diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ddc2409f0..dbfe54ba7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -67,10 +67,39 @@ jobs:
             10.0.201
 
       - name: Run build pipeline script
-        run: bash ./build/build.sh
+        shell: bash
+        run: |
+          set -euo pipefail
+          LEGACY_VERSION="${NBGV_SemVer2}"
+          UMBRACO18_VERSION="7.${LEGACY_VERSION#*.}"
+
+          ARTICULATE_PACKAGE_LANE=legacy \
+          ARTICULATE_PACKAGE_VERSION="$LEGACY_VERSION" \
+          PACK_SAMPLE_THEME=true \
+          bash ./build/build.sh
+
+          ARTICULATE_PACKAGE_LANE=umbraco18 \
+          ARTICULATE_PACKAGE_VERSION="$UMBRACO18_VERSION" \
+          PACK_SAMPLE_THEME=true \
+          bash ./build/build.sh
+
+      - name: Export package versions
+        shell: bash
+        run: |
+          set -euo pipefail
+          LEGACY_VERSION="${NBGV_SemVer2}"
+          UMBRACO18_VERSION="7.${LEGACY_VERSION#*.}"
+          echo "LEGACY_VERSION=$LEGACY_VERSION" >> "$GITHUB_ENV"
+          echo "UMBRACO18_VERSION=$UMBRACO18_VERSION" >> "$GITHUB_ENV"
+
+      - name: Upload v6 packages
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: Articulate-v6-${{ env.LEGACY_VERSION }}
+          path: build/Release/legacy/Articulate.*
 
-      - name: Upload packages
+      - name: Upload v7 packages
         uses: actions/upload-artifact@v7.0.1
         with:
-          name: Articulate.${{ env.NBGV_SemVer2 }}
-          path: ${{ env.RELEASE_FOLDER }}/Articulate.*
+          name: Articulate-v7-${{ env.UMBRACO18_VERSION }}
+          path: build/Release/umbraco18/Articulate.*
diff --git a/.gitignore b/.gitignore
index af2fc7aeb..b28f17fbf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -529,3 +529,4 @@ scratch/
 /src/Articulate.Tests/umbraco-package-schema.json
 /src/Articulate.Tests/appsettings-schema.Umbraco.Cms.json
 src/Articulate.Tests/appsettings-schema.json
+/build/test-site-publish
diff --git a/DEVELOP.md b/DEVELOP.md
index a80f680cc..c52578cab 100644
--- a/DEVELOP.md
+++ b/DEVELOP.md
@@ -56,22 +56,213 @@ pnpm run generate:api
 - `BUILD_CONFIGURATION=Debug` is the default for local builds; Release is the default in packaging flows.
 - `ENABLE_CLIENT_BUILD=true` enables local TypeScript Back Office client builds.
 - `PACK_SAMPLE_THEME=true` forces packing `Articulate.Theme.Sample`; local builds pack it by default, but CI skips it unless explicitly enabled.
-- The scripts clean, restore, build, and pack the current Articulate projects for .NET 9 and .NET 10.
-- The packable NuGet package is produced by `src/Articulate.Web/Articulate.Web.csproj` (`PackageId=Articulate`). Packages are written under `build/$(Configuration)` by default.
-- If you change packaged runtime dependencies or client/static assets, regenerate the Docker inputs before validating source-built or Docker-based installs:
-  - `dotnet pack src/Articulate.Web/Articulate.Web.csproj -c Release`
-  - `dotnet pack src/Articulate.Theme.Sample/Articulate.Theme.Sample.csproj -c Release`
-- Keep `Articulate` and `Articulate.Theme.Sample` at the same package version in `build/Release`; the Docker site restores both using the selected Articulate package version.
-- The Dockerfile selects the newest `Articulate.[0-9]*.nupkg` in `build/Release` by modified time and ignores `.snupkg` files and theme packages when choosing the version.
-- Rebuilding the image is not enough on its own. A running Compose service can remain on an older image/container. Use `docker compose up -d --build --force-recreate articulate`, or run both steps explicitly:
-  - `docker compose build articulate`
-  - `docker compose up -d --force-recreate --no-deps articulate`
-- The expected image tag is `articulate-local:net10`; the Compose container name will still be project/service based, for example `articulate-pr-articulate-1`.
-- If the Docker back office still appears stale after a rebuild, check the running container, not just the image:
-  - `docker compose ps`
-  - `docker exec articulate-pr-articulate-1 /bin/sh -c "find /app -path '*App_Plugins/Articulate/BackOffice/articulate-backoffice.js' -o -path '*App_Plugins/Articulate/umbraco-package.json'"`
-  - `Invoke-WebRequest https://localhost:18443/App_Plugins/Articulate/BackOffice/articulate-backoffice.js -SkipCertificateCheck`
-- The default unattended Docker backoffice user is `admin@localhost` with password `@rticulate` and display name `Jane Doe`. Override with `UMBRACO_USER_NAME`, `UMBRACO_USER_EMAIL`, and `UMBRACO_USER_PASSWORD` when needed.
+- The scripts clean, restore, build, and pack one package lane at a time. The default lane is `legacy`.
+- Running the local build script once does not produce both lanes; run it once with `ARTICULATE_PACKAGE_LANE=legacy` and once with `ARTICULATE_PACKAGE_LANE=umbraco18` when you need both NuGet package sets locally.
+- The packable NuGet package is produced by `src/Articulate.Web/Articulate.Web.csproj` (`PackageId=Articulate`).
+- Packages are written under `build/$(Configuration)/$(ARTICULATE_PACKAGE_LANE)`.
+
+### Package Lanes
+
+The source tree supports two package lanes:
+
+| Lane | Package line | Umbraco support | Target frameworks | Output folder |
+| --- | --- | --- | --- | --- |
+| `legacy` | Articulate 6.x | Umbraco 16/17 | `net9.0`, `net10.0` | `build/Release/legacy` |
+| `umbraco18` | Articulate 7.x | Umbraco 18 | `net10.0` | `build/Release/umbraco18` |
+
+The lanes produce separate NuGet packages because the compiled Umbraco 17 and Umbraco 18 extension points are not binary-compatible. Do not install an Articulate 6 package into Umbraco 18, or an Articulate 7 package into Umbraco 16/17.
+
+Build the Articulate 6 lane:
+
+PowerShell:
+
+```powershell
+$env:ARTICULATE_PACKAGE_LANE='legacy'
+$env:ARTICULATE_PACKAGE_VERSION='6.0.0-rc.2'
+$env:PACK_SAMPLE_THEME='true'
+./build/build.ps1
+```
+
+Bash:
+
+```bash
+ARTICULATE_PACKAGE_LANE=legacy \
+ARTICULATE_PACKAGE_VERSION=6.0.0-rc.2 \
+PACK_SAMPLE_THEME=true \
+./build/build.sh
+```
+
+Build the Articulate 7 / Umbraco 18 lane:
+
+PowerShell:
+
+```powershell
+$env:ARTICULATE_PACKAGE_LANE='umbraco18'
+$env:ARTICULATE_PACKAGE_VERSION='7.0.0-rc.2'
+$env:PACK_SAMPLE_THEME='true'
+./build/build.ps1
+```
+
+Bash:
+
+```bash
+ARTICULATE_PACKAGE_LANE=umbraco18 \
+ARTICULATE_PACKAGE_VERSION=7.0.0-rc.2 \
+PACK_SAMPLE_THEME=true \
+./build/build.sh
+```
+
+The build scripts temporarily patch `version.json` when `ARTICULATE_PACKAGE_VERSION` is set, then restore it before exiting. This keeps Nerdbank.GitVersioning as the source of package metadata while allowing one checkout to produce the Articulate 6 and 7 package lines.
+
+## Local Docker Validation
+
+Docker is a local validation tool. GitHub Actions builds package artifacts but does not run Docker.
+
+### Quick smoke test
+
+Build and smoke-test Docker images for any Umbraco target version using the provided script:
+
+```powershell
+# Windows PowerShell
+.\scripts\docker-test.ps1 -Target umbraco16
+.\scripts\docker-test.ps1 -Target umbraco17
+.\scripts\docker-test.ps1 -Target umbraco18
+.\scripts\docker-test.ps1 -Target all -Keep   # leaves containers running for manual browsing
+```
+
+```bash
+# Bash
+./scripts/docker-test.sh umbraco16
+./scripts/docker-test.sh umbraco17
+./scripts/docker-test.sh umbraco18
+./scripts/docker-test.sh all --keep   # leaves containers running for manual browsing
+```
+
+The PowerShell and Bash Docker test scripts support the same targets:
+
+| Target | Package lane | TFM | Umbraco version | Image tag | HTTPS port |
+| --- | --- | --- | --- | --- | --- |
+| `umbraco16` | `legacy` | `net9.0` | `[16.5.1,17.0.0)` | `articulate-local:umbraco16` | 16016 |
+| `umbraco17` | `legacy` | `net10.0` | `[17.2.2,18.0.0)` | `articulate-local:umbraco17` | 17017 |
+| `umbraco18` | `umbraco18` | `net10.0` | `18.0.0-rc*` | `articulate-local:umbraco18` | 18018 |
+
+Each target builds a Docker image with the correct SDK, ASP.NET runtime, TFM, and Umbraco version range. The smoke test starts Umbraco behind a Caddy sidecar for TLS termination (required by Umbraco Production mode) and verifies both `/` and `/umbraco` respond with HTTP 200. Use `-Keep` in PowerShell or `--keep` in Bash to leave the scripted containers running for manual browser testing.
+
+### Package prerequisites
+
+The Docker test scripts check for both `Articulate.*.nupkg` and `Articulate.Theme.Sample.*.nupkg` in the required package lane. If either is missing, the script builds that lane with `PACK_SAMPLE_THEME=true`.
+
+The package build scripts also assert that the main `Articulate` package contains the Material theme static web assets that previously regressed in the Umbraco 18 lane:
+
+- `staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/css/material.min.css`
+- `staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/js/material.min.js`
+- `staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.min.js`
+- `staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.pink-blue.min.css`
+
+You can still build both lanes explicitly:
+
+```powershell
+$env:ARTICULATE_PACKAGE_LANE='legacy'
+./build/build.ps1
+
+$env:ARTICULATE_PACKAGE_LANE='umbraco18'
+./build/build.ps1
+```
+
+```bash
+ARTICULATE_PACKAGE_LANE=legacy ./build/build.sh
+ARTICULATE_PACKAGE_LANE=umbraco18 ./build/build.sh
+```
+
+### HTTPS / Caddy
+
+The smoke test runs each target behind Caddy for TLS. The default `Caddyfile` uses `tls internal`, which generates a local CA and server certificate. Browsers on Windows will show a certificate warning until the local CA is trusted.
+
+To trust Caddy's root CA:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\build\docker-site\Trust-CaddyRootCA.ps1
+```
+
+### HMAC image signing (Umbraco 17+)
+
+Umbraco 17+ auto-generates an HMAC secret key on first boot. Image resize/crop URLs generated by `GetCropUrl()` include an `hmac` query parameter signed with this key. The server validates the HMAC before processing the image — requests without a valid HMAC return 400.
+
+When rendering image URLs in `<style>` blocks, use the `ToCssStyleUrl()` extension method (returns `IHtmlContent`) instead of raw `@` expressions to prevent Razor from HTML-encoding the `&` query separator into `&amp;`:
+
+```cshtml
+@* Correct — & stays as & in the <style> block *@
+background-image: url('@Model.BlogBanner.ToCssStyleUrl()');
+
+@* Wrong — & becomes &amp; which the browser does not decode in raw text elements *@
+background-image: url('@Model.BlogBanner);
+```
+
+### Manual browser testing
+
+Use the Docker test scripts with their keep option for manual browser testing:
+
+```powershell
+.\scripts\docker-test.ps1 -Target umbraco18 -Keep
+```
+
+```bash
+./scripts/docker-test.sh umbraco18 --keep
+```
+
+This keeps the Umbraco and Caddy containers alive on the target-specific HTTPS port shown above. Clean them up with `docker rm -f $(docker ps -q --filter name=art-)` when finished.
+
+Default unattended backoffice credentials:
+- Name: `Jane Doe`
+- Email: `admin17@localhost` (legacy lane) or `admin18@localhost` (umbraco18 lane)
+- Password: `@rticulate`
+
+## Opt-in Umbraco 18 release-candidate validation (net10 only)
+
+Default source validation lanes remain unchanged (`net9.0` => Umbraco 16, `net10.0` => Umbraco 17 stable).
+
+Use explicit version pinning to validate Umbraco 18 RC locally.
+
+OpenAPI note:
+
+- Umbraco 16/17 lane uses legacy SwaggerGen/operation filter registration.
+- Umbraco 18 lane uses native OpenAPI transformers for Articulate operation IDs and security requirements.
+
+Baseline (`net10.0` + Umbraco 17 stable):
+
+PowerShell:
+
+```powershell
+dotnet restore .\src\Articulate.sln -p:UmbracoCmsPackageVersion=17.2.2
+dotnet build .\src\Articulate.sln -c Debug -f net10.0 --no-restore -p:UmbracoCmsPackageVersion=17.2.2
+dotnet test .\src\Articulate.sln -c Debug -f net10.0 --no-build --no-restore -p:UmbracoCmsPackageVersion=17.2.2
+```
+
+Bash:
+
+```bash
+dotnet restore ./src/Articulate.sln -p:UmbracoCmsPackageVersion=17.2.2
+dotnet build ./src/Articulate.sln -c Debug -f net10.0 --no-restore -p:UmbracoCmsPackageVersion=17.2.2
+dotnet test ./src/Articulate.sln -c Debug -f net10.0 --no-build --no-restore -p:UmbracoCmsPackageVersion=17.2.2
+```
+
+PowerShell:
+
+```powershell
+dotnet restore .\src\Articulate.sln -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet build .\src\Articulate.sln -c Debug -f net10.0 --no-restore -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet test .\src\Articulate.sln -c Debug -f net10.0 --no-build --no-restore -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet run -f net10.0 --project .\src\Articulate.Tests.Website\Articulate.Tests.Website.csproj -p:UmbracoCmsPackageVersion=18.0.0-rc*
+```
+
+Bash:
+
+```bash
+dotnet restore ./src/Articulate.sln -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet build ./src/Articulate.sln -c Debug -f net10.0 --no-restore -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet test ./src/Articulate.sln -c Debug -f net10.0 --no-build --no-restore -p:UmbracoCmsPackageVersion=18.0.0-rc*
+dotnet run -f net10.0 --project ./src/Articulate.Tests.Website/Articulate.Tests.Website.csproj -p:UmbracoCmsPackageVersion=18.0.0-rc*
+```
 
 ## Back Office Client Builds
 
diff --git a/Directory.Build.props b/Directory.Build.props
index 039591e7d..7cbb251b0 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -14,23 +14,22 @@
 	<PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
 		<!-- Support Umbraco 15.x-16.x on .NET 9 -->
 		<UmbracoCmsPackageVersion>[16.5.1,17.0.0)</UmbracoCmsPackageVersion>
-		<MicrosoftOpenApiPackageVersion>[1.6.22,2.0.0)</MicrosoftOpenApiPackageVersion>
-		<MicrosoftCodeAnalysisPackageVersion>[4.13.0,5.3.0)</MicrosoftCodeAnalysisPackageVersion>
-		<SystemServiceModelSyndicationPackageVersion>[9.0.14,10.0.3)</SystemServiceModelSyndicationPackageVersion>
-		<SystemSecurityCryptographyXmlPackageVersion>[9.0.15,10.0.0)</SystemSecurityCryptographyXmlPackageVersion>
-		<MailKitPackageVersion>[4.16.0,5.0.0)</MailKitPackageVersion>
-        <OpenMcdfPackageVersion>3.1.3</OpenMcdfPackageVersion>
+		<!-- Package versions are managed centrally in Directory.Packages.props to keep build props KISS -->
 	</PropertyGroup>
 	<PropertyGroup Condition="'$(TargetFramework)' == 'net10.0'">
 		<!-- Support Umbraco 17.x (including pre-release) on .NET 10 -->
-		<UmbracoCmsPackageVersion>[17.2.2,18.0.0)</UmbracoCmsPackageVersion>
-		<MicrosoftOpenApiPackageVersion>[2.3.0,3.0.0)</MicrosoftOpenApiPackageVersion>
-		<MicrosoftCodeAnalysisPackageVersion>[5.3.0,6.0.0)</MicrosoftCodeAnalysisPackageVersion>
-		<SystemServiceModelSyndicationPackageVersion>[10.0.5,11.0.0)</SystemServiceModelSyndicationPackageVersion>
-		<SystemSecurityCryptographyXmlPackageVersion>[10.0.6,11.0.0)</SystemSecurityCryptographyXmlPackageVersion>
-		<MailKitPackageVersion>[4.16.0,5.0.0)</MailKitPackageVersion>
-        <OpenMcdfPackageVersion>3.1.3</OpenMcdfPackageVersion>
+		<UmbracoCmsPackageVersion>[17.4.2,18.0.0)</UmbracoCmsPackageVersion>
+		<!-- Package versions are managed centrally in Directory.Packages.props to keep build props KISS -->
+		<MarkdigPackageVersion>[1.2.0,2.0.0)</MarkdigPackageVersion>
+		<MicrosoftNetTestSdkPackageVersion>[18.5.1,19.0.0)</MicrosoftNetTestSdkPackageVersion>
+		<!-- net10 needs higher syndication/crypto lower bounds to satisfy Umbraco 17+ transitive requirements -->
+		<SystemServiceModelSyndicationPackageVersion>[10.0.8,11.0.0)</SystemServiceModelSyndicationPackageVersion>
+		<SystemSecurityCryptographyXmlPackageVersion>[10.0.7,11.0.0)</SystemSecurityCryptographyXmlPackageVersion>
 	</PropertyGroup>
+	<PropertyGroup Condition="'$(TargetFramework)' == 'net10.0' and $([System.String]::Copy('$(UmbracoCmsPackageVersion)').StartsWith('18.'))">
+		<DefineConstants>$(DefineConstants);UMBRACO_18_OR_GREATER</DefineConstants>
+	</PropertyGroup>
+
 	<PropertyGroup>
 		<!-- TODO: Enable when 6.0 version is shipped -->
 		<EnablePackageValidation>false</EnablePackageValidation>
@@ -60,14 +59,6 @@
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
 		</PackageReference>
 		<PackageReference Include="Microsoft.CodeAnalysis" Version="$(MicrosoftCodeAnalysisPackageVersion)" PrivateAssets="All" />
-	</ItemGroup>
-	<ItemGroup Condition="'$(UseArticulateUsings)' == 'true'">
-		<Using Include="Umbraco.Cms.Core.DependencyInjection" />
-		<Using Include="Umbraco.Extensions" />
-		<Using Include="Articulate" />
-		<Using Include="Articulate.Models" />
-	</ItemGroup>
-	<ItemGroup Condition="'$(IsPackable)' != 'false'">
 		<None Include="$(MSBuildThisFileDirectory)LICENSE">
 			<Pack>true</Pack>
 			<PackagePath>\</PackagePath>
@@ -77,6 +68,13 @@
 			<PackagePath>\</PackagePath>
 		</None>
 	</ItemGroup>
+	<ItemGroup Condition="'$(UseArticulateUsings)' == 'true'">
+		<Using Include="Umbraco.Cms.Core.DependencyInjection" />
+		<Using Include="Umbraco.Extensions" />
+		<Using Include="Articulate" />
+		<Using Include="Articulate.Models" />
+	</ItemGroup>
+
 	<PropertyGroup>
 		<GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
 	</PropertyGroup>
diff --git a/Directory.Packages.props b/Directory.Packages.props
new file mode 100644
index 000000000..17db6622b
--- /dev/null
+++ b/Directory.Packages.props
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <!-- Centralized package-version properties (kept KISS: wide ranges that satisfy current TFMs) -->
+  <PropertyGroup>
+	<!-- OpenAPI / OpenApi.NET ranges covering net9/net10 lanes -->
+	<MicrosoftOpenApiPackageVersion>[1.6.22,3.0.0)</MicrosoftOpenApiPackageVersion>
+
+	<!-- Roslyn/CodeAnalysis: allow 4.13+ to satisfy workspaces/msbuild transitive constraints -->
+	<MicrosoftCodeAnalysisPackageVersion>[4.13.0,6.0.0)</MicrosoftCodeAnalysisPackageVersion>
+
+	<!-- Syndication / Cryptography ranges covering both TFMs -->
+	<SystemServiceModelSyndicationPackageVersion>[9.0.16,11.0.0)</SystemServiceModelSyndicationPackageVersion>
+	<SystemSecurityCryptographyXmlPackageVersion>[10.0.7,11.0.0)</SystemSecurityCryptographyXmlPackageVersion>
+
+	<!-- MailKit / Markdig / Test SDK -->
+	<MailKitPackageVersion>[4.16.0,5.0.0)</MailKitPackageVersion>
+	<MarkdigPackageVersion>[1.2.0,2.0.0)</MarkdigPackageVersion>
+	<OpenMcdfPackageVersion>[3.1.4,4.0.0)</OpenMcdfPackageVersion>
+	<MicrosoftNetTestSdkPackageVersion>[18.5.1,19.0.0)</MicrosoftNetTestSdkPackageVersion>
+  </PropertyGroup>
+</Project>
diff --git a/Dockerfile b/Dockerfile
index 816034195..98de8051a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,27 +1,47 @@
 # syntax=docker/dockerfile:1
 
-# Build stage - .NET 10 SDK
-FROM mcr.microsoft.com/dotnet/sdk:10.0.201 AS build
+# Parameterized build - supports Umbraco 16 (net9.0), 17 (net10.0), 18 (net10.0)
+# Override SDK/ASPNET images, TFM, and Umbraco version via build args.
+#
+# Examples:
+#   docker build --build-arg TARGET_FRAMEWORK=net9.0 --build-arg DOTNET_SDK_IMAGE=mcr.microsoft.com/dotnet/sdk:9.0.301 ...
+#   docker build --build-arg TARGET_FRAMEWORK=net10.0 ...
+
+ARG DOTNET_SDK_IMAGE=mcr.microsoft.com/dotnet/sdk:10.0.201
+ARG DOTNET_ASPNET_IMAGE=mcr.microsoft.com/dotnet/aspnet:10.0.2
+
+# Build stage
+FROM ${DOTNET_SDK_IMAGE} AS build
 WORKDIR /src
 
-# Allow overriding Umbraco CMS version for the container build
+# All configurable via build args
+ARG TARGET_FRAMEWORK=net10.0
 ARG UMBRACO_CMS_VERSION="[17.2.2,18.0.0)"
 ARG BUILD_CONFIGURATION=Release
 ARG PACKAGE_DIR=/articulate-packages
+ARG PACKAGE_SOURCE=build/Release/legacy
+ARG PACKAGE_LANE=legacy
 
 # Copy config files
 COPY global.json ./
 COPY Directory.Build.props ./
+COPY Directory.Packages.props ./
 COPY nuget.config ./
 COPY build/docker-site/ArticulateDockerSite.csproj build/docker-site/
 COPY build/docker-site/Program.cs build/docker-site/
 COPY build/docker-site/appsettings.json build/docker-site/
 COPY build/docker-site/appsettings.Container.json build/docker-site/
 COPY build/docker-site/nuget.config build/docker-site/
-COPY build/Release/ build/Release/
+COPY ${PACKAGE_SOURCE}/ build/Release/
 
-# Copy nupkg to packages folder and extract version, then restore and publish
+# Sanity check + restore + publish
 RUN set -eux; \
+    rm -f global.json; \
+    if [ -z "$(ls -1 build/Release/Articulate.*.nupkg 2>/dev/null | head -n 1)" ]; then \
+        echo "ERROR: No Articulate nupkg found in build/Release (PACKAGE_SOURCE='${PACKAGE_SOURCE}')." >&2; \
+        echo "Run './build/build.sh' (or the CI build job) to produce packages for lane='${PACKAGE_LANE}'." >&2; \
+        exit 1; \
+    fi; \
     mkdir -p $PACKAGE_DIR; \
     cp build/Release/*.nupkg $PACKAGE_DIR/; \
     mkdir -p build/docker-site/packages; \
@@ -29,21 +49,23 @@ RUN set -eux; \
     ARTICULATE_PKG_FILE=$(ls -1t build/Release/Articulate.[0-9]*.nupkg | grep -v '\.snupkg$' | head -n 1 | xargs -n 1 basename); \
     ARTICULATE_PKG_VERSION=${ARTICULATE_PKG_FILE#Articulate.}; \
     ARTICULATE_PKG_VERSION=${ARTICULATE_PKG_VERSION%.nupkg}; \
+    echo "Building Articulate ${ARTICULATE_PKG_VERSION} for ${TARGET_FRAMEWORK} with Umbraco ${UMBRACO_CMS_VERSION}"; \
     dotnet restore build/docker-site/ArticulateDockerSite.csproj \
     --configfile build/docker-site/nuget.config \
-    /p:TargetFramework=net10.0 \
+    /p:TargetFramework=${TARGET_FRAMEWORK} \
     /p:UmbracoCmsPackageVersion=\"${UMBRACO_CMS_VERSION}\" \
     /p:ArticulatePackageVersion=\"$ARTICULATE_PKG_VERSION\"; \
     dotnet publish build/docker-site/ArticulateDockerSite.csproj \
+    --no-restore \
     -c $BUILD_CONFIGURATION \
-    -f net10.0 \
+    -f ${TARGET_FRAMEWORK} \
     -o /app/publish \
     /p:UseAppHost=false \
     /p:UmbracoCmsPackageVersion=\"${UMBRACO_CMS_VERSION}\" \
     /p:ArticulatePackageVersion=\"$ARTICULATE_PKG_VERSION\"
 
-# Runtime stage - ASP.NET 10.0
-FROM mcr.microsoft.com/dotnet/aspnet:10.0.2 AS final
+# Runtime stage
+FROM ${DOTNET_ASPNET_IMAGE} AS final
 WORKDIR /app
 
 ENV ASPNETCORE_URLS=http://+:8080 \
diff --git a/README.md b/README.md
index 8f1642b4c..d23572ee0 100644
--- a/README.md
+++ b/README.md
@@ -25,12 +25,21 @@ _Need help?_ Head over to [Articulate on GitHub](https://github.com/Shazwazza/Ar
 
 ### Umbraco 16 (NET 9) & 17 (NET 10) (current track)
 
-Articulate 6 targets Umbraco 16.5.1+ and 17.2.2+
+Articulate 6 targets Umbraco 16.5.1+ and 17.2.2+. It does not target Umbraco 18.
 
 - Install `Articulate` from NuGet (`dotnet add package Articulate`). The package includes the backoffice extension and static assets; no extra package references or manual copies required.
 - When building from source, run the test site `dotnet run -f net9.0 --project src/Articulate.Tests.Website/Articulate.Tests.Website.csproj` (or `-f net10.0` for Umbraco 17) and sign into the Umbraco Back Office to finish setup.
 - Migrating from 5.x: in place upgrade or export BlogML from your Articulate 5 site and import it into Articulate 6; media in `media/articulate` is not auto-migrated. During import you can map `postImage` to base64 or an attachment; other inline images must be moved manually (copy the folder, or consider an in-place package upgrade).
 
+### Umbraco 18 beta (NET 10) opt-in
+
+Articulate 7 targets Umbraco 18 on `net10.0`.
+
+- Articulate 6.x packages are for Umbraco 16/17.
+- Articulate 7.x packages are for Umbraco 18.
+- The source tree can build both package lanes, but the resulting NuGet packages are separate because the compiled Umbraco 17 and Umbraco 18 integration points are not binary-compatible.
+- See `DEVELOP.md` for lane build and local Docker commands.
+
 #### Rich Text Editor upgrade behavior
 
 On Umbraco 16/17, Articulate will migrate the built-in `Umbraco.RichText` property editor to `Umb.PropertyEditorUi.TipTap` during package upgrade only if the TinyMCE editor UI is actually registered. 
@@ -149,7 +158,7 @@ Notes:
 - `AllowUnsafeLocalExternalImageHostsInDevelopment` is ignored when `Umbraco:CMS:Runtime:Mode` is `Production`.
 - `localhost`, loopback, and private-network targets remain blocked unless the development-only override is enabled.
 - For BlogML export/import round-trip tests, use an importer-reachable media hostname end-to-end. `localhost` only works when the importer resolves it to the exporting site. If not, rewrite the BlogML media URLs before import or configure the exporting site to emit a reachable hostname instead.
-- The repository `docker-compose.yml` includes commented example environment variables for the common `host.docker.internal` Docker test setup.
+- For Docker package validation, use `scripts/docker-test.ps1` or `scripts/docker-test.sh` rather than ad-hoc Docker commands.
 
 ## Upload and Request Limits
 
@@ -246,6 +255,13 @@ Built-in themes render Disqus comments only when both post comments are enabled
 
 - Articulate 5.x (maintenance): Umbraco 13 LTS (security support through Dec 2025, EOL Dec 2026)
 - Articulate 6.x (current): Umbraco 16.5.1+ on .NET 9; Umbraco 17.2.2+ on .NET 10
+- Articulate 7.x (Umbraco 18 track): Umbraco 18+ on .NET 10
+
+### Umbraco 18 beta validation (opt-in)
+
+This branch enables opt-in validation against Umbraco 18 beta on `net10.0` using the Articulate 7 package lane.
+
+See [DEVELOP.md](DEVELOP.md) for package-lane build commands and local Docker usage.
 
 ## [Documentation](https://github.com/Shazwazza/Articulate/wiki)
 
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 69882ac7a..143bf3395 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,5 +1,15 @@
 # Articulate Release Notes
 
+## PR branch notes (Umbraco 18 release-candidate validation)
+
+- Default support lanes remain unchanged in this branch:
+  - .NET 9 lane targets Umbraco 16.
+  - .NET 10 lane defaults to Umbraco 17 stable.
+- Umbraco 18 release-candidate validation is available as an **opt-in** workflow using explicit version pin overrides:
+  - `-p:UmbracoCmsPackageVersion=18.0.0-rc*` for local restore/build/test and `Articulate.Tests.Website` runs on `net10.0`.
+  - `UMBRACO_CMS_VERSION=18.0.0-rc*` for Docker validation.
+- Validation/reference source used for API compatibility checks: `release/18.0`.
+
 ## Version 6.0.0
 
 ### Breaking Changes
diff --git a/build/build.ps1 b/build/build.ps1
index 7d133216a..05c506b51 100644
--- a/build/build.ps1
+++ b/build/build.ps1
@@ -3,16 +3,22 @@
 #   ENABLE_CLIENT_BUILD=true pwsh -NoLogo -File build/build.ps1
 #   RUN_TESTS=true pwsh -NoLogo -File build/build.ps1
 #   PACK_SAMPLE_THEME=true pwsh -NoLogo -File build/build.ps1
+#   ARTICULATE_PACKAGE_LANE=umbraco18 ARTICULATE_PACKAGE_VERSION=7.0.0-rc.1 pwsh -NoLogo -File build/build.ps1
 # Release builds enable the client build by default so packaged assets carry the stamped version.
 $ScriptStart = Get-Date
 $PSScriptFilePath = Get-Item $MyInvocation.MyCommand.Path
 $RepoRoot = $PSScriptFilePath.Directory.Parent.FullName
 $BuildFolder = Join-Path -Path $RepoRoot -ChildPath "build"
 $Configuration = if ([string]::IsNullOrWhiteSpace($env:BUILD_CONFIGURATION)) { "Release" } else { $env:BUILD_CONFIGURATION }
-$ReleaseFolder = Join-Path -Path $BuildFolder -ChildPath $Configuration
+$ReleaseRoot = Join-Path -Path $BuildFolder -ChildPath $Configuration
+$PackageLane = if ([string]::IsNullOrWhiteSpace($env:ARTICULATE_PACKAGE_LANE)) { "legacy" } else { $env:ARTICULATE_PACKAGE_LANE.ToLowerInvariant() }
+if ($PackageLane -notin @("legacy", "umbraco18")) {
+    throw "Unsupported ARTICULATE_PACKAGE_LANE '$PackageLane'. Expected 'legacy' or 'umbraco18'."
+}
+$ReleaseFolder = Join-Path -Path $ReleaseRoot -ChildPath $PackageLane
 $SolutionRoot = Join-Path -Path $RepoRoot -ChildPath "src"
 $SolutionPath = Join-Path -Path $SolutionRoot -ChildPath "Articulate.sln"
-$TargetFrameworks = @("net9.0", "net10.0")
+$TargetFrameworks = if ($PackageLane -eq "umbraco18") { @("net10.0") } else { @("net9.0", "net10.0") }
 $PSMajorVersion = $PSVersionTable.PSVersion.Major
 $SupportsParallel = $PSMajorVersion -ge 7
 if (-not $SupportsParallel) {
@@ -44,6 +50,9 @@ if ($env:MAXCPU -and ($env:MAXCPU -as [int]) -gt 0) {
     $cpu = [int]$env:MAXCPU
 }
 $msbuildArgs = @("-m", "-maxcpucount:$cpu", "-p:BuildInParallel=true", "-p:RestoreUseStaticGraphEvaluation=true")
+if ($PackageLane -eq "umbraco18") {
+    $msbuildArgs = @("-m", "-maxcpucount:$cpu", "-p:BuildInParallel=true")
+}
 $runningInCi = ($env:CI -eq 'true') -or ($env:GITHUB_ACTIONS -eq 'true')
 if ([string]::IsNullOrEmpty($env:RUN_TESTS)) {
     $runTests = $runningInCi
@@ -58,10 +67,51 @@ else {
     $clientBuildValue = $env:ENABLE_CLIENT_BUILD
 }
 $clientBuildProperty = "-p:EnableClientBuild=$clientBuildValue"
+$laneProperties = @("-p:ArticulatePackageLane=$PackageLane")
+if ($PackageLane -eq "umbraco18") {
+    # Allow opt-in Umbraco version via UMBRACO_CMS_VERSION env var; default to the current v18 release candidate.
+    $umbracoVersion = if (-not [string]::IsNullOrWhiteSpace($env:UMBRACO_CMS_VERSION)) { $env:UMBRACO_CMS_VERSION } else { '18.0.0-rc*' }
+    $laneProperties += @(
+        "-p:TargetFramework=net10.0",
+        "-p:UmbracoCmsPackageVersion=$umbracoVersion"
+    )
+}
+if (-not [string]::IsNullOrWhiteSpace($env:ARTICULATE_PACKAGE_VERSION)) {
+    $laneProperties += @(
+        "-p:Version=$env:ARTICULATE_PACKAGE_VERSION",
+        "-p:PackageVersion=$env:ARTICULATE_PACKAGE_VERSION"
+    )
+}
+$packProperties = @($laneProperties)
+if ($PackageLane -eq "umbraco18") {
+    $packProperties = @($packProperties | Where-Object { $_ -ne "-p:TargetFramework=net10.0" })
+    $packProperties += "-p:TargetFrameworks=net10.0"
+}
 $packSampleTheme = ($env:PACK_SAMPLE_THEME -eq 'true') -or ([string]::IsNullOrEmpty($env:PACK_SAMPLE_THEME) -and -not $runningInCi)
 $dotnetCommon = @("-v", "minimal")
 Write-Host "Using up to $cpu parallel MSBuild nodes"
 Write-Host "Build configuration: $Configuration"
+Write-Host "Package lane: $PackageLane"
+Write-Host "Package output: $ReleaseFolder"
+
+$script:versionJsonPath = Join-Path -Path $RepoRoot -ChildPath "version.json"
+$script:originalVersionJson = $null
+function Restore-VersionJson {
+    if ($null -ne $script:originalVersionJson) {
+        Set-Content -LiteralPath $script:versionJsonPath -Value $script:originalVersionJson -NoNewline
+    }
+}
+trap {
+    Restore-VersionJson
+    break
+}
+
+if (-not [string]::IsNullOrWhiteSpace($env:ARTICULATE_PACKAGE_VERSION)) {
+    $script:originalVersionJson = Get-Content -LiteralPath $script:versionJsonPath -Raw
+    $updatedVersionJson = $script:originalVersionJson -replace '("version"\s*:\s*")[^"]+(")', "`${1}$env:ARTICULATE_PACKAGE_VERSION`${2}"
+    Set-Content -LiteralPath $script:versionJsonPath -Value $updatedVersionJson -NoNewline
+    Write-Host "Temporarily using package version: $env:ARTICULATE_PACKAGE_VERSION"
+}
 
 # Friendly note if running on Windows against a WSL filesystem (\\wsl$ UNC)
 if ($RepoRoot.StartsWith("\\\\wsl$", [System.StringComparison]::OrdinalIgnoreCase) -or 
@@ -78,12 +128,12 @@ dotnet --version
 
 # 1) Clean the solution to ensure release/CI builds start from a fresh slate
 Write-Host "1. Cleaning solution outputs..."
-& dotnet clean $SolutionPath -c $Configuration @dotnetCommon $clientBuildProperty
+& dotnet clean $SolutionPath -c $Configuration @dotnetCommon $clientBuildProperty @laneProperties
 if (-not $?) { Write-Host "Warning dotnet clean failed" }
 
 # 2) Restore (solution-level)
 Write-Host "2. Restoring solution packages in parallel..."
-& dotnet restore $SolutionPath @dotnetCommon @msbuildArgs $clientBuildProperty
+& dotnet restore $SolutionPath @dotnetCommon @msbuildArgs $clientBuildProperty @laneProperties
 if (-not $?) { throw "dotnet restore failed" }
 
 # 3) Build TFMs sequentially to ensure net9.0 (client build) runs before net10.0
@@ -91,7 +141,7 @@ Write-Host "3. Building solution for: $($TargetFrameworks -join ', ')"
 foreach ($tfm in $TargetFrameworks) {
     Write-Host "[build] -> $tfm"
     $sw = [System.Diagnostics.Stopwatch]::StartNew()
-    & dotnet build $SolutionPath -c $Configuration -f $tfm --no-restore @dotnetCommon @msbuildArgs $clientBuildProperty
+    & dotnet build $SolutionPath -c $Configuration -f $tfm --no-restore @dotnetCommon @msbuildArgs $clientBuildProperty @laneProperties
     if ($LASTEXITCODE -ne 0) { throw "dotnet build failed for $tfm" }
     $sw.Stop()
     Write-Host "[build] <- $tfm done in $([int]$sw.Elapsed.TotalSeconds)s"
@@ -100,7 +150,7 @@ foreach ($tfm in $TargetFrameworks) {
 # 4) Run tests
 if ($runTests) {
     Write-Host "4. Running tests..."
-    & dotnet test $SolutionPath -c $Configuration --no-restore --no-build @dotnetCommon
+    & dotnet test $SolutionPath -c $Configuration --no-restore --no-build @dotnetCommon @laneProperties
     if ($LASTEXITCODE -ne 0) { throw "dotnet test failed" }
 }
 else {
@@ -125,7 +175,8 @@ if ($SupportsParallel) {
         $restoreArgs = @("--no-restore")
         $commonArgs = $using:dotnetCommon
         $clientBuildSwitch = $using:clientBuildProperty
-        & dotnet pack -c $using:Configuration $project @restoreArgs -o $using:ReleaseFolder @commonArgs "-p:BuildInParallel=false" $clientBuildSwitch
+        $laneSwitches = $using:packProperties
+        & dotnet pack -c $using:Configuration $project @restoreArgs -o $using:ReleaseFolder @commonArgs "-p:BuildInParallel=false" $clientBuildSwitch @laneSwitches
         if ($LASTEXITCODE -ne 0) { throw "dotnet pack failed for $project" }
     } -ThrottleLimit $packThrottle -ErrorVariable packErrors
     if ($packErrors) { throw "One or more pack operations failed: $($packErrors | Out-String)" }
@@ -133,9 +184,40 @@ if ($SupportsParallel) {
 else {
     foreach ($project in $projectsToPack) {
         Write-Host "[pack] -> $([IO.Path]::GetFileName($project))"
-        & dotnet pack -c $Configuration $project --no-restore -o $ReleaseFolder @dotnetCommon "-p:BuildInParallel=false" $clientBuildProperty
+        & dotnet pack -c $Configuration $project --no-restore -o $ReleaseFolder @dotnetCommon "-p:BuildInParallel=false" $clientBuildProperty @packProperties
         if ($LASTEXITCODE -ne 0) { throw "dotnet pack failed for $project" }
     }
 }
+
+$articulatePackage = Get-ChildItem -LiteralPath $ReleaseFolder -Filter "Articulate.*.nupkg" |
+    Where-Object { $_.Name -notlike "*.snupkg" -and $_.Name -notlike "Articulate.Theme.Sample.*" } |
+    Sort-Object LastWriteTime -Descending |
+    Select-Object -First 1
+if ($null -eq $articulatePackage) {
+    throw "Could not find packed Articulate nupkg in '$ReleaseFolder'."
+}
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+$zip = [System.IO.Compression.ZipFile]::OpenRead($articulatePackage.FullName)
+try {
+    $requiredStaticAssets = @(
+        "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/css/material.min.css",
+        "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/js/material.min.js",
+        "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.min.js",
+        "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.pink-blue.min.css"
+    )
+    $entries = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach ($entry in $zip.Entries) {
+        [void]$entries.Add($entry.FullName)
+    }
+    foreach ($asset in $requiredStaticAssets) {
+        if (-not $entries.Contains($asset)) {
+            throw "Packed Articulate package '$($articulatePackage.Name)' is missing required static web asset '$asset'."
+        }
+    }
+}
+finally {
+    $zip.Dispose()
+}
 $TotalSeconds = (Get-Date) - $ScriptStart
+Restore-VersionJson
 Write-Host ("Build pipeline completed in {0:N1}s. Packages available at {1}" -f $TotalSeconds.TotalSeconds, $ReleaseFolder)
diff --git a/build/build.sh b/build/build.sh
index 7330fed52..0da3a8e0a 100644
--- a/build/build.sh
+++ b/build/build.sh
@@ -4,6 +4,7 @@
 #   ENABLE_CLIENT_BUILD=true ./build/build.sh
 #   RUN_TESTS=true ./build/build.sh
 #   PACK_SAMPLE_THEME=true ./build/build.sh
+#   ARTICULATE_PACKAGE_LANE=umbraco18 ARTICULATE_PACKAGE_VERSION=7.0.0-rc.1 ./build/build.sh
 # Release builds enable the client build by default so packaged assets carry the stamped version.
 
 set -euo pipefail
@@ -30,10 +31,23 @@ SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
 BUILD_FOLDER="$REPO_ROOT/build"
 CONFIGURATION="${BUILD_CONFIGURATION:-Release}"
-RELEASE_FOLDER="$BUILD_FOLDER/$CONFIGURATION"
+PACKAGE_LANE="${ARTICULATE_PACKAGE_LANE:-legacy}"
+case "$PACKAGE_LANE" in
+  legacy|umbraco18) ;;
+  *)
+    echo "Unsupported ARTICULATE_PACKAGE_LANE '$PACKAGE_LANE'. Expected 'legacy' or 'umbraco18'." >&2
+    exit 1
+    ;;
+esac
+RELEASE_ROOT="$BUILD_FOLDER/$CONFIGURATION"
+RELEASE_FOLDER="$RELEASE_ROOT/$PACKAGE_LANE"
 SOLUTION_ROOT="$REPO_ROOT/src"
 SOLUTION_PATH="$SOLUTION_ROOT/Articulate.sln"
-TARGET_FRAMEWORKS=("net9.0" "net10.0")
+if [[ "$PACKAGE_LANE" == "umbraco18" ]]; then
+  TARGET_FRAMEWORKS=("net10.0")
+else
+  TARGET_FRAMEWORKS=("net9.0" "net10.0")
+fi
 
 # Compute CPU parallelism for MSBuild (allow override via MAXCPU)
 CPU_COUNT=${MAXCPU:-}
@@ -41,6 +55,9 @@ if [[ -z "$CPU_COUNT" ]]; then
   CPU_COUNT=$( (command -v nproc >/dev/null 2>&1 && nproc --all) || getconf _NPROCESSORS_ONLN || echo 8 )
 fi
 MSBUILD_PARALLEL=(-m -maxcpucount:"$CPU_COUNT" -p:BuildInParallel=true -p:RestoreUseStaticGraphEvaluation=true)
+if [[ "$PACKAGE_LANE" == "umbraco18" ]]; then
+  MSBUILD_PARALLEL=(-m -maxcpucount:"$CPU_COUNT" -p:BuildInParallel=true)
+fi
 DOTNET_COMMON=(--nologo -v minimal)
 
 # Handle ENABLE_CLIENT_BUILD environment variable (default to true for Release/CI, false otherwise)
@@ -51,6 +68,31 @@ else
 fi
 CLIENT_BUILD_VALUE=${ENABLE_CLIENT_BUILD:-$CLIENT_BUILD_DEFAULT}
 CLIENT_BUILD_PROPERTY="-p:EnableClientBuild=$CLIENT_BUILD_VALUE"
+LANE_PROPERTIES=("-p:ArticulatePackageLane=$PACKAGE_LANE")
+if [[ "$PACKAGE_LANE" == "umbraco18" ]]; then
+  LANE_PROPERTIES+=(
+    "-p:TargetFramework=net10.0"
+    # Allow opt-in via UMBRACO_CMS_VERSION environment variable while keeping the current release-candidate default.
+    "-p:UmbracoCmsPackageVersion=${UMBRACO_CMS_VERSION:-18.0.0-rc*}"
+  )
+fi
+if [[ -n "${ARTICULATE_PACKAGE_VERSION:-}" ]]; then
+  LANE_PROPERTIES+=(
+    "-p:Version=$ARTICULATE_PACKAGE_VERSION"
+    "-p:PackageVersion=$ARTICULATE_PACKAGE_VERSION"
+  )
+fi
+PACK_PROPERTIES=("${LANE_PROPERTIES[@]}")
+if [[ "$PACKAGE_LANE" == "umbraco18" ]]; then
+  FILTERED_PACK_PROPERTIES=()
+  for prop in "${PACK_PROPERTIES[@]}"; do
+    if [[ "$prop" != "-p:TargetFramework=net10.0" ]]; then
+      FILTERED_PACK_PROPERTIES+=("$prop")
+    fi
+  done
+  PACK_PROPERTIES=("${FILTERED_PACK_PROPERTIES[@]}")
+  PACK_PROPERTIES+=("-p:TargetFrameworks=net10.0")
+fi
 PACK_SAMPLE_THEME_VALUE=${PACK_SAMPLE_THEME:-}
 if [[ -n "${RUN_TESTS:-}" ]]; then
   RUN_TESTS_VALUE="$RUN_TESTS"
@@ -62,6 +104,33 @@ fi
 
 echo "Using up to $CPU_COUNT parallel MSBuild nodes"
 echo "Build configuration: $CONFIGURATION"
+echo "Package lane: $PACKAGE_LANE"
+echo "Package output: $RELEASE_FOLDER"
+
+VERSION_JSON="$REPO_ROOT/version.json"
+ORIGINAL_VERSION_JSON=""
+restore_version_json() {
+  if [[ -n "$ORIGINAL_VERSION_JSON" ]]; then
+    printf '%s' "$ORIGINAL_VERSION_JSON" > "$VERSION_JSON"
+  fi
+}
+trap restore_version_json EXIT
+
+if [[ -n "${ARTICULATE_PACKAGE_VERSION:-}" ]]; then
+  ORIGINAL_VERSION_JSON="$(cat "$VERSION_JSON")"
+  python - "$VERSION_JSON" "$ARTICULATE_PACKAGE_VERSION" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+version = sys.argv[2]
+text = path.read_text()
+text = re.sub(r'("version"\s*:\s*")[^"]+(")', rf'\g<1>{version}\2', text, count=1)
+path.write_text(text)
+PY
+  echo "Temporarily using package version: $ARTICULATE_PACKAGE_VERSION"
+fi
 
 # Advise when running in WSL against Windows-mounted drives (slow)
 if [[ $IS_WSL -eq 1 && "$REPO_ROOT" == /mnt/* ]]; then
@@ -81,14 +150,14 @@ export RestoreFallbackFolders=
 
 # --- 1) Clean the solution so Release/CI builds start fresh ---
 echo "1. Cleaning solution outputs..."
-if ! dotnet clean "$SOLUTION_PATH" -c "$CONFIGURATION" "${DOTNET_COMMON[@]}" "$CLIENT_BUILD_PROPERTY"; then
+if ! dotnet clean "$SOLUTION_PATH" -c "$CONFIGURATION" "${DOTNET_COMMON[@]}" "$CLIENT_BUILD_PROPERTY" "${LANE_PROPERTIES[@]}"; then
   echo "Warning: dotnet clean failed" >&2
 fi
 
 # --- 2) Solution-level restore ---
 mkdir -p "$RELEASE_FOLDER"
 echo "2. Restoring solution packages in parallel..."
-if ! dotnet restore "$SOLUTION_PATH" "${DOTNET_COMMON[@]}" "${MSBUILD_PARALLEL[@]}" "$CLIENT_BUILD_PROPERTY"; then
+if ! dotnet restore "$SOLUTION_PATH" "${DOTNET_COMMON[@]}" "${MSBUILD_PARALLEL[@]}" "$CLIENT_BUILD_PROPERTY" "${LANE_PROPERTIES[@]}"; then
   echo "dotnet restore failed" >&2
   exit 1
 fi
@@ -99,7 +168,7 @@ echo "3. Building solution for: ${TARGET_FRAMEWORKS[*]}"
 for tfm in "${TARGET_FRAMEWORKS[@]}"; do
   echo "[build] -> $tfm"
   t0=$(date +%s)
-  if ! dotnet build "$SOLUTION_PATH" -c "$CONFIGURATION" -f "$tfm" --no-restore "${DOTNET_COMMON[@]}" "${MSBUILD_PARALLEL[@]}" "$CLIENT_BUILD_PROPERTY"; then
+  if ! dotnet build "$SOLUTION_PATH" -c "$CONFIGURATION" -f "$tfm" --no-restore "${DOTNET_COMMON[@]}" "${MSBUILD_PARALLEL[@]}" "$CLIENT_BUILD_PROPERTY" "${LANE_PROPERTIES[@]}"; then
     echo "dotnet build failed for $tfm" >&2
     exit 1
   fi
@@ -110,7 +179,7 @@ done
 # --- 4) Run tests ---
 if [[ "$RUN_TESTS_VALUE" == "true" ]]; then
   echo "4. Running tests..."
-  if ! dotnet test "$SOLUTION_PATH" -c "$CONFIGURATION" --no-restore --no-build "${DOTNET_COMMON[@]}"; then
+  if ! dotnet test "$SOLUTION_PATH" -c "$CONFIGURATION" --no-restore --no-build "${DOTNET_COMMON[@]}" "${LANE_PROPERTIES[@]}"; then
     echo "dotnet test failed" >&2
     exit 1
   fi
@@ -134,12 +203,41 @@ for proj in "${PACK_PROJECTS[@]}"; do
   echo "[pack] -> $(basename "$proj")"
   RESTORE_SWITCHES=(--no-restore)
   if ! dotnet pack -c "$CONFIGURATION" "$proj" "${RESTORE_SWITCHES[@]}" -o "$RELEASE_FOLDER" \
-    "${DOTNET_COMMON[@]}" -p:BuildInParallel=false "$CLIENT_BUILD_PROPERTY"; then
+    "${DOTNET_COMMON[@]}" -p:BuildInParallel=false "$CLIENT_BUILD_PROPERTY" "${PACK_PROPERTIES[@]}"; then
     echo "dotnet pack failed for $proj" >&2
     exit 1
   fi
 done
 
+ARTICULATE_PACKAGE="$(find "$RELEASE_FOLDER" -maxdepth 1 -type f -name 'Articulate.*.nupkg' ! -name '*.snupkg' ! -name 'Articulate.Theme.Sample.*' -print | sort | tail -n 1)"
+if [[ -z "$ARTICULATE_PACKAGE" ]]; then
+  echo "Could not find packed Articulate nupkg in '$RELEASE_FOLDER'." >&2
+  exit 1
+fi
+
+python - "$ARTICULATE_PACKAGE" <<'PY'
+import sys
+import zipfile
+
+package_path = sys.argv[1]
+required_assets = {
+    "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/css/material.min.css",
+    "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/dist/js/material.min.js",
+    "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.min.js",
+    "staticwebassets/App_Plugins/Articulate/Themes/Material/assets/vendor/mdl/material.pink-blue.min.css",
+}
+
+with zipfile.ZipFile(package_path) as package:
+    entries = set(package.namelist())
+
+missing = sorted(required_assets - entries)
+if missing:
+    print(f"Packed Articulate package '{package_path}' is missing required static web assets:", file=sys.stderr)
+    for asset in missing:
+        print(f"  - {asset}", file=sys.stderr)
+    sys.exit(1)
+PY
+
 END_TIME=$(date +%s.%N)
 ELAPSED=$(awk -v start="$START_TIME" -v end="$END_TIME" 'BEGIN {printf "%.1f", end - start}')
 echo "Build pipeline completed in ${ELAPSED}s. Packages available at $RELEASE_FOLDER"
diff --git a/build/docker-site/ArticulateDockerSite.csproj b/build/docker-site/ArticulateDockerSite.csproj
index 070e850b9..ab5c3bfa4 100644
--- a/build/docker-site/ArticulateDockerSite.csproj
+++ b/build/docker-site/ArticulateDockerSite.csproj
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project Sdk="Microsoft.NET.Sdk.Web">
   <PropertyGroup>
-    <TargetFrameworks>net10.0</TargetFrameworks>
+    <!-- Default to net10.0; override via -p:TargetFramework=net9.0 for Umbraco 16 builds -->
+    <TargetFramework Condition="'$(TargetFramework)' == ''">net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <AssemblyName>ArticulateDockerSite</AssemblyName>
     <ArticulatePackageVersion Condition="'$(ArticulatePackageVersion)' == ''">6.0.0</ArticulatePackageVersion>
@@ -10,6 +11,8 @@
     <PackageReference Include="Umbraco.Cms" Version="$(UmbracoCmsPackageVersion)" />
     <PackageReference Include="Articulate" Version="$(ArticulatePackageVersion)" />
     <PackageReference Include="Articulate.Theme.Sample" Version="$(ArticulatePackageVersion)" />
-    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" PrivateAssets="All" />
+    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" />
+    <PackageReference Include="FileSignatures" Version="7.2.1" NoWarn="NU1608" />
+    <PackageReference Include="Markdig" Version="1.2.0" NoWarn="NU1608" />
   </ItemGroup>
 </Project>
diff --git a/build/docker-site/Program.cs b/build/docker-site/Program.cs
index d86e4822f..b414f0a01 100644
--- a/build/docker-site/Program.cs
+++ b/build/docker-site/Program.cs
@@ -11,7 +11,10 @@
     options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
 
     // Trust proxies from Docker network
+    // KnownIPNetworks requires .NET 10+ (not available on net9.0)
+#if NET10_0_OR_GREATER
     options.KnownIPNetworks.Clear();
+#endif
     options.KnownProxies.Clear();
 });
 
diff --git a/build/docker-site/README.md b/build/docker-site/README.md
index 16f69b82a..ccb079590 100644
--- a/build/docker-site/README.md
+++ b/build/docker-site/README.md
@@ -1,61 +1,87 @@
-# Local HTTPS (Windows)
+# Local Docker Site
 
-This repo uses Caddy to terminate TLS for the local Umbraco container.
+Use the repository Docker test scripts for local Docker validation:
 
-The default `Caddyfile` uses `tls internal`, which generates a local CA and a server certificate. Browsers on Windows will show a TLS error until the local CA is trusted.
+- PowerShell: `scripts/docker-test.ps1`
+- Bash: `scripts/docker-test.sh`
 
-## Windows (PowerShell)
+These scripts build the selected image, start Umbraco behind a Caddy HTTPS sidecar, verify `/` and `/umbraco`, and clean up after themselves unless the keep option is used.
 
-From the repo root:
+## Smoke Tests
 
-1. Start containers:
-   - `docker compose up -d`
+PowerShell:
 
-2. Trust Caddy's local root CA (Current User by default):
-   - `powershell -ExecutionPolicy Bypass -File .\build\docker-site\Trust-CaddyRootCA.ps1`
+```powershell
+.\scripts\docker-test.ps1 -Target umbraco16
+.\scripts\docker-test.ps1 -Target umbraco17
+.\scripts\docker-test.ps1 -Target umbraco18
+.\scripts\docker-test.ps1 -Target all
+```
 
-If you need machine-wide trust (admin required):
+Bash:
 
-- `powershell -ExecutionPolicy Bypass -File .\build\docker-site\Trust-CaddyRootCA.ps1 -Scope LocalMachine`
+```bash
+./scripts/docker-test.sh umbraco16
+./scripts/docker-test.sh umbraco17
+./scripts/docker-test.sh umbraco18
+./scripts/docker-test.sh all
+```
 
-Restart your browser and open `https://localhost:18443`.
+Each target gets its own HTTPS port so the kept containers can run side by side:
 
-- The script runs on the host and uses `docker cp` to export Caddy's internal root CA from the running `caddy` container.
-- No bind mounts are required for certificate export.
+| Target | Image | HTTPS port |
+| --- | --- | --- |
+| `umbraco16` | `articulate-local:umbraco16` | 16016 |
+| `umbraco17` | `articulate-local:umbraco17` | 17017 |
+| `umbraco18` | `articulate-local:umbraco18` | 18018 |
 
-## Debian/Ubuntu/WSL
+## Manual Browser Testing
 
-From the repo root:
+Use the keep option to leave the scripted Umbraco and Caddy containers running:
 
-1. Start containers:
-   - `docker compose up -d`
+```powershell
+.\scripts\docker-test.ps1 -Target umbraco18 -Keep
+```
 
-2. Trust Caddy's local root CA (system store; requires sudo):
-   - `./build/docker-site/trust-caddy-root-ca.sh`
+```bash
+./scripts/docker-test.sh umbraco18 --keep
+```
+
+Open the target URL printed by the script, for example `https://localhost:18018/umbraco` for Umbraco 18.
+
+Default unattended backoffice credentials:
+
+- Name: `Smoke Test`
+- Email: `smoke@umbraco18.localhost` for the Umbraco 18 target, or the matching target name for other lanes
+- Password: `@rticulate!`
+
+Clean up kept containers when finished:
+
+```bash
+docker rm -f $(docker ps -q --filter name=art-)
+docker network rm art-net-umbraco16 art-net-umbraco17 art-net-umbraco18
+```
+
+## TLS
+
+The smoke test uses `build/docker-site/Caddyfile` with `tls internal`. Browsers will warn about the local Caddy CA until it is trusted.
+
+PowerShell:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\build\docker-site\Trust-CaddyRootCA.ps1
+```
+
+Bash:
+
+```bash
+./build/docker-site/trust-caddy-root-ca.sh
+```
+
+The trust helpers need a running kept Caddy container because they export the generated local root CA from the container.
 
 ## Notes
 
-- This is unrelated to NTLM/SMB hardening; it is normal browser PKI behavior.
-- If your team policy disallows installing a local root CA, you will need a publicly trusted certificate/domain for local development.
-- Default unattended backoffice credentials for the Docker site are:
-  - Name: `Jane Doe`
-  - Email: `admin@localhost`
-  - Password: `@rticulate`
-- Override those defaults with `UMBRACO_USER_NAME`, `UMBRACO_USER_EMAIL`, and `UMBRACO_USER_PASSWORD` before starting the stack if needed.
-- The Docker image builds from packaged NuGet artifacts in `build/Release`, not directly from project output.
-- Regenerate the package inputs after client/static asset or packaged dependency changes:
-  - `dotnet pack src/Articulate.Web/Articulate.Web.csproj -c Release`
-  - `dotnet pack src/Articulate.Theme.Sample/Articulate.Theme.Sample.csproj -c Release`
-- Alternatively, run the repo build script with `PACK_SAMPLE_THEME=true` to produce both packages for Docker validation.
-- Keep `Articulate` and `Articulate.Theme.Sample` at the same package version. The Docker site restores both with the version selected from the newest `Articulate.[0-9]*.nupkg`.
-- The Dockerfile ignores `.snupkg` files and theme packages when selecting the Articulate package version.
-- Rebuilding the image is not enough on its own. A running Compose service can stay on an older container/image. Prefer:
-  - `docker compose up -d --build --force-recreate articulate`
-- Or run the two steps explicitly:
-  - `docker compose build articulate`
-  - `docker compose up -d --force-recreate --no-deps articulate`
-- `articulate-local:net10` is the image tag. The running container name is generated by Compose, for example `articulate-pr-articulate-1`.
-- If the Docker back office still serves older JavaScript, check the running container rather than only the image:
-  - `docker compose ps`
-  - `docker exec articulate-pr-articulate-1 /bin/sh -c "find /app -path '*App_Plugins/Articulate/BackOffice/articulate-backoffice.js' -o -path '*App_Plugins/Articulate/umbraco-package.json'"`
-  - `Invoke-WebRequest https://localhost:18443/App_Plugins/Articulate/BackOffice/articulate-backoffice.js -SkipCertificateCheck`
+- Docker validation should go through `scripts/docker-test.ps1` or `scripts/docker-test.sh`.
+- The test scripts ensure the required package lane contains both `Articulate.*.nupkg` and `Articulate.Theme.Sample.*.nupkg`, building the lane with `PACK_SAMPLE_THEME=true` when necessary.
+- The Umbraco 18 target uses `UMBRACO_CMS_VERSION=18.0.0-rc*`.
diff --git a/build/docker-site/Trust-CaddyRootCA.ps1 b/build/docker-site/Trust-CaddyRootCA.ps1
index 058efb41c..af23dc2f5 100644
--- a/build/docker-site/Trust-CaddyRootCA.ps1
+++ b/build/docker-site/Trust-CaddyRootCA.ps1
@@ -3,8 +3,6 @@ param(
     [ValidateSet('CurrentUser','LocalMachine')]
     [string]$Scope = 'CurrentUser',
 
-    [string]$ComposeProjectDir = (Resolve-Path (Join-Path $PSScriptRoot '..' '..')).Path,
-
     [string]$OutputPath = (Join-Path $PSScriptRoot 'caddy-local-root.crt')
 )
 
@@ -19,19 +17,11 @@ function Assert-Command {
 }
 
 function Get-CaddyContainerId {
-    param([string]$ProjectDir)
-
-    Push-Location $ProjectDir
-    try {
-        $cid = (docker compose ps -q caddy) 2>$null
-        if (-not $cid) {
-            throw "Could not find a running 'caddy' container. Run 'docker compose up -d' first."
-        }
-        return $cid.Trim()
-    }
-    finally {
-        Pop-Location
+    $cid = (docker ps --filter "name=art-caddy-" --format "{{.ID}}" | Select-Object -First 1) 2>$null
+    if (-not $cid) {
+        throw "Could not find a running Articulate Caddy container. Start one with '.\scripts\docker-test.ps1 -Target umbraco18 -Keep' first."
     }
+    return $cid.Trim()
 }
 
 function Copy-RootCAFromContainer {
@@ -82,13 +72,12 @@ function Import-RootCA {
     Import-Certificate -FilePath $CertPath -CertStoreLocation $storePath | Out-Null
 }
 
-Write-Host "Project dir: $ComposeProjectDir"
 Write-Host "Output:      $OutputPath"
 Write-Host "Scope:       $Scope"
 
 Assert-Command docker
 
-$cid = Get-CaddyContainerId -ProjectDir $ComposeProjectDir
+$cid = Get-CaddyContainerId
 Write-Host "Caddy container: $cid"
 
 Copy-RootCAFromContainer -ContainerId $cid -DestPath $OutputPath
@@ -97,4 +86,4 @@ Write-Host "Exported root CA to: $OutputPath"
 Import-RootCA -CertPath $OutputPath -Scope $Scope
 Write-Host "Imported root CA into: $Scope Trusted Root Certification Authorities"
 
-Write-Host "Restart your browser and open https://localhost:18443"
+Write-Host "Restart your browser and open the kept Docker test URL, for example https://localhost:18018"
diff --git a/build/docker-site/trust-caddy-root-ca.sh b/build/docker-site/trust-caddy-root-ca.sh
index 0f368e4be..f3cdb5fed 100644
--- a/build/docker-site/trust-caddy-root-ca.sh
+++ b/build/docker-site/trust-caddy-root-ca.sh
@@ -7,7 +7,7 @@ set -eu
 #   ./build/docker-site/trust-caddy-root-ca.sh
 #
 # Requires:
-# - docker (with compose plugin)
+# - docker
 # - sudo (to install into system trust store)
 
 need_cmd() {
@@ -27,9 +27,9 @@ OUT_FILE="$OUT_DIR/caddy-local-root.crt"
 
 cd "$PROJECT_DIR"
 
-CID=$(docker compose ps -q caddy || true)
+CID=$(docker ps --filter "name=art-caddy-" --format "{{.ID}}" | head -n 1 || true)
 if [ -z "$CID" ]; then
-  echo "Could not find running 'caddy' container. Run: docker compose up -d" >&2
+  echo "Could not find a running Articulate Caddy container. Run: ./scripts/docker-test.sh umbraco18 --keep" >&2
   exit 1
 fi
 
diff --git a/docker-compose.yml b/docker-compose.yml
deleted file mode 100644
index ebff95d33..000000000
--- a/docker-compose.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-services:
-  articulate:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        BUILD_CONFIGURATION: ${BUILD_CONFIGURATION:-Release}
-        UMBRACO_CMS_VERSION: ${UMBRACO_CMS_VERSION:-[17.2.2,18.0.0)}
-    image: ${IMAGE_TAG:-articulate-local:net10}
-    user: "1654:1654"
-    environment:
-      ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT:-Container}
-      ASPNETCORE_URLS: http://+:8080
-      # HTTPS configuration (Caddy terminates TLS)
-      Umbraco__CMS__Global__UseHttps: "true"
-      Umbraco__CMS__Security__BackOfficeHost: ${UMBRACO_PUBLIC_HOST:-https://localhost:18443}
-      Umbraco__CMS__WebRouting__UmbracoApplicationUrl: ${UMBRACO_PUBLIC_URL:-https://localhost:18443/}
-      # Unattended install
-      Umbraco__CMS__Unattended__InstallUnattended: "true"
-      Umbraco__CMS__Unattended__UpgradeUnattended: "true"
-      Umbraco__CMS__Unattended__UnattendedUserName: ${UMBRACO_USER_NAME:-Jane Doe}
-      Umbraco__CMS__Unattended__UnattendedUserEmail: ${UMBRACO_USER_EMAIL:-admin@localhost}
-      Umbraco__CMS__Unattended__UnattendedUserPassword: ${UMBRACO_USER_PASSWORD:-@rticulate}
-      # Articulate OpenID Connect
-      Articulate__ManagementApi__OpenIddict__Client__RedirectUris__0: ${ARTICULATE_REDIRECT_URI:-https://localhost:18443/a-new/}
-      Articulate__ManagementApi__OpenIddict__Client__PostLogoutRedirectUris__0: ${ARTICULATE_LOGOUT_REDIRECT_URI:-https://localhost:18443/}
-      # Uncomment for Docker-to-host image import testing:
-      # Articulate__AllowedMediaHosts__0: host.docker.internal
-      # Umbraco__CMS__Runtime__Mode: BackofficeDevelopment
-      # Articulate__AllowUnsafeLocalExternalImageHostsInDevelopment: "true"
-      # If you add a mock image sidecar instead, allowlist that service hostname instead of host.docker.internal.
-      Umbraco__CMS__ModelsBuilder__ModelsMode: ${MODELS_MODE:-Nothing}
-    volumes:
-      - articulate-media:/app/wwwroot/media
-      - articulate-db:/app/umbraco/Data
-    read_only: false
-    cap_drop:
-      - ALL
-    cap_add:
-      - NET_BIND_SERVICE
-    security_opt:
-      - no-new-privileges:true
-    tmpfs:
-      - /tmp:rw,noexec,nosuid,size=64m
-
-  caddy:
-    image: caddy:2-alpine
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-      - "18443:18443"
-    environment:
-      ARTICULATE_HOST: articulate
-      HTTPS_HOST: localhost:18443
-    command: caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
-    volumes:
-      - caddy-data:/data
-      - caddy-config:/config
-      - ./build/docker-site/Caddyfile:/etc/caddy/Caddyfile:ro
-    depends_on:
-      - articulate
-
-volumes:
-  articulate-media:
-    name: articulate_media
-  articulate-db:
-    name: articulate_db
-  caddy-data:
-  caddy-config:
diff --git a/scripts/docker-test.ps1 b/scripts/docker-test.ps1
new file mode 100644
index 000000000..3bb5b1a3c
--- /dev/null
+++ b/scripts/docker-test.ps1
@@ -0,0 +1,285 @@
+<#
+.SYNOPSIS
+    Build and smoke-test Articulate Docker images for any Umbraco target version.
+
+.EXAMPLE
+    .\scripts\docker-test.ps1 -Target umbraco16
+    .\scripts\docker-test.ps1 -Target umbraco17
+    .\scripts\docker-test.ps1 -Target umbraco18
+    .\scripts\docker-test.ps1 -Target all -Keep    # leaves containers running for manual browsing
+
+.EXAMPLE
+    # Build packages then smoke-test all three:
+    # 1. $env:ARTICULATE_PACKAGE_LANE='legacy'; .\build\build.ps1
+    # 2. $env:ARTICULATE_PACKAGE_LANE='umbraco18'; .\build\build.ps1
+    # 3. .\scripts\docker-test.ps1 -Target all -Keep
+
+.NOTES
+    Each target builds a Docker image with the correct .NET SDK, TFM, Umbraco version,
+    and package lane. The smoke test starts Umbraco + a Caddy sidecar for TLS termination
+    (required by Umbraco Production mode) and verifies both / and /umbraco respond.
+
+    Target configuration is defined in $TargetConfigs below — add or tweak versions there.
+
+    Ports (all run simultaneously with -Keep):
+      umbraco16 -> https://localhost:16016/
+      umbraco17 -> https://localhost:17017/
+      umbraco18 -> https://localhost:18018/
+#>
+Param(
+	[ValidateSet('umbraco16','umbraco17','umbraco18','all')]
+	[string]$Target = 'all',
+	[switch]$Keep
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$RepoRoot = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
+$PackDir = Join-Path $RepoRoot 'build\Release'
+
+# ── Target configuration matrix ──────────────────────────────────────────────
+# One entry per testable Umbraco version. Easy to add new targets.
+$TargetConfigs = @{
+	umbraco16 = @{
+		PackageLane     = 'legacy'
+		TFM             = 'net9.0'
+		UmbracoVersion  = '[16.5.1,17.0.0)'
+		SdkImage        = 'mcr.microsoft.com/dotnet/sdk:10.0.201'  # .NET 10 SDK can build net9.0 targets
+		AspnetImage     = 'mcr.microsoft.com/dotnet/aspnet:9.0.3'
+		ImageTag        = 'articulate-local:umbraco16'
+		ContainerPort   = 16016
+	}
+	umbraco17 = @{
+		PackageLane     = 'legacy'
+		TFM             = 'net10.0'
+		UmbracoVersion  = '[17.2.2,18.0.0)'
+		SdkImage        = 'mcr.microsoft.com/dotnet/sdk:10.0.201'
+		AspnetImage     = 'mcr.microsoft.com/dotnet/aspnet:10.0.2'
+		ImageTag        = 'articulate-local:umbraco17'
+		ContainerPort   = 17017
+	}
+	umbraco18 = @{
+		PackageLane     = 'umbraco18'
+		TFM             = 'net10.0'
+		UmbracoVersion  = '18.0.0-rc*'
+		SdkImage        = 'mcr.microsoft.com/dotnet/sdk:10.0.201'
+		AspnetImage     = 'mcr.microsoft.com/dotnet/aspnet:10.0.2'
+		ImageTag        = 'articulate-local:umbraco18'
+		ContainerPort   = 18018
+	}
+}
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+function Ensure-Packages {
+	param([string]$PackRoot, [string]$Lane)
+	$laneDir = Join-Path $PackRoot $Lane
+	$hasArticulatePackage = Test-Path (Join-Path $laneDir 'Articulate.*.nupkg')
+	$hasSampleThemePackage = Test-Path (Join-Path $laneDir 'Articulate.Theme.Sample.*.nupkg')
+	if ($hasArticulatePackage -and $hasSampleThemePackage) {
+		return
+	}
+	Write-Host "Required Docker packages missing under $laneDir. Building lane '$Lane'..."
+	$psBuild = Join-Path $RepoRoot 'build\build.ps1'
+	if (Test-Path $psBuild) {
+		$previousLane = $env:ARTICULATE_PACKAGE_LANE
+		$previousPackSampleTheme = $env:PACK_SAMPLE_THEME
+		$env:ARTICULATE_PACKAGE_LANE = $Lane
+		$env:PACK_SAMPLE_THEME = 'true'
+		try {
+			& pwsh -NoProfile -ExecutionPolicy Bypass -File $psBuild
+			if ($LASTEXITCODE -ne 0) { throw "Package build failed with exit code $LASTEXITCODE" }
+		}
+		finally {
+			$env:ARTICULATE_PACKAGE_LANE = $previousLane
+			$env:PACK_SAMPLE_THEME = $previousPackSampleTheme
+		}
+	}
+	else {
+		& bash -lc "(cd '$RepoRoot' && ARTICULATE_PACKAGE_LANE=$Lane PACK_SAMPLE_THEME=true ./build/build.sh)"
+		if ($LASTEXITCODE -ne 0) { throw "Package build failed with exit code $LASTEXITCODE" }
+	}
+}
+
+function Build-And-Test {
+	param(
+		[string]$TargetName,
+		[hashtable]$Config
+	)
+
+	$lane = $Config.PackageLane
+	$tfm = $Config.TFM
+	$umbVer = $Config.UmbracoVersion
+	$imgTag = $Config.ImageTag
+	$port = $Config.ContainerPort
+	$pkgSrc = Join-Path $PackDir $lane
+	$dockerPkgSrc = "build/Release/$lane"
+
+	if (-not (Test-Path $pkgSrc)) {
+		Write-Error "Package source '$pkgSrc' not found; ensure build produced packages for lane=$lane"
+		return 1
+	}
+
+	Write-Host ""
+	Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Cyan
+	Write-Host "  Target: $TargetName  |  Lane: $lane  |  TFM: $tfm" -ForegroundColor Cyan
+	Write-Host "  Umbraco: $umbVer" -ForegroundColor Cyan
+	Write-Host "  Image: $imgTag" -ForegroundColor Cyan
+	Write-Host "  HTTPS smoke test: https://localhost:$port/" -ForegroundColor Cyan
+	Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Cyan
+	Write-Host ""
+
+	# ── Build Docker image ────────────────────────────────────────────────────
+	Write-Host "Building Docker image $imgTag ..."
+	$buildArgs = @(
+		'--build-arg', "DOTNET_SDK_IMAGE=$($Config.SdkImage)",
+		'--build-arg', "DOTNET_ASPNET_IMAGE=$($Config.AspnetImage)",
+		'--build-arg', "TARGET_FRAMEWORK=$tfm",
+		'--build-arg', "UMBRACO_CMS_VERSION=$umbVer",
+		'--build-arg', "PACKAGE_SOURCE=$dockerPkgSrc",
+		'--build-arg', "PACKAGE_LANE=$lane"
+	)
+	& docker build --no-cache --pull @buildArgs -t $imgTag $RepoRoot
+	if ($LASTEXITCODE -ne 0) {
+		Write-Host "Docker build failed for $imgTag" -ForegroundColor Red
+		return $LASTEXITCODE
+	}
+
+	# ── Run Umbraco + Caddy for HTTPS smoke test ─────────────────────────────
+	$containerName = "art-$TargetName"
+	$caddyName = "art-caddy-$TargetName"
+	$networkName = "art-net-$TargetName"
+
+	# Create isolated network so Caddy can resolve the app container
+	docker network create $networkName 2>$null | Out-Null
+
+	# Umbraco app container (HTTP internally, Production mode with UseHttps)
+	$appEnvVars = @(
+		'-e', 'ASPNETCORE_ENVIRONMENT=Container',
+		'-e', 'ASPNETCORE_URLS=http://+:8080',
+		'-e', 'ConnectionStrings__umbracoDbDSN=Data Source=/app/umbraco/Data/Umbraco.sqlite.db;Cache=Shared;Foreign Keys=True;Pooling=True',
+		'-e', 'ConnectionStrings__umbracoDbDSN_ProviderName=Microsoft.Data.Sqlite',
+		# Production HTTPS requirements (Caddy terminates TLS)
+		'-e', 'Umbraco__CMS__Global__UseHttps=true',
+		'-e', "Umbraco__CMS__WebRouting__UmbracoApplicationUrl=https://localhost:$port/",
+		'-e', "Umbraco__CMS__Security__BackOfficeHost=https://localhost:$port",
+		# Unattended install
+		'-e', 'Umbraco__CMS__Unattended__InstallUnattended=true',
+		'-e', 'Umbraco__CMS__Unattended__UpgradeUnattended=true',
+		'-e', 'Umbraco__CMS__Unattended__PackageMigrationsUnattended=true',
+		'-e', 'Umbraco__CMS__Unattended__UnattendedUserName=Smoke Test',
+		'-e', "Umbraco__CMS__Unattended__UnattendedUserEmail=smoke@$TargetName.localhost",
+		'-e', 'Umbraco__CMS__Unattended__UnattendedUserPassword=@rticulate!',
+		'-e', 'Umbraco__CMS__ModelsBuilder__ModelsMode=Nothing'
+	)
+
+	Write-Host "Starting Umbraco container $containerName ..."
+	& docker run -d --rm --name $containerName --network $networkName @appEnvVars $imgTag | Out-Null
+
+	# Caddy sidecar for TLS termination
+	$caddyfile = Join-Path $RepoRoot 'build/docker-site/Caddyfile'
+	# Caddyfile listens on :18443 inside the container; we map host port to it
+	Write-Host "Starting Caddy sidecar $caddyName on https://localhost:$port ..."
+	& docker run -d --rm --name $caddyName --network $networkName `
+		-p "${port}:18443" `
+		-v "${caddyfile}:/etc/caddy/Caddyfile:ro" `
+		-e "ARTICULATE_HOST=$containerName" `
+		-e "HTTPS_HOST=localhost:$port" `
+		caddy:2-alpine `
+		caddy run --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1 | Out-Null
+
+	try {
+		$rootOk = $false
+		$umbracoOk = $false
+
+		for ($i = 0; $i -lt 45; $i++) {
+			if (-not $rootOk) {
+				try {
+					$root = Invoke-WebRequest -UseBasicParsing -Uri "https://localhost:$port/" -TimeoutSec 3 -ErrorAction Stop -SkipCertificateCheck
+					if ($root.StatusCode -ge 200 -and $root.StatusCode -lt 400) {
+						$rootOk = $true
+						Write-Host "  / => HTTP $($root.StatusCode) OK" -ForegroundColor Green
+					}
+				}
+				catch { }
+			}
+
+			if (-not $umbracoOk) {
+				try {
+					$resp = Invoke-WebRequest -UseBasicParsing -Uri "https://localhost:$port/umbraco" -TimeoutSec 3 -ErrorAction Stop -SkipCertificateCheck
+					if ($resp.StatusCode -ge 200 -and $resp.StatusCode -lt 400) {
+						$umbracoOk = $true
+						Write-Host "  /umbraco => HTTP $($resp.StatusCode) OK" -ForegroundColor Green
+					}
+				}
+				catch { }
+			}
+
+			if ($rootOk -and $umbracoOk) {
+				Write-Host ""
+				if ($script:Keep) {
+				Write-Host "  PASSED: $TargetName ($imgTag)  =>  https://localhost:$port/" -ForegroundColor Green
+			} else {
+				Write-Host "  PASSED: $TargetName ($imgTag)" -ForegroundColor Green
+			}
+				return 0
+			}
+
+			Start-Sleep -Seconds 2
+		}
+
+		# Failed — dump diagnostics
+		Write-Host ""
+		Write-Host "  FAILED: $TargetName ($imgTag)" -ForegroundColor Red
+		Write-Host "  / => $(if ($rootOk) { 'OK' } else { 'FAIL' })" -ForegroundColor $(if ($rootOk) { 'Green' } else { 'Red' })
+		Write-Host "  /umbraco => $(if ($umbracoOk) { 'OK' } else { 'FAIL' })" -ForegroundColor $(if ($umbracoOk) { 'Green' } else { 'Red' })
+		Write-Host ""
+		Write-Host '--- Umbraco logs (last 60 lines) ---' -ForegroundColor Yellow
+		docker logs $containerName 2>&1 | Select-Object -Last 60 | ForEach-Object { Write-Host $_ }
+		Write-Host '--- Caddy logs (last 10 lines) ---' -ForegroundColor Yellow
+		docker logs $caddyName 2>&1 | Select-Object -Last 10 | ForEach-Object { Write-Host $_ }
+		return 2
+	}
+	finally {
+		if (-not $script:Keep) {
+			docker rm -f $caddyName 2>$null | Out-Null
+			docker rm -f $containerName 2>$null | Out-Null
+			docker network rm $networkName 2>$null | Out-Null
+		}
+	}
+}
+
+# ── Main ──────────────────────────────────────────────────────────────────────
+
+$targets = if ($Target -eq 'all') { @('umbraco16','umbraco17','umbraco18') } else { @($Target) }
+
+# Build all needed package lanes up front
+$lanes = $targets | ForEach-Object { $TargetConfigs[$_].PackageLane } | Sort-Object -Unique
+foreach ($lane in $lanes) {
+	Ensure-Packages -PackRoot $PackDir -Lane $lane
+}
+
+# Run each target
+$exitCode = 0
+$script:Keep = $Keep.IsPresent
+foreach ($t in $targets) {
+	$result = [int](Build-And-Test -TargetName $t -Config $TargetConfigs[$t])
+	if ($result -ne 0 -and $exitCode -eq 0) {
+		$exitCode = $result
+	}
+}
+
+if ($Keep.IsPresent -and $exitCode -eq 0) {
+	Write-Host ""
+	Write-Host "Containers kept alive for manual inspection:" -ForegroundColor Cyan
+	Write-Host "  docker ps --filter name=art-" -ForegroundColor White
+	foreach ($t in $targets) {
+		$port = $TargetConfigs[$t].ContainerPort
+		Write-Host "  $t => https://localhost:$port/  |  https://localhost:$port/umbraco" -ForegroundColor Yellow
+	}
+	Write-Host ""
+	Write-Host "To clean up:  docker rm -f $(docker ps -q --filter name=art-)" -ForegroundColor DarkGray
+}
+
+exit $exitCode
diff --git a/scripts/docker-test.sh b/scripts/docker-test.sh
new file mode 100644
index 000000000..40e9e0944
--- /dev/null
+++ b/scripts/docker-test.sh
@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build and smoke-test Articulate Docker images for Umbraco 16/17/18.
+# Usage:
+#   ./scripts/docker-test.sh [umbraco16|umbraco17|umbraco18|all] [--keep]
+
+CHOICE="${1:-all}"
+KEEP=false
+if [[ "${2:-}" == "--keep" || "${2:-}" == "-k" ]]; then
+  KEEP=true
+fi
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+PACK_DIR="$REPO_ROOT/build/Release"
+
+declare -A PACKAGE_LANE=(
+  [umbraco16]="legacy"
+  [umbraco17]="legacy"
+  [umbraco18]="umbraco18"
+)
+declare -A TFM=(
+  [umbraco16]="net9.0"
+  [umbraco17]="net10.0"
+  [umbraco18]="net10.0"
+)
+declare -A UMBRACO_VERSION=(
+  [umbraco16]="[16.5.1,17.0.0)"
+  [umbraco17]="[17.2.2,18.0.0)"
+  [umbraco18]="18.0.0-rc*"
+)
+declare -A SDK_IMAGE=(
+  [umbraco16]="mcr.microsoft.com/dotnet/sdk:10.0.201"
+  [umbraco17]="mcr.microsoft.com/dotnet/sdk:10.0.201"
+  [umbraco18]="mcr.microsoft.com/dotnet/sdk:10.0.201"
+)
+declare -A ASPNET_IMAGE=(
+  [umbraco16]="mcr.microsoft.com/dotnet/aspnet:9.0.3"
+  [umbraco17]="mcr.microsoft.com/dotnet/aspnet:10.0.2"
+  [umbraco18]="mcr.microsoft.com/dotnet/aspnet:10.0.2"
+)
+declare -A IMAGE_TAG=(
+  [umbraco16]="articulate-local:umbraco16"
+  [umbraco17]="articulate-local:umbraco17"
+  [umbraco18]="articulate-local:umbraco18"
+)
+declare -A HTTPS_PORT=(
+  [umbraco16]="16016"
+  [umbraco17]="17017"
+  [umbraco18]="18018"
+)
+
+usage() {
+  echo "Usage: $0 [umbraco16|umbraco17|umbraco18|all] [--keep]" >&2
+}
+
+ensure_packages() {
+  local lane="$1"
+  local lane_dir="$PACK_DIR/$lane"
+  shopt -s nullglob
+  local articulate_packages=("$lane_dir"/Articulate.[0-9]*.nupkg)
+  local sample_packages=("$lane_dir"/Articulate.Theme.Sample.*.nupkg)
+  shopt -u nullglob
+
+  if [[ ${#articulate_packages[@]} -gt 0 && ${#sample_packages[@]} -gt 0 ]]; then
+    return 0
+  fi
+
+  echo "Required Docker packages missing under $lane_dir. Building lane '$lane'..."
+  (cd "$REPO_ROOT" && ARTICULATE_PACKAGE_LANE="$lane" PACK_SAMPLE_THEME=true bash ./build/build.sh)
+}
+
+cleanup_target() {
+  local target="$1"
+  if [[ "$KEEP" == false ]]; then
+    docker rm -f "art-caddy-$target" >/dev/null 2>&1 || true
+    docker rm -f "art-$target" >/dev/null 2>&1 || true
+    docker network rm "art-net-$target" >/dev/null 2>&1 || true
+  fi
+}
+
+build_and_test() {
+  local target="$1"
+  local lane="${PACKAGE_LANE[$target]}"
+  local tfm="${TFM[$target]}"
+  local umb_ver="${UMBRACO_VERSION[$target]}"
+  local sdk_image="${SDK_IMAGE[$target]}"
+  local aspnet_image="${ASPNET_IMAGE[$target]}"
+  local img_tag="${IMAGE_TAG[$target]}"
+  local port="${HTTPS_PORT[$target]}"
+  local docker_pkg_src="build/Release/$lane"
+  local caddyfile="$REPO_ROOT/build/docker-site/Caddyfile"
+
+  echo
+  echo "==========================================================="
+  echo "  Target: $target  |  Lane: $lane  |  TFM: $tfm"
+  echo "  Umbraco: $umb_ver"
+  echo "  Image: $img_tag"
+  echo "  HTTPS smoke test: https://localhost:$port/"
+  echo "==========================================================="
+  echo
+
+  docker build --no-cache --pull \
+    --build-arg "DOTNET_SDK_IMAGE=$sdk_image" \
+    --build-arg "DOTNET_ASPNET_IMAGE=$aspnet_image" \
+    --build-arg "TARGET_FRAMEWORK=$tfm" \
+    --build-arg "UMBRACO_CMS_VERSION=$umb_ver" \
+    --build-arg "PACKAGE_SOURCE=$docker_pkg_src" \
+    --build-arg "PACKAGE_LANE=$lane" \
+    -t "$img_tag" \
+    "$REPO_ROOT"
+
+  local container_name="art-$target"
+  local caddy_name="art-caddy-$target"
+  local network_name="art-net-$target"
+
+  docker network create "$network_name" >/dev/null 2>&1 || true
+
+  docker run -d --rm --name "$container_name" --network "$network_name" \
+    -e "ASPNETCORE_ENVIRONMENT=Container" \
+    -e "ASPNETCORE_URLS=http://+:8080" \
+    -e "ConnectionStrings__umbracoDbDSN=Data Source=/app/umbraco/Data/Umbraco.sqlite.db;Cache=Shared;Foreign Keys=True;Pooling=True" \
+    -e "ConnectionStrings__umbracoDbDSN_ProviderName=Microsoft.Data.Sqlite" \
+    -e "Umbraco__CMS__Global__UseHttps=true" \
+    -e "Umbraco__CMS__WebRouting__UmbracoApplicationUrl=https://localhost:$port/" \
+    -e "Umbraco__CMS__Security__BackOfficeHost=https://localhost:$port" \
+    -e "Umbraco__CMS__Unattended__InstallUnattended=true" \
+    -e "Umbraco__CMS__Unattended__UpgradeUnattended=true" \
+    -e "Umbraco__CMS__Unattended__PackageMigrationsUnattended=true" \
+    -e "Umbraco__CMS__Unattended__UnattendedUserName=Smoke Test" \
+    -e "Umbraco__CMS__Unattended__UnattendedUserEmail=smoke@$target.localhost" \
+    -e "Umbraco__CMS__Unattended__UnattendedUserPassword=@rticulate!" \
+    -e "Umbraco__CMS__ModelsBuilder__ModelsMode=Nothing" \
+    "$img_tag" >/dev/null
+
+  docker run -d --rm --name "$caddy_name" --network "$network_name" \
+    -p "$port:18443" \
+    -v "$caddyfile:/etc/caddy/Caddyfile:ro" \
+    -e "ARTICULATE_HOST=$container_name" \
+    -e "HTTPS_HOST=localhost:$port" \
+    caddy:2-alpine \
+    caddy run --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null
+
+  local root_ok=false
+  local umbraco_ok=false
+  local i=0
+
+  while [[ $i -lt 45 ]]; do
+    if [[ "$root_ok" == false ]] && curl -kfsS "https://localhost:$port/" >/dev/null 2>&1; then
+      root_ok=true
+      echo "  / => OK"
+    fi
+    if [[ "$umbraco_ok" == false ]] && curl -kfsS "https://localhost:$port/umbraco" >/dev/null 2>&1; then
+      umbraco_ok=true
+      echo "  /umbraco => OK"
+    fi
+    if [[ "$root_ok" == true && "$umbraco_ok" == true ]]; then
+      if [[ "$KEEP" == true ]]; then
+        echo "  PASSED: $target ($img_tag) => https://localhost:$port/"
+      else
+        echo "  PASSED: $target ($img_tag)"
+      fi
+      cleanup_target "$target"
+      return 0
+    fi
+    i=$((i + 1))
+    sleep 2
+  done
+
+  echo "  FAILED: $target ($img_tag)" >&2
+  echo "--- Umbraco logs (last 60 lines) ---" >&2
+  docker logs "$container_name" 2>&1 | tail -n 60 >&2 || true
+  echo "--- Caddy logs (last 10 lines) ---" >&2
+  docker logs "$caddy_name" 2>&1 | tail -n 10 >&2 || true
+  cleanup_target "$target"
+  return 2
+}
+
+case "$CHOICE" in
+  umbraco16|umbraco17|umbraco18)
+    targets=("$CHOICE")
+    ;;
+  all)
+    targets=(umbraco16 umbraco17 umbraco18)
+    ;;
+  *)
+    usage
+    exit 1
+    ;;
+esac
+
+lanes=()
+for target in "${targets[@]}"; do
+  lane="${PACKAGE_LANE[$target]}"
+  if [[ ! " ${lanes[*]} " =~ " $lane " ]]; then
+    lanes+=("$lane")
+  fi
+done
+
+for lane in "${lanes[@]}"; do
+  ensure_packages "$lane"
+done
+
+exit_code=0
+for target in "${targets[@]}"; do
+  if build_and_test "$target"; then
+    :
+  else
+    result=$?
+    if [[ $exit_code -eq 0 ]]; then
+      exit_code=$result
+    fi
+  fi
+done
+
+if [[ "$KEEP" == true && $exit_code -eq 0 ]]; then
+  echo
+  echo "Containers kept alive for manual inspection:"
+  docker ps --filter name=art-
+  for target in "${targets[@]}"; do
+    echo "  $target => https://localhost:${HTTPS_PORT[$target]}/  |  https://localhost:${HTTPS_PORT[$target]}/umbraco"
+  done
+  echo "To clean up: docker rm -f \$(docker ps -q --filter name=art-)"
+fi
+
+exit "$exit_code"
diff --git a/src/Articulate.Tests.Website/Articulate.Tests.Website.csproj b/src/Articulate.Tests.Website/Articulate.Tests.Website.csproj
index 0a44ae06f..db70bba94 100644
--- a/src/Articulate.Tests.Website/Articulate.Tests.Website.csproj
+++ b/src/Articulate.Tests.Website/Articulate.Tests.Website.csproj
@@ -10,7 +10,6 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Umbraco.Cms" Version="$(UmbracoCmsPackageVersion)" />
-    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" PrivateAssets="All" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
     <PackageReference Include="Umbraco.Cms.DevelopmentMode.Backoffice" Version="$(UmbracoCmsPackageVersion)" />
diff --git a/src/Articulate.Tests/Articulate.Tests.csproj b/src/Articulate.Tests/Articulate.Tests.csproj
index c436543ba..8c63384f2 100644
--- a/src/Articulate.Tests/Articulate.Tests.csproj
+++ b/src/Articulate.Tests/Articulate.Tests.csproj
@@ -13,13 +13,12 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkPackageVersion)" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <PackageReference Include="NUnit" Version="3.14.0" />
     <PackageReference Include="NUnit3TestAdapter" Version="4.6.0" />
     <PackageReference Include="Umbraco.Cms" Version="$(UmbracoCmsPackageVersion)" />
     <PackageReference Include="Umbraco.Cms.Tests.Integration" Version="$(UmbracoCmsPackageVersion)" />
-    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
diff --git a/src/Articulate.Tests/Routing/ArticulateRouteValidatorTests.cs b/src/Articulate.Tests/Routing/ArticulateRouteValidatorTests.cs
index 46878a3b8..1d657737b 100644
--- a/src/Articulate.Tests/Routing/ArticulateRouteValidatorTests.cs
+++ b/src/Articulate.Tests/Routing/ArticulateRouteValidatorTests.cs
@@ -167,15 +167,13 @@ public void ValidateRootPathMappings_rejects_same_path_with_equivalent_path_base
         [Test]
         public void ValidateConfiguredRouteSegments_rejects_duplicate_child_route_segments()
         {
-            IPublishedContent root = CreateRoot(
-                children:
-                [
-                    CreateRoot(name: "Child A", urlSegment: "tags"),
-                    CreateRoot(name: "Child B", urlSegment: "Tags")
-                ]);
+            IPublishedContent root = CreateRoot();
 
             InvalidOperationException ex = Assert.Throws<InvalidOperationException>(() =>
-                ArticulateRouteValidator.ValidateConfiguredRouteSegments(root))!;
+                ArticulateRouteValidator.ValidateConfiguredRouteSegments(root, [
+                    CreateRoot(name: "Child A", urlSegment: "tags"),
+                    CreateRoot(name: "Child B", urlSegment: "Tags")
+                ]))!;
 
             Assert.That(ex.Message, Does.Contain("child content 'Child A'"));
             Assert.That(ex.Message, Does.Contain("child content 'Child B'"));
@@ -217,8 +215,7 @@ private static IPublishedContent CreateRoot(
             int id = 1,
             string name = "Blog",
             string path = "-1,1",
-            string urlSegment = "blog",
-            IEnumerable<IPublishedContent>? children = null)
+            string urlSegment = "blog")
         {
             Mock<IPublishedContentType> contentType = new();
             contentType.SetupGet(x => x.Alias).Returns(ArticulateConstants.ContentType.Articulate);
@@ -227,11 +224,22 @@ private static IPublishedContent CreateRoot(
             root.SetupGet(x => x.Id).Returns(id);
             root.SetupGet(x => x.Name).Returns(name);
             root.SetupGet(x => x.Path).Returns(path);
+            root.SetupGet(x => x.Key).Returns(Guid.NewGuid());
+            root.SetupGet(x => x.Properties).Returns([]);
+            root.Setup(x => x.GetProperty(It.IsAny<string>())).Returns((IPublishedProperty?)null);
+            root.SetupGet(x => x.SortOrder).Returns(0);
+            root.SetupGet(x => x.CreatorId).Returns(0);
+            root.SetupGet(x => x.CreateDate).Returns(DateTime.UtcNow);
+            root.SetupGet(x => x.WriterId).Returns(0);
+            root.SetupGet(x => x.UpdateDate).Returns(DateTime.UtcNow);
+            root.SetupGet(x => x.Cultures).Returns(new Dictionary<string, PublishedCultureInfo>());
+            root.SetupGet(x => x.ItemType).Returns(PublishedItemType.Content);
+            root.Setup(x => x.IsDraft(It.IsAny<string?>())).Returns(false);
+            root.Setup(x => x.IsPublished(It.IsAny<string?>())).Returns(true);
+            root.SetupGet(x => x.Level).Returns(1);
+            root.SetupGet(x => x.TemplateId).Returns((int?)null);
             root.SetupGet(x => x.UrlSegment).Returns(urlSegment);
             root.SetupGet(x => x.ContentType).Returns(contentType.Object);
-#pragma warning disable CS0618 // Test double needs to supply the legacy Children property used by validation.
-            root.SetupGet(x => x.Children).Returns(children ?? []);
-#pragma warning restore CS0618
             return root.Object;
         }
     }
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Master.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Master.cshtml
index f6cc5b281..559a9e218 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Master.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Master.cshtml
@@ -68,11 +68,11 @@
 
     @await RenderSectionAsync("Header", false)
 
-    @if (Model.BlogBannerCss is not null)
+    @if (Model.BlogBanner is not null)
     {
         <style>
             body::before {
-                background-image: url('@Model.BlogBannerCss');
+                background-image: url('@Model.BlogBanner.ToCssStyleUrl()');
                 background-size: cover;
                 background-attachment: fixed;
             }
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/AuthorInfo.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/AuthorInfo.cshtml
index ef164f258..008febffb 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/AuthorInfo.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/AuthorInfo.cshtml
@@ -4,7 +4,7 @@
 {
     if (Model.Author.Image is not null)
     {
-        var thumbnail = Model.Author.Image.GetCropUrl(cropAlias: "thumbnail", preferFocalPoint: true, useCropDimensions: true)?.ToSafeCssUrl();
+        var thumbnail = Model.Author.Image.GetCropUrl(cropAlias: "thumbnail", preferFocalPoint: true, useCropDimensions: true)?.ToCssStyleUrl();
         if (thumbnail is not null)
         {
             <div class="minilogo" style="background: url('@thumbnail')"></div>
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/PostImageHeader.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/PostImageHeader.cshtml
index fe8b1e766..fd123380a 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/PostImageHeader.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/Material/Views/Partials/PostImageHeader.cshtml
@@ -1,11 +1,8 @@
 @model IImageModel
 @{
-    var bgUrl = Model.CroppedWideUrl;
-    var safeBgUrl = bgUrl.ToSafeCssUrl();
-
-    if (safeBgUrl is not null)
+    if (Model.CroppedWideUrl is not null)
     {
-        <div class="@Model.Image.GetImageClass("mdl-card__media") mdl-color-text--grey-50" style="background-image: url('@safeBgUrl');">
+        <div class="@Model.Image.GetImageClass("mdl-card__media") mdl-color-text--grey-50" style="background-image: url('@Model.CroppedWideUrl.ToCssStyleUrl()');">
             <h3>
                 <a href="@Model.Url">@Model.Name</a>
             </h3>
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/Mini/Views/Partials/Header.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/Mini/Views/Partials/Header.cshtml
index 87238b762..96ebe27d0 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/Mini/Views/Partials/Header.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/Mini/Views/Partials/Header.cshtml
@@ -3,8 +3,8 @@
 <div class="header-placeholder">&nbsp;</div>
 
 @{
-    string backgroundStyle = Model.BlogBannerCss is not null
-        ? $"background-image: url('{Model.BlogBannerCss}');"
+    string backgroundStyle = Model.BlogBanner is not null
+        ? $"background-image: url('{Model.BlogBanner.ToCssStyleUrl()}');"
         : "";
 }
 <div class="header-content" style="@backgroundStyle">
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/Phantom/Views/Partials/Sidebar.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/Phantom/Views/Partials/Sidebar.cshtml
index 466202365..953ca5992 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/Phantom/Views/Partials/Sidebar.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/Phantom/Views/Partials/Sidebar.cshtml
@@ -1,8 +1,8 @@
 @model IMasterModel
 
 @{
-    var backgroundStyle = Model.BlogBannerCss is not null
-        ? $"background-image: url('{Model.BlogBannerCss}');"
+    var backgroundStyle = Model.BlogBanner is not null
+        ? $"background-image: url('{Model.BlogBanner.ToCssStyleUrl()}');"
         : string.Empty;
 }
 <div class="sidebar" role="heading" style="@backgroundStyle">
diff --git a/src/Articulate.Web/App_Plugins/Articulate/Themes/VAPOR/Views/List.cshtml b/src/Articulate.Web/App_Plugins/Articulate/Themes/VAPOR/Views/List.cshtml
index 0fca6cda9..681d4e368 100644
--- a/src/Articulate.Web/App_Plugins/Articulate/Themes/VAPOR/Views/List.cshtml
+++ b/src/Articulate.Web/App_Plugins/Articulate/Themes/VAPOR/Views/List.cshtml
@@ -23,7 +23,7 @@ else
             </header>
             <section class="post-excerpt">
                 @{
-                    var thumbnail = post.PostImage?.GetCropUrl(cropAlias: "blogPost", preferFocalPoint: true, useCropDimensions: true)?.ToSafeCssUrl();
+                    var thumbnail = post.PostImage?.GetCropUrl(cropAlias: "blogPost", preferFocalPoint: true, useCropDimensions: true)?.ToCssStyleUrl();
                 }
                 @if (thumbnail is not null)
                 {
diff --git a/src/Articulate.Web/Articulate.Web.csproj b/src/Articulate.Web/Articulate.Web.csproj
index 1b9f16000..74baa9f60 100644
--- a/src/Articulate.Web/Articulate.Web.csproj
+++ b/src/Articulate.Web/Articulate.Web.csproj
@@ -35,12 +35,11 @@
     <PackageReference Include="Umbraco.Cms.Api.Management" Version="$(UmbracoCmsPackageVersion)" />
     <!-- Third-party dependencies (from Articulate.csproj) -->
     <PackageReference Include="Argotic.Core" Version="3001.0.0" />
-    <PackageReference Include="FileSignatures" Version="6.1.1" />
-    <PackageReference Include="Markdig" Version="0.44.0" />
+    <PackageReference Include="FileSignatures" Version="7.2.1" />
+    <PackageReference Include="Markdig" Version="$(MarkdigPackageVersion)" />
     <PackageReference Include="WilderMinds.MetaWeblog" Version="5.1.3" />
     <PackageReference Include="System.ServiceModel.Syndication" Version="$(SystemServiceModelSyndicationPackageVersion)" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlPackageVersion)" PrivateAssets="All" />
-    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" PrivateAssets="All" />
   </ItemGroup>
 
   <!-- Build targets shipped with the package (copies XML docs for Swagger) -->
@@ -109,7 +108,7 @@
     <Error Text="pnpm-lock.yaml is out of sync. Run 'pnpm install' locally." Condition="'$(PnpmFrozenExitCode)' != '0' and '$(PnpmFrozenExitCode)' != ''" />
 
     <!-- Local Dev: Standard Install -->
-    <Exec Command="pnpm install" WorkingDirectory="$(ClientProjectDirectory)" Condition="'$(CI)' != 'true'" />
+    <Exec Command="pnpm install --config.confirmModulesPurge=false" WorkingDirectory="$(ClientProjectDirectory)" Condition="'$(CI)' != 'true'" />
 
     <!-- The Actual Build -->
     <Exec Command="$(ClientBuildCommand)" WorkingDirectory="$(ClientProjectDirectory)" EnvironmentVariables="ARTICULATE_APP_VERSION=$(_ResolvedArticulateAppVersion)" />
diff --git a/src/Articulate/Articulate.csproj b/src/Articulate/Articulate.csproj
index fe1235806..d9c1b7f44 100644
--- a/src/Articulate/Articulate.csproj
+++ b/src/Articulate/Articulate.csproj
@@ -14,15 +14,15 @@
     <PackageReference Include="Umbraco.Cms.Api.Management" Version="$(UmbracoCmsPackageVersion)" />
 
     <PackageReference Include="Argotic.Core" Version="3001.0.0" />
-    <PackageReference Include="FileSignatures" Version="6.1.1" />
-    <PackageReference Include="Markdig" Version="0.44.0" />
+    <PackageReference Include="FileSignatures" Version="7.2.1" />
+    <PackageReference Include="Markdig" Version="$(MarkdigPackageVersion)" />
     <PackageReference Include="WilderMinds.MetaWeblog" Version="5.1.3" />
     <PackageReference Include="System.ServiceModel.Syndication" Version="$(SystemServiceModelSyndicationPackageVersion)" />
   </ItemGroup>
 
   <ItemGroup Label="Force minimum versions">
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlPackageVersion)" PrivateAssets="All" />
-    <PackageReference Include="OpenMcdf" Version="$(OpenMcdfPackageVersion)" PrivateAssets="All" />
+    <!-- Align minimum System.Security.Cryptography.Xml to Umbraco's requirement to avoid NU1605 downgrades -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="[10.0.7,11.0.0)" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Articulate/Components/ArticulateApiComposer.cs b/src/Articulate/Components/ArticulateApiComposer.cs
index 4e4774fea..c8a9da9b0 100644
--- a/src/Articulate/Components/ArticulateApiComposer.cs
+++ b/src/Articulate/Components/ArticulateApiComposer.cs
@@ -4,26 +4,40 @@
 using Articulate.Swagger;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
 using Umbraco.Cms.Api.Common.OpenApi;
+#else
+using Umbraco.Cms.Api.Common.OpenApi;
+using Umbraco.Cms.Api.Management.OpenApi;
+#endif
 using Umbraco.Cms.Core.Composing;
 using Umbraco.Cms.Core.Notifications;
 
 namespace Articulate.Components
 {
     /// <summary>
-    /// Composes the Articulate API by registering Swagger/OpenAPI configuration and operation handlers.
+    /// Composes the Articulate API by registering version-appropriate OpenAPI configuration and application services.
     /// </summary>
     public class ArticulateApiComposer : IComposer
     {
         /// <summary>
-        /// Registers services and configures Swagger/OpenAPI for the Articulate API.
+        /// Registers services and configures Articulate OpenAPI behavior for the active Umbraco runtime.
         /// </summary>
         /// <param name="builder">The Umbraco builder used for service registration.</param>
         public void Compose(IUmbracoBuilder builder)
         {
             IServiceCollection services = builder.Services;
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
             _ = services.AddSingleton<IOperationIdHandler, ArticulateOperationIdHandler>();
             _ = services.ConfigureOptions<ArticulateSwaggerOptions>();
+#else
+            _ = services.ConfigureOptions<ArticulateSwaggerOptions>();
+            _ = builder.AddBackOfficeOpenApiDocument(
+                ArticulateConstants.ManagementApi.Name,
+                document => document
+                    .WithTitle("Articulate Management API")
+                    .WithBackOfficeAuthentication());
+#endif
             _ = services.Configure<ArticulateOpenIdClientOptions>(
                 builder.Config.GetSection(ArticulateOpenIdClientOptions.SectionName));
             _ = services.AddSingleton<IValidateOptions<ArticulateOpenIdClientOptions>, ArticulateOpenIdClientOptionsValidator>();
diff --git a/src/Articulate/Components/ArticulateComposer.cs b/src/Articulate/Components/ArticulateComposer.cs
index fe7271a79..2b85c2f04 100644
--- a/src/Articulate/Components/ArticulateComposer.cs
+++ b/src/Articulate/Components/ArticulateComposer.cs
@@ -59,8 +59,13 @@ public void Compose(IUmbracoBuilder builder)
                 options.ViewLocationExpanders.Add(new ArticulateViewLocationExpander());
             });
 
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+            _ = builder.UrlProviders().InsertBefore<DefaultUrlProvider, DateFormattedUrlProvider>();
+            _ = builder.ContentFinders().InsertBefore<ContentFinderByUrl, DateFormattedPostContentFinder>();
+#else
             _ = builder.UrlProviders().InsertBefore<NewDefaultUrlProvider, DateFormattedUrlProvider>();
             _ = builder.ContentFinders().InsertBefore<ContentFinderByUrlNew, DateFormattedPostContentFinder>();
+#endif
 
             _ = services.AddOptions<ArticulateOptions>()
                 .BindConfiguration("Articulate");
diff --git a/src/Articulate/Controllers/MetaWeblogController.cs b/src/Articulate/Controllers/MetaWeblogController.cs
index 05153af58..40c88048a 100644
--- a/src/Articulate/Controllers/MetaWeblogController.cs
+++ b/src/Articulate/Controllers/MetaWeblogController.cs
@@ -3,7 +3,6 @@
 using System.Xml;
 using System.Xml.Linq;
 using Articulate.Attributes;
-using Articulate.ImportExport;
 using Articulate.MetaWeblog;
 using Articulate.Options;
 using Microsoft.AspNetCore.Mvc;
diff --git a/src/Articulate/Migrations/ArticulateMigrationPlanExecutedHandler.cs b/src/Articulate/Migrations/ArticulateMigrationPlanExecutedHandler.cs
index 08bf4011a..43a4cbed3 100644
--- a/src/Articulate/Migrations/ArticulateMigrationPlanExecutedHandler.cs
+++ b/src/Articulate/Migrations/ArticulateMigrationPlanExecutedHandler.cs
@@ -108,10 +108,17 @@ private bool ShouldPublishAfterPackageImport(
 
     private bool CanAutoPublish(string trigger)
     {
-        if (runtimeState.Level is not RuntimeLevel.Run)
+        logger.LogInformation(
+            "Articulate CanAutoPublish check for {Trigger}: RuntimeLevel={RuntimeLevel}, AutoPublishOnStartup={AutoPublishOnStartup}",
+            trigger,
+            runtimeState.Level,
+            options.Value.AutoPublishOnStartup);
+
+        if (runtimeState.Level is RuntimeLevel.Boot or RuntimeLevel.BootFailed or RuntimeLevel.Unknown)
         {
             logger.LogInformation(
-                "Umbraco is not in Run level, skipping Articulate post-migration tasks ({Trigger}).",
+                "Umbraco runtime is not ready (level={RuntimeLevel}), skipping Articulate post-migration tasks ({Trigger}).",
+                runtimeState.Level,
                 trigger);
             return false;
         }
@@ -123,6 +130,11 @@ private bool CanAutoPublish(string trigger)
             return false;
         }
 
+        logger.LogInformation(
+            "Articulate post-migration tasks will proceed for {Trigger} (RuntimeLevel={RuntimeLevel}).",
+            trigger,
+            runtimeState.Level);
+
         return true;
     }
 
diff --git a/src/Articulate/Models/MasterModel.cs b/src/Articulate/Models/MasterModel.cs
index 7c29479a3..32a1d886f 100644
--- a/src/Articulate/Models/MasterModel.cs
+++ b/src/Articulate/Models/MasterModel.cs
@@ -13,9 +13,14 @@ public class MasterModel : PublishedContentWrapped, IMasterModel
         /// <summary>
         /// The basic model for all articulate objects
         /// </summary>
-        public MasterModel(IPublishedContent content, IPublishedValueFallback publishedValueFallback) : base(
-            content,
-            publishedValueFallback) => PublishedValueFallback = publishedValueFallback;
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+        public MasterModel(IPublishedContent content, IPublishedValueFallback publishedValueFallback) : base(content)
+            => PublishedValueFallback = publishedValueFallback;
+#else
+        public MasterModel(IPublishedContent content, IPublishedValueFallback publishedValueFallback)
+            : base(content, publishedValueFallback)
+            => PublishedValueFallback = publishedValueFallback;
+#endif
 
         /// <summary>
         /// Returns the current theme
diff --git a/src/Articulate/Models/PublishedContentExtensions.cs b/src/Articulate/Models/PublishedContentExtensions.cs
index 095e1532d..0b5a8eb47 100644
--- a/src/Articulate/Models/PublishedContentExtensions.cs
+++ b/src/Articulate/Models/PublishedContentExtensions.cs
@@ -779,9 +779,9 @@ public static IPublishedContent[] GetListNodes(IMasterModel masterModel)
                 throw new ArgumentNullException(nameof(masterModel));
             }
 
-                IPublishedContent[] listNodes = masterModel.RootBlogNode
-                    .ChildrenOfType(ArticulateConstants.ContentType
-                        .ArticulateArchive).ToArray();
+            IPublishedContent[] listNodes = masterModel.RootBlogNode
+                .ChildrenOfType(ArticulateConstants.ContentType
+                    .ArticulateArchive).ToArray();
 
             if (listNodes.Length == 0)
             {
diff --git a/src/Articulate/Options/ArticulateSwaggerOptions.cs b/src/Articulate/Options/ArticulateSwaggerOptions.cs
index 49ab48773..43e88f1e5 100644
--- a/src/Articulate/Options/ArticulateSwaggerOptions.cs
+++ b/src/Articulate/Options/ArticulateSwaggerOptions.cs
@@ -1,11 +1,16 @@
 #nullable enable
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
 using System.Reflection;
-using Articulate.Swagger;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
 using Swashbuckle.AspNetCore.SwaggerGen;
-#if NET10_0_OR_GREATER
+#endif
+using Articulate.Swagger;
+using Microsoft.Extensions.Options;
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.OpenApi;
+#elif NET10_0_OR_GREATER
 using Microsoft.OpenApi;
 #else
 using Microsoft.OpenApi.Models;
@@ -13,16 +18,14 @@
 
 namespace Articulate.Options
 {
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
     /// <summary>
-    /// Configures SwaggerGen options for the Articulate API, including documentation, tags, and XML comments.
+    /// Configures Articulate management API OpenAPI generation across supported Umbraco versions.
     /// </summary>
     public class ArticulateSwaggerOptions(ILogger<ArticulateSwaggerOptions> logger)
         : IConfigureOptions<SwaggerGenOptions>
     {
-        /// <summary>
-        /// Configures SwaggerGen options for the Articulate API.
-        /// </summary>
-        /// <param name="options">The SwaggerGen options to configure.</param>
+        /// <inheritdoc/>
         public void Configure(SwaggerGenOptions options)
         {
             var year = DateTime.Now.Year.ToString();
@@ -68,4 +71,44 @@ public void Configure(SwaggerGenOptions options)
             options.OperationFilter<ArticulateOperationSecurityFilter>();
         }
     }
+#else
+    /// <summary>
+    /// Configures named <see cref="OpenApiOptions"/> for the Articulate management API document in Umbraco 18+.
+    /// </summary>
+    public class ArticulateSwaggerOptions
+        : IConfigureNamedOptions<OpenApiOptions>
+    {
+        /// <summary>
+        /// Configures the named Articulate OpenAPI document by registering operation/document transformers.
+        /// </summary>
+        /// <param name="name">The OpenAPI document name.</param>
+        /// <param name="options">The OpenAPI options for the named document.</param>
+        public void Configure(string? name, OpenApiOptions options)
+        {
+            if (!string.Equals(name, ArticulateConstants.ManagementApi.Name, StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            options.AddOperationTransformer<ArticulateOperationIdHandler>();
+            options.AddOperationTransformer<ArticulateOperationSecurityFilter>();
+            options.AddDocumentTransformer<ArticulateOperationSecurityFilter>();
+            options.AddDocumentTransformer((document, _, _) =>
+            {
+                document.Info.Version = "Latest";
+                document.Info.Title = "Articulate Management API";
+                document.Info.Description = "API for the back office dashboard section Articulate, a wonderful Blog engine built on Umbraco. ";
+                return Task.CompletedTask;
+            });
+        }
+
+        /// <summary>
+        /// Required interface member for unnamed options; intentionally unused because Articulate config is named.
+        /// </summary>
+        /// <param name="options">The unnamed OpenAPI options instance.</param>
+        public void Configure(OpenApiOptions options)
+        {
+        }
+    }
+#endif
 }
diff --git a/src/Articulate/Routing/ArticulateRouteValidator.cs b/src/Articulate/Routing/ArticulateRouteValidator.cs
index 3f459a8c8..46fb976c3 100644
--- a/src/Articulate/Routing/ArticulateRouteValidator.cs
+++ b/src/Articulate/Routing/ArticulateRouteValidator.cs
@@ -33,13 +33,14 @@ internal static List<Domain> DomainsForContent(IContent content, IReadOnlyList<D
             return [.. domains.Where(domain => nodePaths.Contains(domain.ContentId))];
         }
 
-        internal static void ValidateConfiguredRouteSegments(IPublishedContent articulateRootNode)
+        internal static void ValidateConfiguredRouteSegments(
+            IPublishedContent articulateRootNode,
+            IEnumerable<IPublishedContent>? children = null)
         {
             var configuredSegments = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
 
-#pragma warning disable CS0618 // IPublishedContent.Children used here to avoid navigation-service requirements during validation.
-            foreach (IPublishedContent child in articulateRootNode.Children)
-#pragma warning restore CS0618
+            IEnumerable<IPublishedContent> configuredChildren = children ?? articulateRootNode.Children();
+            foreach (IPublishedContent child in configuredChildren)
             {
                 string? childRouteSegment = ArticulateRouteSegmentHelper.NormalizeOrNull(child.UrlSegment);
                 if (childRouteSegment is not null)
diff --git a/src/Articulate/Routing/DateFormattedPostContentFinder.cs b/src/Articulate/Routing/DateFormattedPostContentFinder.cs
index c30e9e829..f2992cf33 100644
--- a/src/Articulate/Routing/DateFormattedPostContentFinder.cs
+++ b/src/Articulate/Routing/DateFormattedPostContentFinder.cs
@@ -14,7 +14,11 @@ namespace Articulate.Routing
     /// <summary>
     /// Content finder that handles date-formatted URLs for Articulate blog posts (e.g., /YYYY/MM/DD/post-name/).
     /// </summary>
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+    public class DateFormattedPostContentFinder : ContentFinderByUrl
+#else
     public class DateFormattedPostContentFinder : ContentFinderByUrlNew
+#endif
     {
         private readonly IDocumentUrlService _documentUrlService;
         private readonly IPublishedContentCache _publishedContentCache;
@@ -23,12 +27,20 @@ public class DateFormattedPostContentFinder : ContentFinderByUrlNew
         /// Initializes a new instance of the <see cref="DateFormattedPostContentFinder"/> class.
         /// </summary>
         public DateFormattedPostContentFinder(
-            ILogger<DateFormattedPostContentFinder> logger,
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+            ILogger<ContentFinderByUrl> logger,
+#else
+            ILogger<ContentFinderByUrlNew> logger,
+#endif
             IUmbracoContextAccessor umbracoContextAccessor,
             IDocumentUrlService documentUrlService,
             IPublishedContentCache publishedContentCache,
             IOptionsMonitor<WebRoutingSettings> webRoutingSettings)
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
             : base(logger, umbracoContextAccessor, documentUrlService, publishedContentCache, webRoutingSettings)
+#else
+            : base(logger, umbracoContextAccessor, documentUrlService, publishedContentCache, webRoutingSettings)
+#endif
         {
             _documentUrlService = documentUrlService;
             _publishedContentCache = publishedContentCache;
diff --git a/src/Articulate/Routing/DateFormattedUrlProvider.cs b/src/Articulate/Routing/DateFormattedUrlProvider.cs
index c319e41e5..16c9cc47c 100644
--- a/src/Articulate/Routing/DateFormattedUrlProvider.cs
+++ b/src/Articulate/Routing/DateFormattedUrlProvider.cs
@@ -14,15 +14,19 @@ namespace Articulate.Routing
     /// <summary>
     /// Provides date-formatted URLs for Articulate blog posts (e.g., /YYYY/MM/DD/post-name/).
     /// </summary>
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
+    public class DateFormattedUrlProvider : DefaultUrlProvider
+#else
     public class DateFormattedUrlProvider : NewDefaultUrlProvider
+#endif
     {
-#if NET10_0_OR_GREATER
+#if NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER
         /// <summary>
         /// Initializes a new instance of the <see cref="DateFormattedUrlProvider"/> class for NET10 (Umbraco 17+).
         /// </summary>
         public DateFormattedUrlProvider(
             IOptionsMonitor<RequestHandlerSettings> requestSettings,
-            ILogger<DateFormattedUrlProvider> logger,
+            ILogger<DefaultUrlProvider> logger,
             ISiteDomainMapper siteDomainMapper,
             IUmbracoContextAccessor umbracoContextAccessor,
             UriUtility uriUtility,
@@ -54,13 +58,19 @@ public DateFormattedUrlProvider(
         /// </summary>
         public DateFormattedUrlProvider(
             IOptionsMonitor<RequestHandlerSettings> requestSettings,
+#if NET9_0
             ILogger<DefaultUrlProvider> logger,
+#else
+            ILogger<NewDefaultUrlProvider> logger,
+#endif
             ISiteDomainMapper siteDomainMapper,
             IUmbracoContextAccessor umbracoContextAccessor,
             UriUtility uriUtility,
+#if NET9_0
 #pragma warning disable CS0618 // Type or member is obsolete
             ILocalizationService localizationService,
 #pragma warning restore CS0618 // Type or member is obsolete
+#endif
             IPublishedContentCache publishedContentCache,
             IDomainCache domainCache,
             IIdKeyMap idKeyMap,
@@ -74,7 +84,9 @@ public DateFormattedUrlProvider(
                 siteDomainMapper,
                 umbracoContextAccessor,
                 uriUtility,
+#if NET9_0
                 localizationService,
+#endif
                 publishedContentCache,
                 domainCache,
                 idKeyMap,
diff --git a/src/Articulate/SecurityExtensions.cs b/src/Articulate/SecurityExtensions.cs
index 7bc1e82fb..44be0f94d 100644
--- a/src/Articulate/SecurityExtensions.cs
+++ b/src/Articulate/SecurityExtensions.cs
@@ -1,4 +1,6 @@
 #nullable enable
+using Microsoft.AspNetCore.Html;
+
 namespace Articulate
 {
     /// <summary>
@@ -75,16 +77,46 @@ public static class SecurityExtensions
                 return null;
             }
 
+            // Normalize/encode the URL portion first so spaces and other URI characters are safe for HTTP requests.
+            string normalized;
+            try
+            {
+                if (uri.IsAbsoluteUri)
+                {
+                    // Escape as a URI string for absolute URIs (preserves path separators)
+                    normalized = Uri.EscapeUriString(url);
+                }
+                else
+                {
+                    // For relative URLs, percent-encode literal spaces which commonly break requests
+                    normalized = url.Replace(" ", "%20");
+                }
+            }
+            catch
+            {
+                normalized = url.Replace(" ", "%20");
+            }
+
             // Escape characters that could break out of CSS context
-            return url
+            return normalized
                 .Replace("\\", "\\\\")
                 .Replace("'", "\\'")
                 .Replace("\"", "\\\"")
                 .Replace("\n", "\\n")
                 .Replace("\r", "\\r")
                 .Replace("\0", string.Empty)
-                .Replace("(", "\\(")
+                                .Replace("(", "\\(")
                 .Replace(")", "\\)");
         }
+
+        /// <summary>
+        /// CSS-escapes a URL and returns <see cref="IHtmlContent"/> so Razor does not double-encode the ampersands
+        /// when rendering in a &lt;style&gt; block or inline style attribute.
+        /// </summary>
+        public static IHtmlContent ToCssStyleUrl(this string? url)
+        {
+            var safe = url.ToSafeCssUrl();
+            return safe is not null ? new HtmlString(safe) : HtmlString.Empty;
+        }
     }
 }
diff --git a/src/Articulate/Swagger/ArticulateOperationIdHandler.cs b/src/Articulate/Swagger/ArticulateOperationIdHandler.cs
index 6559b8860..dfb214272 100644
--- a/src/Articulate/Swagger/ArticulateOperationIdHandler.cs
+++ b/src/Articulate/Swagger/ArticulateOperationIdHandler.cs
@@ -1,6 +1,7 @@
 #nullable enable
-using Articulate.Controllers.Api;
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
 using Asp.Versioning;
+using Articulate.Controllers.Api;
 using Microsoft.AspNetCore.Mvc.ApiExplorer;
 using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.Extensions.Options;
@@ -9,9 +10,9 @@
 namespace Articulate.Swagger
 {
     /// <summary>
-    /// Handles the generation of operation IDs for Articulate API endpoints in Swagger.
+    /// Handles the generation of operation IDs for Articulate API endpoints.
     /// </summary>
-#pragma warning disable CS9107 // Parameter captured and passed to base - intentional, base class doesn't expose options
+#pragma warning disable CS9107
     internal class ArticulateOperationIdHandler(IOptions<ApiVersioningOptions> apiVersioningOptions)
         : OperationIdHandler(apiVersioningOptions)
 #pragma warning restore CS9107
@@ -19,7 +20,6 @@ internal class ArticulateOperationIdHandler(IOptions<ApiVersioningOptions> apiVe
         /// <inheritdoc/>
         public override string Handle(ApiDescription apiDescription) => ArticulateOperationId(apiDescription);
 
-        // Adapted from Umbraco.Cms.Api.Common.OpenApi.OperationIdHandler
         /// <inheritdoc/>
         protected override bool CanHandle(
             ApiDescription apiDescription,
@@ -27,10 +27,14 @@ protected override bool CanHandle(
         {
             Type type = typeof(BlogMlApiController);
             var namespaceName = type.Namespace ?? "Articulate.Api.Management.Controllers";
+            var controllerNamespace = controllerActionDescriptor.ControllerTypeInfo.Namespace;
 
-            return controllerActionDescriptor.ControllerTypeInfo.Namespace?.StartsWith(
-                namespaceName,
-                StringComparison.InvariantCultureIgnoreCase) is true;
+            return controllerNamespace?.StartsWith(
+                       namespaceName,
+                       StringComparison.InvariantCultureIgnoreCase) is true
+                   || controllerNamespace?.StartsWith(
+                       "Articulate.Api.Management.Controllers",
+                       StringComparison.InvariantCultureIgnoreCase) is true;
         }
 
         private string ArticulateOperationId(ApiDescription apiDescription)
@@ -50,36 +54,123 @@ private string ArticulateOperationId(ApiDescription apiDescription)
                     $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
             }
 
-            // Remove the prefixed base path with version, e.g. /umbraco/articulate/api/v1/tracked-reference/{id} => tracked-reference/{id}
             var unprefixedRelativePath = ArticulateOperationIdRegexes
                 .VersionPrefixRegex()
                 .Replace(relativePath, string.Empty);
 
-            // Remove template placeholders, e.g. tracked-reference/{id} => tracked-reference/ID
             var formattedOperationId = ArticulateOperationIdRegexes
                 .TemplatePlaceholdersRegex()
                 .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
 
-            // Remove dashes (-) and slashes (/) and convert the following letter to uppercase with
-            // the word "By" in front, e.g. tracked-reference-id => trackedReferenceById
             formattedOperationId = ArticulateOperationIdRegexes
                 .ToCamelCaseRegex()
                 .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
 
-            // Get map to version attribute
             var version = string.Empty;
-
             var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
 
-            // We only want to add a version, if it is not the default one.
             if (!string.IsNullOrEmpty(versionAttributeValue) &&
-                !string.Equals(versionAttributeValue, defaultVersion.ToString()))
+                !string.Equals(versionAttributeValue, defaultVersion.ToString(), StringComparison.Ordinal))
+            {
+                version = versionAttributeValue;
+            }
+
+            return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
+        }
+    }
+}
+#else
+using Asp.Versioning;
+using Microsoft.AspNetCore.Mvc.ApiExplorer;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi;
+
+namespace Articulate.Swagger
+{
+    /// <summary>
+    /// Transforms OpenAPI operation IDs for Articulate API endpoints in Umbraco 18+.
+    /// </summary>
+    internal class ArticulateOperationIdHandler : IOpenApiOperationTransformer
+    {
+        /// <inheritdoc/>
+        public Task TransformAsync(
+            OpenApiOperation operation,
+            OpenApiOperationTransformerContext context,
+            CancellationToken cancellationToken)
+        {
+            var operationId = GenerateOperationId(context);
+            if (operationId is not null)
+            {
+                operation.OperationId = operationId;
+            }
+
+            return Task.CompletedTask;
+        }
+
+        private static string? GenerateOperationId(OpenApiOperationTransformerContext context)
+        {
+            ApiDescription apiDescription = context.Description;
+            if (apiDescription.ActionDescriptor is not ControllerActionDescriptor controllerActionDescriptor)
+            {
+                return null;
+            }
+
+            Type type = typeof(Controllers.Api.BlogMlApiController);
+            var namespaceName = type.Namespace ?? "Articulate.Api.Management.Controllers";
+            var controllerNamespace = controllerActionDescriptor.ControllerTypeInfo.Namespace;
+
+            var shouldHandle = controllerNamespace?.StartsWith(namespaceName, StringComparison.InvariantCultureIgnoreCase) is true
+                               || controllerNamespace?.StartsWith("Articulate.Api.Management.Controllers", StringComparison.InvariantCultureIgnoreCase) is true;
+
+            if (!shouldHandle)
+            {
+                return null;
+            }
+
+            ApiVersion defaultVersion = context.ApplicationServices.GetRequiredService<IOptions<ApiVersioningOptions>>().Value.DefaultApiVersion;
+            var httpMethod = apiDescription.HttpMethod?.ToLower().ToFirstUpper() ?? "Get";
+
+            if (string.IsNullOrWhiteSpace(apiDescription.ActionDescriptor.AttributeRouteInfo?.Name) == false)
+            {
+                var explicitOperationId = apiDescription.ActionDescriptor.AttributeRouteInfo!.Name;
+                return explicitOperationId.InvariantStartsWith(httpMethod)
+                    ? explicitOperationId
+                    : $"{httpMethod}{explicitOperationId}";
+            }
+
+            var relativePath = apiDescription.RelativePath;
+
+            if (string.IsNullOrWhiteSpace(relativePath))
+            {
+                throw new InvalidOperationException(
+                    $"There is no relative path for controller action {apiDescription.ActionDescriptor.RouteValues["controller"]}");
+            }
+
+            var unprefixedRelativePath = ArticulateOperationIdRegexes
+                .VersionPrefixRegex()
+                .Replace(relativePath, string.Empty);
+
+            var formattedOperationId = ArticulateOperationIdRegexes
+                .TemplatePlaceholdersRegex()
+                .Replace(unprefixedRelativePath, m => $"By{m.Groups[1].Value.ToFirstUpper()}");
+
+            formattedOperationId = ArticulateOperationIdRegexes
+                .ToCamelCaseRegex()
+                .Replace(formattedOperationId, m => m.Groups[1].Value.ToUpper());
+
+            string? version = null;
+            var versionAttributeValue = controllerActionDescriptor.MethodInfo.GetMapToApiVersionAttributeValue();
+
+            if (string.Equals(versionAttributeValue, defaultVersion.ToString(), StringComparison.Ordinal) == false)
             {
                 version = versionAttributeValue;
             }
 
-            // Return the operation ID with the formatted http method verb in front, e.g. GetTrackedReferenceById
             return $"{httpMethod}{formattedOperationId.ToFirstUpper()}{version}";
         }
     }
 }
+#endif
diff --git a/src/Articulate/Swagger/ArticulateOperationSecurityFilter.cs b/src/Articulate/Swagger/ArticulateOperationSecurityFilter.cs
index 904ae6035..6e9309020 100644
--- a/src/Articulate/Swagger/ArticulateOperationSecurityFilter.cs
+++ b/src/Articulate/Swagger/ArticulateOperationSecurityFilter.cs
@@ -1,10 +1,11 @@
 #nullable enable
+#if !(NET10_0_OR_GREATER && UMBRACO_18_OR_GREATER)
 using Umbraco.Cms.Api.Management.OpenApi;
 
 namespace Articulate.Swagger
 {
     /// <summary>
-    /// Adds security requirements to Articulate API operations for Swagger documentation.
+    /// Adds backoffice security requirements to Articulate API operations.
     /// </summary>
     internal class ArticulateOperationSecurityFilter : BackOfficeSecurityRequirementsOperationFilterBase
     {
@@ -14,3 +15,110 @@ internal class ArticulateOperationSecurityFilter : BackOfficeSecurityRequirement
         protected override string ApiName => ArticulateConstants.ManagementApi.Name;
     }
 }
+#else
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.OpenApi;
+using Umbraco.Cms.Api.Common.Security;
+
+namespace Articulate.Swagger
+{
+    /// <summary>
+    /// Adds backoffice security requirements for Articulate API operations in Umbraco 18+ OpenAPI.
+    /// </summary>
+    internal class ArticulateOperationSecurityFilter : IOpenApiOperationTransformer, IOpenApiDocumentTransformer
+    {
+        private const int BaseAuthorizeAttributeCount = 2;
+        private const string BackOfficeUserSecurityName = "Backoffice-User";
+
+        /// <inheritdoc />
+        public Task TransformAsync(
+            OpenApiOperation operation,
+            OpenApiOperationTransformerContext context,
+            CancellationToken cancellationToken)
+        {
+            if (context.Description.ActionDescriptor is not ControllerActionDescriptor description)
+            {
+                return Task.CompletedTask;
+            }
+
+            if (description.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ||
+                description.MethodInfo.DeclaringType?.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) == true)
+            {
+                operation.Security = [];
+                return Task.CompletedTask;
+            }
+
+            operation.Responses ??= new OpenApiResponses();
+            operation.Responses[StatusCodes.Status401Unauthorized.ToString()] = new OpenApiResponse
+            {
+                Description = "The resource is protected and requires an authentication token"
+            };
+
+            var schemaRef = new OpenApiSecuritySchemeReference(BackOfficeUserSecurityName, context.Document);
+            operation.Security ??= new List<OpenApiSecurityRequirement>();
+            operation.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+
+            var numberOfAuthorizeAttributes =
+                description.MethodInfo.GetCustomAttributes(true).Count(x => x is AuthorizeAttribute)
+                + description.MethodInfo.DeclaringType?.GetCustomAttributes(true).Count(x => x is AuthorizeAttribute);
+
+            if (numberOfAuthorizeAttributes > BaseAuthorizeAttributeCount || InjectsAuthorizationService(description.MethodInfo.DeclaringType))
+            {
+                operation.Responses[StatusCodes.Status403Forbidden.ToString()] = new OpenApiResponse
+                {
+                    Description = "The authenticated user does not have access to this resource"
+                };
+            }
+
+            return Task.CompletedTask;
+        }
+
+        /// <inheritdoc />
+        public Task TransformAsync(
+            OpenApiDocument document,
+            OpenApiDocumentTransformerContext context,
+            CancellationToken cancellationToken)
+        {
+            var apiKeyScheme = new OpenApiSecurityScheme
+            {
+                Type = SecuritySchemeType.OAuth2,
+                Name = "Umbraco",
+                In = ParameterLocation.Header,
+                Description = "Umbraco Authentication",
+                Flows = new OpenApiOAuthFlows
+                {
+                    AuthorizationCode = new OpenApiOAuthFlow
+                    {
+                        AuthorizationUrl = new System.Uri(Paths.BackOfficeApi.AuthorizationEndpoint, UriKind.Relative),
+                        TokenUrl = new System.Uri(Paths.BackOfficeApi.TokenEndpoint, UriKind.Relative),
+                    },
+                },
+            };
+
+            document.Components ??= new OpenApiComponents();
+            document.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
+            document.Components.SecuritySchemes[BackOfficeUserSecurityName] = apiKeyScheme;
+
+            var schemaRef = new OpenApiSecuritySchemeReference(BackOfficeUserSecurityName, document);
+            document.Security ??= new List<OpenApiSecurityRequirement>();
+            document.Security.Add(new OpenApiSecurityRequirement { [schemaRef] = [] });
+            return Task.CompletedTask;
+        }
+
+        private static bool InjectsAuthorizationService(Type? type)
+        {
+            if (type is null)
+            {
+                return false;
+            }
+
+            return type.GetConstructors()
+                .Any(ctor => ctor.GetParameters()
+                    .Any(parameter => parameter.ParameterType == typeof(IAuthorizationService)));
+        }
+    }
+}
+#endif