null | grep -iE 'hacktivism-bank|taler-bank' | head -1 ;;
+    *)
+      c=$(podman ps --format '{{.Names}}' 2>/dev/null | grep -E '^taler-hacktivism$' | head -1)
+      if [ -n "$c" ]; then echo "$c"; return; fi
+      podman ps --format '{{.Names}}' 2>/dev/null | grep -iE 'merchant|hacktivism' | grep -viE 'bank|exchange' | head -1
+      ;;
+  esac
+}
+for want in taler-hacktivism-exchange-ansible taler-hacktivism-bank taler-hacktivism; do
+  c=$(resolve_ctr "$want")
+  [ -n "$c" ] || continue
+  role=other
+  case "$c" in
+    *exchange*) role=exchange ;;
+    *bank*)     role=bank ;;
+    *)          role=merchant ;;
+  esac
+  code=$(podman exec "$c" curl -sS -m 12 -o /dev/null -w '%{http_code}' "$INRELEASE_URL" 2>/dev/null || echo 000)
+  echo "R|${role}|${c}|${code}"
+  if podman exec "$c" bash -lc 'grep -Rqs deb.taler.net /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null'; then
+    echo "S|${role}|${c}|yes"
+  else
+    echo "S|${role}|${c}|no"
+  fi
+  podman exec "$c" dpkg-query -W -f '${Package}\t${Version}\n' 2>/dev/null \
+    | awk -v role="$role" -v ctr="$c" '
+        $1 ~ /^(taler-|libeufin-|libtaler|libdonau)/ {
+          printf "P|%s|%s|%s|%s\n", role, ctr, $1, $2
+        }'
+done
+REMOTE
+} >"$tmp/remote-versions.sh"
+
+REMOTE_OUT=$(koopa_ssh_bash 60 <"$tmp/remote-versions.sh" || true)
+
+printf '%s\n' "$REMOTE_OUT" | grep -E '^R\|' >"$tmp/reach.tsv" || true
+printf '%s\n' "$REMOTE_OUT" | grep -E '^S\|' >"$tmp/sources.tsv" || true
+printf '%s\n' "$REMOTE_OUT" | grep -E '^P\|' >"$tmp/installed.tsv" || true
+
+if [ -s "$tmp/reach.tsv" ]; then
+  while IFS='|' read -r _ role ctr code; do
+    if [ "$code" = "200" ]; then
+      ok "container ${role} → deb.taler.net" "${ctr} InRelease HTTP $code"
+    else
+      fail "container ${role} → deb.taler.net" "${ctr} InRelease HTTP $code — apt install/update will fail"
+    fi
+  done <"$tmp/reach.tsv"
+else
+  warn "container → deb.taler.net" "no reachability rows"
+fi
+
+if [ -s "$tmp/sources.tsv" ]; then
+  while IFS='|' read -r _ role ctr has; do
+    if [ "$has" = "yes" ]; then
+      ok "container ${role} apt source" "${ctr} lists deb.taler.net"
+    else
+      warn "container ${role} apt source" "${ctr} no deb.taler.net in sources.list*"
+    fi
+  done <"$tmp/sources.tsv"
+fi
+
+if [ ! -s "$tmp/installed.tsv" ]; then
+  fail "installed packages" "none found in taler containers"
+  summary
+  exit 1
+fi
+n_inst=$(wc -l <"$tmp/installed.tsv" | tr -d ' ')
+ok "collected installed packages" "${n_inst} rows"
+
+# ---------------------------------------------------------------------------
+# 3) compare installed vs trixie (and note testing)
+# ---------------------------------------------------------------------------
+section "versions · compare installed vs ${SUITE}"
+
+export BEHIND_MODE HAVE_TESTING
+export TALER_APT_SUITE="$SUITE"
+CORE_PKGS="taler-exchange taler-exchange-database taler-merchant taler-merchant-webui libeufin-bank libeufin-common libtalerexchange libtalermerchant taler-terms-generator"
+export CORE_PKGS
+
+python3 - "$tmp/Packages" "$tmp/Packages-testing" "$tmp/installed.tsv" <<'PY' >"$tmp/py.out"
+import sys, os
+from collections import defaultdict
+
+main_idx, test_idx, inst_path = sys.argv[1:4]
+have_testing = os.environ.get("HAVE_TESTING", "0") == "1"
+core = set(os.environ.get("CORE_PKGS", "").split())
+suite = os.environ.get("TALER_APT_SUITE", "trixie")
+
+def _ord_ch(c):
+    if c == "~":
+        return -1
+    if c.isdigit():
+        return 0
+    if c.isalpha():
+        return ord(c)
+    return ord(c) + 256
+
+def _split_ver(v):
+    epoch = 0
+    if ":" in v:
+        e, v = v.split(":", 1)
+        try:
+            epoch = int(e)
+        except ValueError:
+            epoch = 0
+    if "-" in v:
+        upstream, deb = v.rsplit("-", 1)
+    else:
+        upstream, deb = v, ""
+    return epoch, upstream, deb
+
+def _cmp_part(a, b):
+    ia = ib = 0
+    while ia < len(a) or ib < len(b):
+        while True:
+            ca = a[ia] if ia < len(a) and not a[ia].isdigit() else ""
+            cb = b[ib] if ib < len(b) and not b[ib].isdigit() else ""
+            if ca == "" and cb == "":
+                break
+            if ca == "" and cb:
+                return -1 if _ord_ch(cb) > 0 else (1 if cb == "~" else -1)
+            if cb == "" and ca:
+                return 1 if _ord_ch(ca) > 0 else (-1 if ca == "~" else 1)
+            oa, ob = _ord_ch(ca), _ord_ch(cb)
+            ia += 1
+            ib += 1
+            if oa != ob:
+                return (oa > ob) - (oa < ob)
+        sa = sb = ""
+        while ia < len(a) and a[ia].isdigit():
+            sa += a[ia]; ia += 1
+        while ib < len(b) and b[ib].isdigit():
+            sb += b[ib]; ib += 1
+        na = int(sa) if sa else 0
+        nb = int(sb) if sb else 0
+        if na != nb:
+            return (na > nb) - (na < nb)
+    return 0
+
+def deb_cmp(a, b):
+    if a == b:
+        return 0
+    ea, ua, da = _split_ver(a)
+    eb, ub, db = _split_ver(b)
+    if ea != eb:
+        return (ea > eb) - (ea < eb)
+    c = _cmp_part(ua, ub)
+    if c:
+        return c
+    return _cmp_part(da, db)
+
+def parse_packages(path):
+    pkgs = {}
+    if not path or not os.path.isfile(path) or os.path.getsize(path) == 0:
+        return pkgs
+    cur = ver = None
+    with open(path, encoding="utf-8", errors="replace") as f:
+        for line in f:
+            line = line.rstrip("\n")
+            if line.startswith("Package: "):
+                if cur and ver and (cur not in pkgs or deb_cmp(ver, pkgs[cur]) > 0):
+                    pkgs[cur] = ver
+                cur = line[9:].strip()
+                ver = None
+            elif line.startswith("Version: ") and cur:
+                ver = line[9:].strip()
+            elif line == "" and cur:
+                if ver and (cur not in pkgs or deb_cmp(ver, pkgs[cur]) > 0):
+                    pkgs[cur] = ver
+                cur = ver = None
+        if cur and ver and (cur not in pkgs or deb_cmp(ver, pkgs[cur]) > 0):
+            pkgs[cur] = ver
+    return pkgs
+
+main = parse_packages(main_idx)
+testing = parse_packages(test_idx) if have_testing else {}
+
+by_pkg = defaultdict(list)
+with open(inst_path, encoding="utf-8") as f:
+    for line in f:
+        line = line.strip()
+        if not line.startswith("P|"):
+            continue
+        parts = line.split("|")
+        if len(parts) < 5:
+            continue
+        _, role, ctr, pkg, ver = parts[:5]
+        by_pkg[pkg].append((role, ctr, ver))
+
+for pkg in sorted(by_pkg.keys()):
+    versions = sorted({v for _, _, v in by_pkg[pkg]}, key=lambda v: v)
+    # pick "highest" via deb_cmp
+    inst = versions[0]
+    for v in versions[1:]:
+        if deb_cmp(v, inst) > 0:
+            inst = v
+    roles = ",".join(sorted({r for r, _, _ in by_pkg[pkg]}))
+    multi = len(set(versions)) > 1
+    trixie = main.get(pkg)
+    testv = testing.get(pkg)
+    status = "ok"
+    detail = ""
+    if multi:
+        status = "warn"
+        detail = "multiple installed: " + ", ".join(sorted(set(versions)))
+    if trixie is None:
+        if status == "ok":
+            status = "info"
+        detail = (detail + "; " if detail else "") + f"not in {suite} main index"
+    else:
+        c = deb_cmp(inst, trixie)
+        if c == 0:
+            detail = (detail + "; " if detail else "") + f"= {suite} {trixie}"
+        elif c < 0:
+            status = "behind"
+            detail = f"installed {inst} < {suite} {trixie}"
+        else:
+            status = "ahead"
+            detail = f"installed {inst} > {suite} {trixie}"
+            if testv and deb_cmp(inst, testv) == 0:
+                detail += f" (={suite}-testing)"
+            elif testv:
+                detail += f" (testing has {testv})"
+    core_flag = "1" if pkg in core else "0"
+    print(f"{status}|{pkg}|{inst}|{trixie or '-'}|{roles}|{core_flag}|{detail}")
+PY
+
+ok_n=0; ahead_n=0; behind_n=0
+while IFS='|' read -r status pkg inst trixie roles core detail; do
+  [ -n "${status:-}" ] || continue
+  label="pkg ${pkg} (${roles})"
+  case "$status" in
+    ok)
+      ok "$label" "${inst}"
+      ok_n=$((ok_n + 1))
+      ;;
+    ahead)
+      info "$label" "$detail"
+      ahead_n=$((ahead_n + 1))
+      ;;
+    behind)
+      behind_n=$((behind_n + 1))
+      if [ "$core" = "1" ] || [ "$BEHIND_MODE" = "error" ]; then
+        fail "$label" "$detail"
+      else
+        warn "$label" "$detail"
+      fi
+      ;;
+    warn)
+      warn "$label" "$detail"
+      ;;
+    info)
+      info "$label" "installed ${inst}${detail:+ — $detail}"
+      ;;
+    *)
+      info "$label" "$status $detail"
+      ;;
+  esac
+done <"$tmp/py.out"
+
+# Core packages must exist somewhere
+for need in taler-exchange libeufin-bank taler-merchant; do
+  if grep -qE "^P\|[^|]+\|[^|]+\|${need}\|" "$tmp/installed.tsv"; then
+    ok "core installed ${need}"
+  else
+    fail "core installed ${need}" "not present in any taler container"
+  fi
+done
+
+info "suite" "deb.taler.net ${SUITE} (testing_index=${HAVE_TESTING})"
+info "tally" "match=${ok_n} ahead=${ahead_n} behind=${behind_n}"
+
+summary