diff --git a/scripts/taler-monitoring/check_urls.sh b/scripts/taler-monitoring/check_urls.sh
index 7191609..36520d4 100755
--- a/scripts/taler-monitoring/check_urls.sh
+++ b/scripts/taler-monitoring/check_urls.sh
@@ -841,6 +841,97 @@ PY
   fi
   check_url_soft "merchant /webui/" 200 "$MERCHANT_PUBLIC/webui/"
   check_url_soft "merchant /" 302,301,200 "$MERCHANT_PUBLIC/"
+
+  # --- merchant SPA fingerprints (selfbuild / package overlay) ---
+  # version.txt = SPA package version (e.g. 1.6.11)
+  # version-overlay.txt = optional deploy stamp (selfbuild-v1.6.11-0e4807845)
+  # Env:
+  #   EXPECT_WEBUI_VERSION=1.6.11     → fail if version.txt ≠
+  #   EXPECT_WEBUI_OVERLAY=substr     → fail if overlay missing that substr
+  #   WEBUI_OVERLAY_DENY=regex        → fail if overlay matches (e.g. master-11340)
+  #   CHECK_WEBUI_SPA=0               → skip this block
+  if [ "${CHECK_WEBUI_SPA:-1}" = "1" ]; then
+    set_group webui
+    section "www · merchant SPA /webui/ fingerprints"
+    vcode=$(http_body "$MERCHANT_PUBLIC/webui/version.txt" "$tmp/webui-version.txt")
+    if [ "$vcode" = "200" ] && [ -s "$tmp/webui-version.txt" ]; then
+      got_ver=$(tr -d ' \n\r\t' <"$tmp/webui-version.txt")
+      ok "merchant /webui/version.txt" "HTTP 200 · ${got_ver}"
+      if [ -n "${EXPECT_WEBUI_VERSION:-}" ]; then
+        if [ "$got_ver" = "${EXPECT_WEBUI_VERSION}" ]; then
+          ok "merchant webui version pin" "EXPECT_WEBUI_VERSION=${EXPECT_WEBUI_VERSION}"
+        else
+          fail "merchant webui version pin" "got ${got_ver} want ${EXPECT_WEBUI_VERSION}"
+        fi
+      else
+        info "merchant webui version" "${got_ver} (set EXPECT_WEBUI_VERSION= to pin)"
+      fi
+    else
+      if [ "${LOCAL_STACK:-1}" = "1" ]; then
+        fail "merchant /webui/version.txt" "HTTP ${vcode:-000} (SPA missing version stamp)"
+      else
+        warn "merchant /webui/version.txt" "HTTP ${vcode:-000}"
+      fi
+    fi
+
+    ocode=$(http_body "$MERCHANT_PUBLIC/webui/version-overlay.txt" "$tmp/webui-overlay.txt")
+    if [ "$ocode" = "200" ] && [ -s "$tmp/webui-overlay.txt" ]; then
+      got_ov=$(tr -d '\n\r' <"$tmp/webui-overlay.txt" | head -c 200)
+      ok "merchant /webui/version-overlay.txt" "HTTP 200 · ${got_ov}"
+      if [ -n "${EXPECT_WEBUI_OVERLAY:-}" ]; then
+        case "$got_ov" in
+          *"${EXPECT_WEBUI_OVERLAY}"*)
+            ok "merchant webui overlay pin" "contains ${EXPECT_WEBUI_OVERLAY}"
+            ;;
+          *)
+            fail "merchant webui overlay pin" "got «${got_ov}» want substr ${EXPECT_WEBUI_OVERLAY}"
+            ;;
+        esac
+      fi
+      if [ -n "${WEBUI_OVERLAY_DENY:-}" ]; then
+        if printf '%s' "$got_ov" | grep -qE -- "${WEBUI_OVERLAY_DENY}"; then
+          fail "merchant webui overlay deny" "«${got_ov}» matches WEBUI_OVERLAY_DENY=${WEBUI_OVERLAY_DENY}"
+        else
+          ok "merchant webui overlay deny" "no match for ${WEBUI_OVERLAY_DENY}"
+        fi
+      fi
+    else
+      # Overlay is optional for pure package installs; warn on local selfbuild stacks
+      if [ "${LOCAL_STACK:-1}" = "1" ]; then
+        warn "merchant /webui/version-overlay.txt" "HTTP ${ocode:-000} (optional; selfbuild writes it)"
+      else
+        info "merchant /webui/version-overlay.txt" "HTTP ${ocode:-000} (optional)"
+      fi
+    fi
+
+    # Core SPA assets (paths used by selfbuild dist/prod).
+    # index.js is large — longer timeout; normalize curl "200000" (200 + ||000).
+    _webui_asset_code() {
+      local url="$1" tmo="${2:-${TIMEOUT}}"
+      local raw
+      raw=$(curl -skS --max-redirs 0 -m "$tmo" -o /dev/null -w '%{http_code}' "$url" 2>/dev/null || true)
+      # take first 3 digits only (avoid 200000 glue when curl exits non-zero after writing code)
+      printf '%s' "$raw" | tr -cd '0-9' | head -c 3
+      [ -n "$(printf '%s' "$raw" | tr -cd '0-9')" ] || printf '000'
+    }
+    for asset in index.html index.js; do
+      tmo="${TIMEOUT}"
+      [ "$asset" = "index.js" ] && tmo="${WEBUI_INDEX_JS_TIMEOUT:-60}"
+      acode=$(_webui_asset_code "$MERCHANT_PUBLIC/webui/${asset}" "$tmo")
+      case "$acode" in
+        200) ok "merchant /webui/${asset}" "HTTP 200" ;;
+        *)
+          if [ "${LOCAL_STACK:-1}" = "1" ]; then
+            fail "merchant /webui/${asset}" "HTTP ${acode:-000}"
+          else
+            warn "merchant /webui/${asset}" "HTTP ${acode:-000}"
+          fi
+          ;;
+      esac
+    done
+    # return group for any later merchant checks in this block
+    set_group merchant
+  fi
 fi
 
 # Merchant legal docs