diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
new file mode 100644
index 00000000..cde1a6eb
--- /dev/null
+++ b/.github/workflows/build-iso.yml
@@ -0,0 +1,190 @@
+name: Build ProXam Exam ISO
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      iso_variant:
+        description: 'ISO variant to build'
+        required: true
+        default: 'proxam-exam'
+        type: choice
+        options:
+          - proxam-exam
+          - moodle-rdp
+      debug:
+        description: 'Enable debug output'
+        required: false
+        default: 'false'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Free up disk space
+        # GitHub Actions runners come with ~14 GB total but only ~3–4 GB free after
+        # preinstalled software. The ISO build needs ~10+ GB. We remove toolchains
+        # and SDKs we don't need to reclaim ~25 GB of space.
+        run: |
+          echo "==> Disk space before cleanup:"
+          df -h /
+          sudo rm -rf \
+            /usr/share/dotnet \
+            /usr/local/lib/android \
+            /opt/ghc \
+            /opt/hostedtoolcache \
+            /usr/local/share/powershell \
+            /usr/share/swift \
+            /usr/local/.ghcup \
+            /usr/lib/jvm \
+            /usr/local/graalvm \
+            /usr/local/share/chromium \
+            /usr/local/share/edge_driver \
+            /usr/local/share/gecko_driver \
+            /usr/local/share/vcpkg \
+            /usr/share/miniconda \
+            /usr/local/aws-cli \
+            /usr/local/aws-sam-cli \
+            /opt/az \
+            "$AGENT_TOOLSDIRECTORY" || true
+          sudo apt-get clean
+          docker image prune -af || true
+          echo "==> Disk space after cleanup:"
+          df -h /
+
+      - name: Checkout proxam-lernstick
+        uses: actions/checkout@v4
+
+      - name: Checkout proxam-exam-client
+        uses: actions/checkout@v4
+        with:
+          repository: Wojtasik-Lang-Consulting/proxam-exam-client
+          path: proxam-exam-client-src
+
+      - name: Create constants file
+        run: |
+          cat > constants <<'EOF'
+          BUILD_DIR=""
+          TMPFS=""
+          TMPFS_IMAGE=""
+          TMPFS_IMAGE_SIZE=0
+          TMPFS_IMAGE_MOUNT=""
+          MIRROR_BUILD="http://deb.debian.org/debian"
+          MIRROR_SYSTEM="http://deb.debian.org/debian"
+          MIRROR_SECURITY_SYSTEM="http://security.debian.org/"
+          SOURCE="false"
+          EOF
+
+      - name: Build proxam-exam-client .deb and place in packages.chroot
+        # Build the .deb from source inside a Trixie container so the package
+        # is available to live-build via config/packages.chroot/ — no GitHub
+        # Release required and no network access needed inside the chroot.
+        run: |
+          mkdir -p config/packages.chroot
+          docker run --rm \
+            -v "${{ github.workspace }}/proxam-exam-client-src:/src" \
+            -v "${{ github.workspace }}/config/packages.chroot:/out" \
+            debian:trixie \
+            bash -c "
+              set -e
+              apt-get update -qq
+              apt-get install -y --no-install-recommends \
+                build-essential \
+                devscripts \
+                debhelper \
+                config-package-dev \
+                gettext \
+                fakeroot \
+                dpkg-dev
+              cp -r /src /build
+              cd /build
+              dpkg-buildpackage -us -uc -b
+              cp /proxam-exam-client_*.deb /out/
+              ls -la /out/
+            "
+
+      - name: Select ISO variant
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            ISO_VARIANT="${{ github.event.inputs.iso_variant }}"
+          else
+            ISO_VARIANT="proxam-exam"
+          fi
+
+          case "${ISO_VARIANT}" in
+            proxam-exam)
+              echo "ISO_VARIANT=${ISO_VARIANT}" >> "$GITHUB_ENV"
+              echo "ISO_BUILD_SCRIPT=build_proxam_exam_iso.sh" >> "$GITHUB_ENV"
+              echo "ISO_ARTIFACT_NAME=proxam-exam-iso" >> "$GITHUB_ENV"
+              echo "ISO_FILE_GLOB=proxam-exam_debian13_proxam_exam_*" >> "$GITHUB_ENV"
+              ;;
+            moodle-rdp)
+              echo "ISO_VARIANT=${ISO_VARIANT}" >> "$GITHUB_ENV"
+              echo "ISO_BUILD_SCRIPT=build_proxam_moodle_rdp_iso.sh" >> "$GITHUB_ENV"
+              echo "ISO_ARTIFACT_NAME=proxam-moodle-rdp-iso" >> "$GITHUB_ENV"
+              echo "ISO_FILE_GLOB=lernstick_debian13_moodle_rdp_*" >> "$GITHUB_ENV"
+              ;;
+            *)
+              echo "Unsupported ISO variant: ${ISO_VARIANT}" >&2
+              exit 1
+              ;;
+          esac
+
+      - name: Build ISO (privileged Debian container)
+        # live-build uses systemd-nspawn to run chroot hooks.
+        # systemd-nspawn requires kernel namespaces → must run in a
+        # --privileged container so it has full access to host kernel features.
+        # Using docker run directly (instead of GitHub Actions container: block)
+        # lets us pass --privileged and --cgroupns=host which the container: block omits.
+        run: |
+          docker run --privileged --cgroupns=host \
+            -v "${{ github.workspace }}:/build" \
+            -w /build \
+            debian:trixie \
+            bash -c "
+              set -e
+              apt-get update -qq
+              apt-get install -y --no-install-recommends \
+                live-build \
+                systemd-container \
+                rsync \
+                zsync \
+                gfxboot \
+                libhtml-parser-perl \
+                wget \
+                ca-certificates \
+                git \
+                debootstrap \
+                squashfs-tools \
+                xorriso \
+                isolinux \
+                syslinux \
+                syslinux-common \
+                grub-efi-amd64-bin \
+                grub-pc-bin \
+                mtools \
+                dosfstools
+              chmod +x "${ISO_BUILD_SCRIPT}"
+              ./${ISO_BUILD_SCRIPT}
+            "
+
+      - name: Upload ISO artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.ISO_ARTIFACT_NAME }}
+          path: |
+            ${{ env.ISO_FILE_GLOB }}.iso
+            ${{ env.ISO_FILE_GLOB }}.md5
+          retention-days: 14
+
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ${{ env.ISO_FILE_GLOB }}.iso
+            ${{ env.ISO_FILE_GLOB }}.md5
+          generate_release_notes: true
diff --git a/README.md b/README.md
index eb409ed8..09dd0a42 100644
--- a/README.md
+++ b/README.md
@@ -8,3 +8,22 @@ packages needed on a Debian system to run this script:
 * live-build
 * rsync
 * zsync
+
+## Additional ISO variants
+
+### Minimal Moodle + RDP ISO
+
+Use `./build_proxam_moodle_rdp_iso.sh` to create a stripped-down GNOME-based image
+for Moodle exams and Windows Remote Desktop access.
+
+This build profile:
+- keeps only the shared core package lists required to boot the Lernstick image
+- removes the default desktop, education and flatpak package sets
+- skips the ProXam exam-client installation hook
+- adds Firefox ESR, Remmina and a small launcher that opens Moodle in kiosk mode
+	or starts the RDP client
+
+Before distributing the image, adjust the generated config file inside the image:
+- `/etc/proxam-moodle-rdp.conf`
+- set `MOODLE_URL` to your Moodle course or quiz URL
+- optionally set `REMMINA_PROFILE` to a pre-provisioned `.remmina` profile path
diff --git a/backports.txt b/backports.txt
index 9ae154f3..859fc039 100644
--- a/backports.txt
+++ b/backports.txt
@@ -1,10 +1,10 @@
-# bookworm (64 Bit)
-sudo pbuilder --login --basetgz /var/cache/pbuilder/base-bookworm-bpo.tar.gz --bindmounts /home/debian12/lernstick/backports/bookworm
+# trixie (64 Bit)
+sudo pbuilder --login --basetgz /var/cache/pbuilder/base-trixie-bpo.tar.gz --bindmounts /home/debian13/lernstick/backports/trixie
 
-# bookworm (32 Bit)
-sudo pbuilder --login --architecture i386 --basetgz /var/cache/pbuilder/base-bookworm32-bpo.tar.gz --bindmounts /home/debian12/lernstick/backports/bookworm
+# trixie (32 Bit)
+sudo pbuilder --login --architecture i386 --basetgz /var/cache/pbuilder/base-trixie32-bpo.tar.gz --bindmounts /home/debian13/lernstick/backports/trixie
 
-# bookworm
+# trixie
 apt update; apt --yes upgrade; apt --yes install devscripts fakeroot pbuilder sudo; /usr/lib/pbuilder/pbuilder-satisfydepends --continue-fail
 
 
diff --git a/build_binary_release.sh b/build_binary_release.sh
index bde7a86d..a5c675a9 100755
--- a/build_binary_release.sh
+++ b/build_binary_release.sh
@@ -7,19 +7,19 @@ fi
 clear
 
 # build edu version
-git checkout debian12
+git checkout debian13
 ./build_tmpfs.sh
 ./build_edu-mini_iso.sh
 ./build_tmpfs.sh
 ./build_edu_iso.sh
 
 # build exam version
-git checkout exam-debian12
+git checkout exam-debian13
 ./build_tmpfs.sh
 ./build_exam_iso.sh
 
 # checkout main repo
-git checkout debian12
+git checkout debian13
 
 # final shutdown?
 if [ -n "$SHUTDOWN_AFTER_BUILDING" ]
diff --git a/build_proxam_exam_iso.sh b/build_proxam_exam_iso.sh
new file mode 100755
index 00000000..585cb596
--- /dev/null
+++ b/build_proxam_exam_iso.sh
@@ -0,0 +1,77 @@
+#!/bin/bash
+# ProXam Exam ISO Build Script
+# Builds a Lernstick-based exam ISO with the proxam-exam-client pre-installed.
+#
+# Usage:
+#   ./build_proxam_exam_iso.sh
+#
+# Requirements:
+#   - Debian 13 (Trixie) host or container
+#   - live-build, rsync, zsync, gfxboot, libhtml-parser-perl installed
+#   - constants file present (copy from constants.example and adapt)
+
+set -e
+
+. ./functions.sh
+check_and_source_constants
+
+init_build
+
+ISO_SUFFIX="_proxam_exam"
+SOURCE="false"
+
+echo "==> Building ProXam Exam ISO (suffix: ${ISO_SUFFIX})"
+echo "==> Build started: $(date)"
+
+# Override distribution to trixie for debian13 branch
+build_image_proxam()
+{
+    TODAY=$(date +%Y-%m-%d)
+
+    rm -f config/binary config/bootstrap config/build config/chroot config/common config/source
+    lb clean
+
+    lb config \
+        --apt-indices false \
+        --apt-recommends true \
+        --architectures amd64 \
+        --archive-areas "main contrib non-free non-free-firmware" \
+        --bootloaders "syslinux,grub-efi" \
+        --chroot-squashfs-compression-level 22 \
+        --chroot-squashfs-compression-type zstd \
+        --debootstrap-options "--include=ca-certificates,openssl" \
+        --distribution trixie \
+        --firmware-chroot false \
+        --iso-volume "proxam-exam ${TODAY}" \
+        --mirror-binary "${MIRROR_SYSTEM}" \
+        --mirror-binary-security "${MIRROR_SECURITY_SYSTEM}" \
+        --mirror-bootstrap "${MIRROR_BUILD}" \
+        --security true \
+        --source false \
+        --updates true \
+        --verbose
+
+    lb build 2>&1 | tee logfile.txt
+
+    ISO_FILE="live-image-amd64.hybrid.iso"
+    if [ -f "${ISO_FILE}" ]; then
+        PREFIX="proxam-exam_debian13${ISO_SUFFIX}_${TODAY}"
+        IMAGE="${PREFIX}.iso"
+        mv "${ISO_FILE}" "${IMAGE}"
+        rm -f ./*.zsync
+        zsyncmake -C "${IMAGE}" -u "${IMAGE}"
+        md5sum "${IMAGE}" > "${IMAGE}.md5"
+
+        if [ -d "${BUILD_DIR}" ]; then
+            mv "${PREFIX}"* "${BUILD_DIR}"
+            mv logfile.txt "${BUILD_DIR}"
+        fi
+
+        echo "==> ISO built successfully: ${IMAGE}"
+    else
+        echo "ERROR: ISO was not built. Check logfile.txt for details." | tee -a logfile.txt
+        exit 1
+    fi
+}
+
+build_image_proxam
diff --git a/build_proxam_moodle_rdp_iso.sh b/build_proxam_moodle_rdp_iso.sh
new file mode 100644
index 00000000..4bbfe703
--- /dev/null
+++ b/build_proxam_moodle_rdp_iso.sh
@@ -0,0 +1,150 @@
+#!/bin/bash
+
+set -e
+
+ISO_SUFFIX="_moodle_rdp"
+SOURCE="false"
+
+. ./functions.sh
+check_and_source_constants
+
+if [ -d "${TMPFS_IMAGE_MOUNT}" ]
+then
+	cd "${TMPFS_IMAGE_MOUNT}"
+elif [ -n "${TMPFS_IMAGE_MOUNT}" ]
+then
+	echo "WARNING: tmpfs directory \"${TMPFS_IMAGE_MOUNT}\" doesn't exist, building without tmpfs."
+fi
+
+if [ -n "${BUILD_DIR}" ] && [ ! -d "${BUILD_DIR}" ]
+then
+	echo "ERROR: build directory ${BUILD_DIR} doesn't exist."
+	echo "Please check the BUILD_DIR definition in your constants file."
+	exit 1
+fi
+
+prepare_moodle_rdp_profile()
+{
+	echo "==> Preparing minimal Moodle + RDP profile"
+
+	find config/package-lists -maxdepth 1 -type f -name '*.list.chroot' \
+		! -name 'commandline.list.chroot' \
+		! -name 'debian_contrib-core.list.chroot' \
+		! -name 'debian_main-core.list.chroot' \
+		! -name 'debian_non-free.list.chroot' \
+		! -name 'gnome-core.list.chroot' \
+		! -name 'grub-efi.list.chroot' \
+		! -name 'lernstick-core.list.chroot' \
+		! -name 'lernstick-drivers.list.chroot' \
+		! -name 'lernstick-gnome-core.list.chroot' \
+		-delete
+
+	rm -f \
+		config/hooks/live/enable-flathub.container \
+		config/hooks/live/install-proxam-exam-client.chroot \
+		config/includes.chroot_after_packages/etc/xdg/autostart/clipit-startup.desktop \
+		config/includes.chroot_after_packages/etc/lernstick-exam-client.conf \
+		config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d/proxam.conf
+
+	cat > config/package-lists/proxam-moodle-rdp.list.chroot <<'EOF'
+curl
+eog
+evince
+firefox-esr
+firefox-esr-l10n-de
+firefox-esr-l10n-en-gb
+jq
+lernstick-firewall
+libreoffice-calc
+libreoffice-impress
+libreoffice-writer
+libreoffice-l10n-de
+nautilus
+remmina
+remmina-plugin-rdp
+zenity
+EOF
+
+	# Enable the firewall on boot so the Squid whitelist is enforced
+	# before the user can open a browser.
+	# Also allow outbound RDP (TCP 3389) which bypasses Squid (not HTTP).
+	cat > config/hooks/live/enable-proxam-firewall.chroot <<'HOOK'
+#!/bin/sh
+set -e
+systemctl enable lernstick-firewall || true
+
+# Allow outbound RDP connections through the firewall.
+# lernstick-firewall only handles HTTP/HTTPS via Squid; RDP needs a
+# direct iptables exception applied at boot.
+mkdir -p /etc/NetworkManager/dispatcher.d
+cat > /etc/NetworkManager/dispatcher.d/90-proxam-rdp-allow <<'DISPATCH'
+#!/bin/sh
+# Allow outbound RDP (TCP 3389) — applied on every interface up event.
+if [ "$2" = "up" ]; then
+    iptables -C OUTPUT -p tcp --dport 3389 -m comment --comment "proxam-moodle-rdp" -j ACCEPT 2>/dev/null \
+        || iptables -I OUTPUT -p tcp --dport 3389 -m comment --comment "proxam-moodle-rdp" -j ACCEPT
+fi
+DISPATCH
+chmod +x /etc/NetworkManager/dispatcher.d/90-proxam-rdp-allow
+HOOK
+	chmod +x config/hooks/live/enable-proxam-firewall.chroot
+
+	# Disable GNOME initial setup ("Preview Linux System" dialog) and tour.
+	# gnome-initial-setup is pulled in by gnome-core and shows a wizard on
+	# first login that lets users explore the desktop — unwanted in exam mode.
+	cat > config/hooks/live/disable-gnome-initial-setup.chroot <<'HOOK'
+#!/bin/sh
+set -e
+# Remove gnome-initial-setup if installed (pulled by gnome-core)
+apt-get remove --purge -y gnome-initial-setup gnome-tour 2>/dev/null || true
+# Also disable via XDG autostart override in case it gets reinstalled
+mkdir -p /etc/xdg/autostart
+for DESKTOP in gnome-initial-setup-copy-worker.desktop gnome-initial-setup-first-login.desktop gnome-tour.desktop; do
+    if [ -f "/etc/xdg/autostart/${DESKTOP}" ]; then
+        printf '[Desktop Entry]\nHidden=true\n' > "/etc/xdg/autostart/${DESKTOP}"
+    else
+        printf '[Desktop Entry]\nType=Application\nName=Disabled\nHidden=true\n' > "/etc/xdg/autostart/${DESKTOP}"
+    fi
+done
+HOOK
+	chmod +x config/hooks/live/disable-gnome-initial-setup.chroot
+
+	# Pre-build MIME database, desktop file cache, and icon cache so that
+	# file type associations (open .png with eog, .pdf with evince, .docx
+	# with LibreOffice) work immediately on first boot without a restart.
+	cat > config/hooks/live/rebuild-mime-caches.chroot <<'HOOK'
+#!/bin/sh
+set -e
+update-mime-database /usr/share/mime 2>/dev/null || true
+update-desktop-database /usr/share/applications 2>/dev/null || true
+gtk-update-icon-cache -f /usr/share/icons/hicolor 2>/dev/null || true
+glib-compile-schemas /usr/share/glib-2.0/schemas 2>/dev/null || true
+HOOK
+	chmod +x config/hooks/live/rebuild-mime-caches.chroot
+
+	mkdir -p config/includes.chroot_after_packages/etc/xdg/autostart
+	mkdir -p config/includes.chroot_after_packages/etc
+	mkdir -p config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d
+	mkdir -p config/includes.chroot_after_packages/usr/local/bin
+	mkdir -p config/includes.chroot_after_packages/usr/share/applications
+
+	install -m 0644 templates/proxam-moodle-rdp/lernstickWelcome \
+		config/includes.chroot_after_packages/etc/lernstickWelcome
+	install -m 0644 templates/proxam-moodle-rdp/proxam-firewall-whitelist.conf \
+		config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d/proxam.conf
+	install -m 0644 templates/proxam-moodle-rdp/proxam-moodle-rdp.conf \
+		config/includes.chroot_after_packages/etc/proxam-moodle-rdp.conf
+	install -m 0755 templates/proxam-moodle-rdp/proxam-moodle-rdp-launcher \
+		config/includes.chroot_after_packages/usr/local/bin/proxam-moodle-rdp-launcher
+	install -m 0755 templates/proxam-moodle-rdp/proxam-download-files \
+		config/includes.chroot_after_packages/usr/local/bin/proxam-download-files
+	install -m 0644 templates/proxam-moodle-rdp/proxam-moodle-rdp.desktop \
+		config/includes.chroot_after_packages/etc/xdg/autostart/proxam-moodle-rdp.desktop
+	install -m 0644 templates/proxam-moodle-rdp/proxam-moodle-rdp.desktop \
+		config/includes.chroot_after_packages/usr/share/applications/proxam-moodle-rdp.desktop
+}
+
+init_build
+prepare_moodle_rdp_profile
+configure
+build_image
\ No newline at end of file
diff --git a/build_source_release.sh b/build_source_release.sh
index 8012879c..6864a147 100755
--- a/build_source_release.sh
+++ b/build_source_release.sh
@@ -7,19 +7,19 @@ fi
 clear
 
 # build edu version
-git checkout debian12
+git checkout debian13
 ./build_tmpfs.sh
 ./build_edu-mini_iso.sh
 ./build_tmpfs.sh
 ./build_source.sh
 
 # build exam version
-git checkout exam-debian12
+git checkout exam-debian13
 ./build_tmpfs.sh
 ./build_source.sh
 
 # cleanup
-git checkout debian12
+git checkout debian13
 
 # final shutdown?
 if [ -n "$SHUTDOWN_AFTER_BUILDING" ]
diff --git a/config/archives/lernstick-12.key b/config/archives/lernstick-13.key
similarity index 100%
rename from config/archives/lernstick-12.key
rename to config/archives/lernstick-13.key
diff --git a/config/archives/lernstick-12.list b/config/archives/lernstick-13.list
similarity index 57%
rename from config/archives/lernstick-12.list
rename to config/archives/lernstick-13.list
index 3d8a8d45..07eee84d 100644
--- a/config/archives/lernstick-12.list
+++ b/config/archives/lernstick-13.list
@@ -1,23 +1,23 @@
 # Lernstick specific packages
-deb [arch=amd64,arm64] http://packages.lernstick.ch/lernstick lernstick-12 main contrib non-free
-deb-src http://packages.lernstick.ch/lernstick lernstick-12 main contrib non-free
+deb [arch=amd64,arm64] http://packages.lernstick.ch/lernstick lernstick-13 main contrib non-free
+deb-src http://packages.lernstick.ch/lernstick lernstick-13 main contrib non-free
 
 # Backports done by the Lernstick team of other packages
-deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-12-backports main contrib non-free non-free-firmware
-deb-src http://packages.lernstick.ch/lernstick lernstick-12-backports main contrib non-free non-free-firmware
+deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-13-backports main contrib non-free non-free-firmware
+deb-src http://packages.lernstick.ch/lernstick lernstick-13-backports main contrib non-free non-free-firmware
 
 # Third party packages
-deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-12-thirdparty main contrib non-free
-deb-src http://packages.lernstick.ch/lernstick lernstick-12-thirdparty main contrib non-free
+deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-13-thirdparty main contrib non-free
+deb-src http://packages.lernstick.ch/lernstick lernstick-13-thirdparty main contrib non-free
 
 # Staging packages (distribution set to "not automatic")
-deb [arch=amd64,arm64] http://packages.lernstick.ch/lernstick lernstick-12-staging main contrib non-free
-deb-src http://packages.lernstick.ch/lernstick lernstick-12-staging main contrib non-free
+deb [arch=amd64,arm64] http://packages.lernstick.ch/lernstick lernstick-13-staging main contrib non-free
+deb-src http://packages.lernstick.ch/lernstick lernstick-13-staging main contrib non-free
 
 # Staging distribution for backports (set to "not automatic")
-deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-12-backports-staging main contrib non-free non-free-firmware
-deb-src http://packages.lernstick.ch/lernstick lernstick-12-backports-staging main contrib non-free non-free-firmware
+deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-13-backports-staging main contrib non-free non-free-firmware
+deb-src http://packages.lernstick.ch/lernstick lernstick-13-backports-staging main contrib non-free non-free-firmware
 
 # Staging distribution for third party packages (distribution set to "not automatic")
-deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-12-thirdparty-staging main contrib non-free
-deb-src http://packages.lernstick.ch/lernstick lernstick-12-thirdparty-staging main contrib non-free
+deb [arch=i386,amd64] http://packages.lernstick.ch/lernstick lernstick-13-thirdparty-staging main contrib non-free
+deb-src http://packages.lernstick.ch/lernstick lernstick-13-thirdparty-staging main contrib non-free
diff --git a/config/hooks/live/clean_uv_cache.chroot b/config/hooks/live/clean_uv_cache.chroot
new file mode 100755
index 00000000..08cdc653
--- /dev/null
+++ b/config/hooks/live/clean_uv_cache.chroot
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# If we install packages with uv, we will have many files in the uv cache.
+# This can be huge, just clean the cache.
+
+if [ -e /usr/local/bin/uv ]
+then
+	/usr/local/bin/uv cache clean
+else
+	echo "WARNING: command uv not found"
+fi
diff --git a/config/hooks/live/disable_services.chroot b/config/hooks/live/disable_services.chroot
new file mode 100755
index 00000000..356ed79b
--- /dev/null
+++ b/config/hooks/live/disable_services.chroot
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# disabled nmbd in Debian 13 because of a timeout
+# https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1090974
+systemctl disable nmbd
diff --git a/config/hooks/live/enable-flathub.container b/config/hooks/live/enable-flathub.container
index c56cbe6d..2070b4f3 100755
--- a/config/hooks/live/enable-flathub.container
+++ b/config/hooks/live/enable-flathub.container
@@ -25,7 +25,7 @@ flatpak remote-add --if-not-exists flathub-beta https://flathub.org/beta-repo/fl
 echo "installing flatpak nvidia drivers..."
 # install one package after the other so that an installation failure in one
 # package doesn't stop the installation of subsequent packages
-for i in "535-216-01"
+for i in "550-163-01"
 do
 	flatpak -y install org.freedesktop.Platform.GL.nvidia-$i
 done
@@ -61,6 +61,7 @@ flatpak -y install \
 	io.github.adrienverge.PhotoCollage \
 	io.github.flattool.Warehouse \
 	io.github.pwr_solaar.solaar \
+	io.github.yairm210.unciv \
 	io.sourceforge.pentobi \
 	net.hhoney.rota \
 	net.lutris.Lutris \
@@ -124,6 +125,7 @@ flatpak -y install \
 	org.kde.parley \
 	org.kde.picmi \
 	org.ksnip.ksnip \
+	org.luanti.luanti \
 	org.mixxx.Mixxx \
 	org.mobsya.ThymioSuite \
 	org.musescore.MuseScore \
@@ -139,9 +141,7 @@ flatpak -y install \
 	org.x.Warpinator \
 	xyz.ketok.Speedtest
 #	io.lmms.LMMS \
-#	net.minetest.Minetest \
 #	org.denemo.Denemo \
 #	org.gimp.GIMP \
 #	org.speed_dreams.SpeedDreams \
 #	org.supertuxproject.SuperTux \
-#	xyz.ketok.Speedtest
diff --git a/config/hooks/live/install-proxam-exam-client.chroot b/config/hooks/live/install-proxam-exam-client.chroot
new file mode 100755
index 00000000..e8d2cebe
--- /dev/null
+++ b/config/hooks/live/install-proxam-exam-client.chroot
@@ -0,0 +1,59 @@
+#!/bin/sh
+# Install proxam-exam-client during ISO build.
+# If the package was already installed by live-build from config/packages.chroot/,
+# this hook only installs any extra runtime dependencies not declared in the .deb.
+# As a fallback it downloads the latest release from GitHub.
+set -e
+
+GITHUB_REPO="Wojtasik-Lang-Consulting/proxam-exam-client"
+DEB_NAME="proxam-exam-client"
+TMPDIR="/tmp/proxam-exam-client-install"
+
+# If already installed (e.g. via config/packages.chroot/), skip download
+if dpkg -l "${DEB_NAME}" 2>/dev/null | grep -q "^ii"; then
+    echo "==> ${DEB_NAME} already installed, skipping download."
+else
+    echo "==> Installing ${DEB_NAME} from GitHub Releases ..."
+
+    LATEST_URL=$(wget -qO- "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" \
+        | grep "browser_download_url" \
+        | grep "\.deb" \
+        | head -1 \
+        | cut -d '"' -f 4)
+
+    if [ -z "${LATEST_URL}" ]; then
+        echo "ERROR: Could not find a .deb release for ${GITHUB_REPO}." >&2
+        echo "       Either push a tagged release or place the .deb in config/packages.chroot/." >&2
+        exit 1
+    fi
+
+    echo "==> Downloading: ${LATEST_URL}"
+    mkdir -p "${TMPDIR}"
+    wget -q -O "${TMPDIR}/${DEB_NAME}.deb" "${LATEST_URL}"
+
+    echo "==> Installing ${DEB_NAME}.deb ..."
+    apt-get install -y --no-install-recommends \
+        wget \
+        python3 \
+        zenity \
+        coreutils \
+        iptables \
+        ffmpeg \
+        screen \
+        xdotool \
+        python3-wxgtk-webview4.0 \
+        python3-packaging \
+        python3-requests \
+        avahi-utils \
+        rdiff-backup
+    dpkg -i "${TMPDIR}/${DEB_NAME}.deb" || apt-get install -f -y
+
+    rm -rf "${TMPDIR}"
+fi
+
+# Install extra runtime deps not in the .deb's Depends (avahi-utils, rdiff-backup)
+apt-get install -y --no-install-recommends \
+    avahi-utils \
+    rdiff-backup
+
+echo "==> ${DEB_NAME} installed successfully."
diff --git a/config/hooks/live/uninstall_packages.chroot b/config/hooks/live/uninstall_packages.chroot
index beca6951..9e759242 100755
--- a/config/hooks/live/uninstall_packages.chroot
+++ b/config/hooks/live/uninstall_packages.chroot
@@ -7,15 +7,13 @@
 # system so we have to remove them here right afer installing them...
 apt-get purge -y \
 	blueman \
-	exim4-base \
-	exim4-config \
-	exim4-daemon-light \
+	eog \
+	firmware-marvell-prestera \
 	gnome-robots \
 	gnome-system-tools \
 	gucharmap \
 	hexchat \
-	minidlna \
-	nextcloud-desktop-doc \
+	malcontent-gui \
 	plasma-discover \
 	plasma-discover-common \
 	system-tools-backends \
diff --git a/config/includes.chroot_after_packages/etc/lernstick-exam-client.conf b/config/includes.chroot_after_packages/etc/lernstick-exam-client.conf
new file mode 100644
index 00000000..15ad21ab
--- /dev/null
+++ b/config/includes.chroot_after_packages/etc/lernstick-exam-client.conf
@@ -0,0 +1,20 @@
+# ProXam Exam Client — Serverkonfiguration
+#
+# Diese Datei wird von searchExamServer gelesen wenn kein mDNS-Server
+# gefunden wird. IP und Host auf den ProXam-Server anpassen.
+#
+# Für mDNS-Discovery (Schule mit lokalem Server): diese Datei löschen oder
+# auskommentieren — der Client scannt dann das Netzwerk automatisch.
+
+serverIp="0.0.0.0"
+serverHost="api.proxam.at"
+serverPort=443
+serverProto="https"
+serverDesc="ProXam Prüfungsserver"
+
+actionDownload='proxam/ticket/download/{token}'
+actionFinish='proxam/ticket/finish/{token}'
+actionNotify='proxam/ticket/notify/{token}?state={state}'
+actionSSHKey='proxam/ticket/ssh-key'
+actionMd5='proxam/ticket/md5/{token}'
+actionConfig='proxam/ticket/config/{token}'
diff --git a/config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d/proxam.conf b/config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d/proxam.conf
new file mode 100644
index 00000000..6b0ee19e
--- /dev/null
+++ b/config/includes.chroot_after_packages/etc/lernstick-firewall/proxy.d/proxam.conf
@@ -0,0 +1,8 @@
+# ProXam Firewall Whitelist
+# Erlaubt HTTP/HTTPS-Zugriff auf den ProXam-Backend-Server.
+# Wird von lernstick-firewall (Squid-Proxy) eingelesen.
+#
+# Format: ^proto://host (Regex-Präfix)
+# Diese Datei wird beim Start von searchExamServer automatisch befüllt.
+# Der Eintrag hier dient als Fallback/Basis-Whitelist.
+^https://api\.proxam\.at
diff --git a/config/includes.chroot_after_packages/etc/lernstickWelcome b/config/includes.chroot_after_packages/etc/lernstickWelcome
index 2914e54a..0ce79500 100644
--- a/config/includes.chroot_after_packages/etc/lernstickWelcome
+++ b/config/includes.chroot_after_packages/etc/lernstickWelcome
@@ -1,3 +1,4 @@
 AutoStartInstaller=true
 ShowNotUsedInfo=true
 ShowReadOnlyInfo=true
+SearchExamServer=true
diff --git a/config/package-lists/commandline.list.chroot b/config/package-lists/commandline.list.chroot
index 555c5b0f..aff3cb08 100644
--- a/config/package-lists/commandline.list.chroot
+++ b/config/package-lists/commandline.list.chroot
@@ -11,10 +11,11 @@ bash-completion
 bind9-host
 btop
 command-not-found
-deborphan
+#deborphan
 debtree
 dialog
 duf
+fastfetch
 hexyl
 htop
 icnsutils
@@ -27,7 +28,6 @@ less
 mc
 mtools
 ncdu
-neofetch
 nethogs
 netpbm
 nvitop
diff --git a/config/package-lists/debian_contrib-core.list.chroot b/config/package-lists/debian_contrib-core.list.chroot
index a9146bab..aea384c9 100644
--- a/config/package-lists/debian_contrib-core.list.chroot
+++ b/config/package-lists/debian_contrib-core.list.chroot
@@ -7,6 +7,6 @@
 
 firmware-b43-installer
 firmware-b43legacy-installer
-nvidia-settings=535.216.01-1~bpo12+1
+nvidia-settings=550.163.01-1
 virtualbox-guest-utils
 virtualbox-guest-x11
diff --git a/config/package-lists/debian_main-core.list.chroot b/config/package-lists/debian_main-core.list.chroot
index a6bf0623..ed2a0094 100644
--- a/config/package-lists/debian_main-core.list.chroot
+++ b/config/package-lists/debian_main-core.list.chroot
@@ -18,7 +18,7 @@ avahi-utils
 cifs-utils
 console-setup
 cryptsetup-initramfs
-cryptsetup-run
+cryptsetup
 davfs2
 dfrs
 #ecryptfs-utils
@@ -40,9 +40,6 @@ fonts-roboto
 fonts-ubuntu
 fonts-ubuntu-console
 gdm3
-gedit
-gedit-plugins
-gedit-plugin-text-size
 gnome-clocks
 gstreamer1.0-alsa
 gstreamer1.0-libav
@@ -50,9 +47,7 @@ gstreamer1.0-plugins-bad
 gstreamer1.0-plugins-base
 gstreamer1.0-plugins-good
 gstreamer1.0-plugins-ugly
-# gstreamer1.0-vaapi crashes Xorg on a Lenovo Ideapad 3 14ARE05, see:
-# https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1861609
-#gstreamer1.0-vaapi
+gstreamer1.0-vaapi
 gtkman
 haveged
 i2c-tools
@@ -60,8 +55,8 @@ i965-va-driver
 #icedtea-8-plugin
 keyutils
 libbluray-bdj
-libcanberra-gtk0
-libcanberra-gtk-module
+libcanberra-gtk3-0
+libcanberra-gtk3-module
 libgl1-mesa-dri
 libva-glx2
 live-tools
@@ -80,7 +75,7 @@ mesa-vulkan-drivers
 modemmanager
 mokutil
 nala
-network-manager-fortisslvpn
+#network-manager-fortisslvpn
 #network-manager-iodine
 network-manager-l2tp
 network-manager-openconnect
@@ -103,10 +98,11 @@ ppp
 projecteur
 rfkill
 rng-tools5
+rocminfo
 rsync
+screenkey
 smbclient
-smbios-utils
-software-properties-gtk
+#software-properties-gtk
 spice-vdagent
 squashfs-tools
 sshfs
@@ -136,7 +132,7 @@ xserver-xorg-input-evdev
 #xserver-xorg-input-joystick (DON'T install, it breaks gamepads!)
 xserver-xorg-input-kbd
 xserver-xorg-input-mouse
-xserver-xorg-input-mutouch
+#xserver-xorg-input-mutouch
 #xserver-xorg-input-synaptics
 xserver-xorg-input-wacom
 xserver-xorg-input-xwiimote
@@ -145,11 +141,11 @@ xserver-xorg-video-amdgpu
 xserver-xorg-video-cirrus
 xserver-xorg-video-dummy
 xserver-xorg-video-glide
-xserver-xorg-video-ivtv
+#xserver-xorg-video-ivtv
 xserver-xorg-video-mach64
 xserver-xorg-video-mga
 xserver-xorg-video-neomagic
-xserver-xorg-video-openchrome
+#xserver-xorg-video-openchrome
 xserver-xorg-video-qxl
 xserver-xorg-video-r128
 xserver-xorg-video-savage
diff --git a/config/package-lists/debian_main-default.list.chroot b/config/package-lists/debian_main-default.list.chroot
index 8b732d66..46fec4dc 100644
--- a/config/package-lists/debian_main-default.list.chroot
+++ b/config/package-lists/debian_main-default.list.chroot
@@ -4,14 +4,10 @@
 # standard and exam version, but are *NOT* needed in all customized exam
 # versions.
 #
-# * synaptic needs apt-xapian-index for quicksearch
-#
 ################################################################################
 
-apt-xapian-index
 clamtk
-eog-plugins
-epoptes-client
+#epoptes-client
 firefox-esr
 firefox-esr-l10n-de
 firefox-esr-l10n-en-gb
@@ -26,12 +22,12 @@ firefox-esr-l10n-sq
 #fslint
 #gconf-editor
 gdebi
+geogebra-gnome
 gnome-nettool
 gnome-system-monitor
 gtkhash
 lshw-gtk
 menulibre
 seahorse
-#shutter
 synaptic
 virt-manager
diff --git a/config/package-lists/debian_main-mini.list.chroot b/config/package-lists/debian_main-mini.list.chroot
index ddb5859f..667fc34f 100644
--- a/config/package-lists/debian_main-mini.list.chroot
+++ b/config/package-lists/debian_main-mini.list.chroot
@@ -16,7 +16,6 @@
 amsynth
 #apper
 arandr
-#ardesia
 blop
 bluetooth
 bluez-cups
@@ -37,8 +36,7 @@ dmz-cursor-theme
 dolphin
 #dolphin-nextcloud
 dolphin-owncloud
-epoptes
-#ffplay
+#epoptes
 flac
 fritzing
 fritzing-parts
@@ -50,7 +48,6 @@ gparted
 graphviz
 gstreamer1.0-packagekit
 gwakeonlan
-#handbrake-gtk
 heif-thumbnailer
 hugin
 hunspell-de-at
@@ -75,7 +72,7 @@ jmtpfs
 jstest-gtk
 keepassxc
 kfind
-kipi-plugins
+#kipi-plugins
 kmag
 kmousetool
 konq-plugins
@@ -83,14 +80,6 @@ konqueror
 krename
 #ktimetracker
 #lilypond
-# mypaint is currently not co-installable with gimp, see
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894757
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897909
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906144
-# Therefore we can install mypaint only from flathub
-#mypaint
-#mypaint-data
-#mypaint-data-extras
 myspell-es
 myspell-fa
 mystiq
@@ -122,7 +111,7 @@ obs-transition-table
 obs-vintage-filter
 okular
 okular-extra-backends
-onedrive
+#onedrive disabled because of https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1101407
 owncloud-client
 photofilmstrip
 qelectrotech
@@ -135,17 +124,16 @@ qtqr
 rawtherapee
 samba
 samplerate-programs
-sane
+#sane
 sane-utils
-#scrcpy
+scrcpy
 sddm
 smb4k
 sonic-pi
-#spamassassin
 spice-webdavd
 subversion
 swh-plugins
-synfigstudio
+#synfigstudio
 tesseract-ocr-deu
 tesseract-ocr-eng
 tesseract-ocr-fra
@@ -164,12 +152,10 @@ thunderbird-l10n-ru
 thunderbird-l10n-sq
 totem-plugins
 vim-gtk3
-vinagre
-#vym
 wireshark
 xournal
 xsane
-youtube-dl
+yt-dlp
 zenmap
 zint-qt
 zsync
diff --git a/config/package-lists/debian_main-standard.list.chroot b/config/package-lists/debian_main-standard.list.chroot
index 41e23e20..e113672b 100644
--- a/config/package-lists/debian_main-standard.list.chroot
+++ b/config/package-lists/debian_main-standard.list.chroot
@@ -6,15 +6,15 @@ extremetuxracer
 gimp
 gimp-data
 gimp-data-extras
-gimp-gap
+#gimp-gap
 gimp-help-de
 gimp-help-en
 gimp-help-es
 gimp-help-fr
 gimp-help-it
+gimp-help-pt-br
 gimp-help-ru
-gimp-plugin-registry
-#gimp-python
+#gimp-plugin-registry
 gimp-texturize
 kstars
 kstars-data
diff --git a/config/package-lists/debian_main_amd64.list.chroot b/config/package-lists/debian_main_amd64.list.chroot
deleted file mode 100644
index 1569e65d..00000000
--- a/config/package-lists/debian_main_amd64.list.chroot
+++ /dev/null
@@ -1,8 +0,0 @@
-################################################################################
-#
-# * virtualbox and other dkms based modules needs linux-headers-*, otherwise
-#   these kernel modules can not be compiled
-#
-################################################################################
-
-linux-headers-6.12.9+bpo-amd64
diff --git a/config/package-lists/debian_non-free.list.chroot b/config/package-lists/debian_non-free.list.chroot
index f74c384f..4cb0b229 100644
--- a/config/package-lists/debian_non-free.list.chroot
+++ b/config/package-lists/debian_non-free.list.chroot
@@ -19,7 +19,7 @@ firmware-misc-nonfree
 firmware-myricom
 firmware-netronome
 firmware-netxen
-firmware-nvidia-gsp=535.216.01-1~deb12u1
+firmware-nvidia-gsp=550.163.01-4~bpo13+1
 firmware-qlogic
 firmware-realtek
 firmware-siano
@@ -27,39 +27,39 @@ firmware-sof-signed
 firmware-ti-connectivity
 firmware-zd1211
 intel-microcode
-libcuda1=535.216.01-1~deb12u1
-libegl-nvidia0=535.216.01-1~deb12u1
-libgl1-nvidia-glvnd-glx=535.216.01-1~deb12u1
-libgles-nvidia1=535.216.01-1~deb12u1
-libgles-nvidia2=535.216.01-1~deb12u1
-libglx-nvidia0=535.216.01-1~deb12u1
-libnvcuvid1=535.216.01-1~deb12u1
-libnvidia-allocator1=535.216.01-1~deb12u1
-libnvidia-cfg1=535.216.01-1~deb12u1
-libnvidia-eglcore=535.216.01-1~deb12u1
-libnvidia-encode1=535.216.01-1~deb12u1
-libnvidia-glcore=535.216.01-1~deb12u1
-libnvidia-glvkspirv=535.216.01-1~deb12u1
-libnvidia-ml1=535.216.01-1~deb12u1
-libnvidia-pkcs11-openssl3=535.216.01-1~deb12u1
-libnvidia-ptxjitcompiler1=535.216.01-1~deb12u1
-libnvidia-rtcore=535.216.01-1~deb12u1
-libnvoptix1=535.216.01-1~deb12u1
-nvidia-alternative=535.216.01-1~deb12u1
+libcuda1=550.163.01-4~bpo13+1
+libegl-nvidia0=550.163.01-4~bpo13+1
+libgl1-nvidia-glvnd-glx=550.163.01-4~bpo13+1
+libgles-nvidia1=550.163.01-4~bpo13+1
+libgles-nvidia2=550.163.01-4~bpo13+1
+libglx-nvidia0=550.163.01-4~bpo13+1
+libnvcuvid1=550.163.01-4~bpo13+1
+libnvidia-allocator1=550.163.01-4~bpo13+1
+libnvidia-cfg1=550.163.01-4~bpo13+1
+libnvidia-eglcore=550.163.01-4~bpo13+1
+libnvidia-encode1=550.163.01-4~bpo13+1
+libnvidia-glcore=550.163.01-4~bpo13+1
+libnvidia-glvkspirv=550.163.01-4~bpo13+1
+libnvidia-ml1=550.163.01-4~bpo13+1
+libnvidia-pkcs11-openssl3=550.163.01-4~bpo13+1
+libnvidia-ptxjitcompiler1=550.163.01-4~bpo13+1
+libnvidia-rtcore=550.163.01-4~bpo13+1
+libnvoptix1=550.163.01-4~bpo13+1
+nvidia-alternative=550.163.01-4~bpo13+1
 nvidia-container-toolkit
-nvidia-cuda-mps=535.216.01-1~deb12u1
-nvidia-detect=535.216.01-1~deb12u1
-nvidia-driver=535.216.01-1~deb12u1
-nvidia-driver-bin=535.216.01-1~deb12u1
-nvidia-driver-libs=535.216.01-1~deb12u1
-nvidia-egl-common=535.216.01-1~deb12u1
-nvidia-egl-icd=535.216.01-1~deb12u1
-nvidia-kernel-support=535.216.01-1~deb12u1
-nvidia-legacy-check=535.216.01-1~deb12u1
-nvidia-smi=535.216.01-1~deb12u1
-nvidia-suspend-common=535.216.01-1~deb12u1
-nvidia-vdpau-driver=535.216.01-1~deb12u1
-nvidia-vulkan-common=535.216.01-1~deb12u1
+nvidia-cuda-mps=550.163.01-4~bpo13+1
+nvidia-detect=550.163.01-4~bpo13+1
+nvidia-driver=550.163.01-4~bpo13+1
+nvidia-driver-bin=550.163.01-4~bpo13+1
+nvidia-driver-libs=550.163.01-4~bpo13+1
+nvidia-egl-common=550.163.01-4~bpo13+1
+nvidia-egl-icd=550.163.01-4~bpo13+1
+nvidia-kernel-support=550.163.01-4~bpo13+1
+nvidia-legacy-check=550.163.01-4~bpo13+1
+nvidia-smi=550.163.01-4~bpo13+1
+nvidia-suspend-common=550.163.01-4~bpo13+1
+nvidia-vdpau-driver=550.163.01-4~bpo13+1
+nvidia-vulkan-common=550.163.01-4~bpo13+1
 p7zip-rar
 phoronix-test-suite
-xserver-xorg-video-nvidia=535.216.01-1~deb12u1
+xserver-xorg-video-nvidia=550.163.01-4~bpo13+1
diff --git a/config/package-lists/education.list.chroot b/config/package-lists/education.list.chroot
index c3b89b82..5cd7fcb4 100644
--- a/config/package-lists/education.list.chroot
+++ b/config/package-lists/education.list.chroot
@@ -3,7 +3,6 @@
 avogadro
 #bkchem
 chemtool
-#childsplay
 jfractionlab
 kalgebra
 kgeography
@@ -16,7 +15,7 @@ pianobooster
 pspp
 #pymol
 pysiogame
-speedcrunch
+#speedcrunch
 step
 tipp10
 tuxmath
diff --git a/config/package-lists/games.list.chroot b/config/package-lists/games.list.chroot
index b6e34def..246a1440 100644
--- a/config/package-lists/games.list.chroot
+++ b/config/package-lists/games.list.chroot
@@ -9,7 +9,7 @@ armagetronad
 blockout2
 crack-attack
 dossizola
-fb-music-high
+#fb-music-high
 foobillardplus
 freeciv-client-gtk4
 freeciv-server
diff --git a/config/package-lists/gnome-core.list.chroot b/config/package-lists/gnome-core.list.chroot
index 7c29e50b..b446759d 100644
--- a/config/package-lists/gnome-core.list.chroot
+++ b/config/package-lists/gnome-core.list.chroot
@@ -6,16 +6,18 @@
 ################################################################################
 
 gnome-core
+gnome-shell-extension-appindicator
 gnome-shell-extension-dashtodock
 gnome-shell-extension-dash-to-panel
 gnome-shell-extension-desktop-icons-ng
 #gnome-shell-extension-draw-on-your-screen
 gnome-shell-extension-gpaste
 gnome-shell-extensions
-gnome-shell-extension-top-icons-plus
+gnome-shell-extension-tiling-assistant
+gnome-shell-extension-workspace-indicator
 nautilus
 #nautilus-wipe
-network-manager-fortisslvpn-gnome
+#network-manager-fortisslvpn-gnome
 network-manager-gnome
 #network-manager-iodine-gnome
 network-manager-l2tp-gnome
diff --git a/config/package-lists/gnome-default.list.chroot b/config/package-lists/gnome-default.list.chroot
index 7a670224..25d18b05 100644
--- a/config/package-lists/gnome-default.list.chroot
+++ b/config/package-lists/gnome-default.list.chroot
@@ -10,6 +10,6 @@ clamtk-gnome
 #eiciel # breaks l10n in nautilus
 font-manager
 gnome-tweaks
-#nautilus-font-manager
+nautilus-font-manager
 #nautilus-gtkhash
 seahorse-nautilus
diff --git a/config/package-lists/gnome-mini.list.chroot b/config/package-lists/gnome-mini.list.chroot
index 0054427c..e822f197 100644
--- a/config/package-lists/gnome-mini.list.chroot
+++ b/config/package-lists/gnome-mini.list.chroot
@@ -2,6 +2,8 @@
 # in the exam version.
 
 gnome-firmware
+gnome-shell-extension-gsconnect
+gnome-shell-extension-gsconnect-browsers
 #hamster-applet
 nautilus-admin
 #nautilus-nextcloud
diff --git a/config/package-lists/kde.list.chroot b/config/package-lists/kde.list.chroot
index b2aae6cf..a37035a0 100644
--- a/config/package-lists/kde.list.chroot
+++ b/config/package-lists/kde.list.chroot
@@ -16,14 +16,14 @@ kde-config-cddb
 kde-config-cron
 kde-config-gtk-style
 kde-config-gtk-style-preview
-kde-config-systemd
+#kde-config-systemd
 kdegraphics-thumbnailers
 kdenetwork-filesharing
 kde-style-qtcurve-qt5
 kdf
 kdialog
 kfourinline
-kgamma5
+kgamma
 khelpcenter
 kio-audiocd
 kiriki
@@ -33,13 +33,11 @@ klines
 kmahjongg
 kmenuedit
 kmines
-knotes
+#knotes
 konsole
 kpat
 kreversi
 ksudoku
-#ksysguard
-#ksysguardd
 ksystemlog
 ktorrent
 kwalletmanager
diff --git a/config/package-lists/lernstick-cinnamon.list.chroot b/config/package-lists/lernstick-cinnamon.list.chroot
index 931acbc0..5b8e9e07 100644
--- a/config/package-lists/lernstick-cinnamon.list.chroot
+++ b/config/package-lists/lernstick-cinnamon.list.chroot
@@ -1,2 +1,2 @@
-lernstick-cinnamon-screensaver
+#lernstick-cinnamon-screensaver
 lernstick-nemo
diff --git a/config/package-lists/lernstick-core.list.chroot b/config/package-lists/lernstick-core.list.chroot
index 1254b84f..780e4ed0 100644
--- a/config/package-lists/lernstick-core.list.chroot
+++ b/config/package-lists/lernstick-core.list.chroot
@@ -24,7 +24,7 @@ lernstick-onboard
 #lernstick-openjdk-8-jre
 lernstick-python-apt-common
 lernstick-ranger
-lernstick-software-properties-gtk
+#lernstick-software-properties-gtk
 lernstick-speech-dispatcher
 lernstick-systemd
 lernstick-texlive-base
diff --git a/config/package-lists/lernstick-default.list.chroot b/config/package-lists/lernstick-default.list.chroot
index 6646f0b4..864326e5 100644
--- a/config/package-lists/lernstick-default.list.chroot
+++ b/config/package-lists/lernstick-default.list.chroot
@@ -8,7 +8,6 @@
 
 jitsi-meet-electron
 lernstick-baobab
-lernstick-eog
 lernstick-evince
 lernstick-file-roller
 lernstick-firefox-addons
@@ -24,4 +23,5 @@ lernstick-master-pdf-editor
 lernstick-menulibre
 #lernstick-shutter
 lernstick-synaptic
+lernstick-virt-manager
 master-pdf-editor-5
diff --git a/config/package-lists/lernstick-drivers.list.chroot b/config/package-lists/lernstick-drivers.list.chroot
index b6662e43..0d41167c 100644
--- a/config/package-lists/lernstick-drivers.list.chroot
+++ b/config/package-lists/lernstick-drivers.list.chroot
@@ -1,5 +1,5 @@
-broadcom-sta-modules-6.12.9+bpo-amd64-signed
-nvidia-kernel-535.216.01-6.12.9+bpo-amd64-signed
-rtl88x2bu-modules-6.12.9+bpo-amd64-signed
-v4l2loopback-modules-6.12.9+bpo-amd64-signed
-virtualbox-modules-6.12.9+bpo-amd64-signed
+broadcom-sta-modules-6.18.15+deb13-amd64-signed
+nvidia-kernel-550.163.01-6.18.15+deb13-amd64-signed
+rtl88x2bu-modules-6.18.15+deb13-amd64-signed
+v4l2loopback-modules-6.18.15+deb13-amd64-signed
+virtualbox-modules-6.18.15+deb13-amd64-signed
diff --git a/config/package-lists/lernstick-education.list.chroot b/config/package-lists/lernstick-education.list.chroot
index 3cdc3af6..e896b5ac 100644
--- a/config/package-lists/lernstick-education.list.chroot
+++ b/config/package-lists/lernstick-education.list.chroot
@@ -21,9 +21,8 @@ lernstick-orthografietrainer
 lernstick-phet
 lernstick-pspp
 #lernstick-pymol
-#lernstick-schatz-der-kulturen
 lernstick-sikore
-lernstick-speedcrunch
+#lernstick-speedcrunch
 lernstick-step
 lernstick-tipp10
 lernstick-toporopa
diff --git a/config/package-lists/lernstick-gnome-core.list.chroot b/config/package-lists/lernstick-gnome-core.list.chroot
index bfc7e62a..a7fb3386 100644
--- a/config/package-lists/lernstick-gnome-core.list.chroot
+++ b/config/package-lists/lernstick-gnome-core.list.chroot
@@ -5,8 +5,9 @@
 #
 ################################################################################
 
-gnome-shell-extension-draw-on-your-screen2
-#gnome-shell-extension-unblank
-#gnome-shell-extension-unlock-dialog-background
+gnome-shell-extension-draw-on-gnome
+gnome-shell-extension-gjs-osk
+gnome-shell-extension-unblank
+gnome-shell-extension-unlock-dialog-background
 lernstick-gpaste-2
 lernstick-nautilus
diff --git a/config/package-lists/lernstick-gnome-mini.list.chroot b/config/package-lists/lernstick-gnome-mini.list.chroot
index 0da4f82a..5712d082 100644
--- a/config/package-lists/lernstick-gnome-mini.list.chroot
+++ b/config/package-lists/lernstick-gnome-mini.list.chroot
@@ -5,7 +5,6 @@
 #
 ################################################################################
 
-lernstick-gedit
 lernstick-gnome-calculator
 lernstick-gnome-font-viewer
 #lernstick-hamster-applet
diff --git a/config/package-lists/lernstick-kde.list.chroot b/config/package-lists/lernstick-kde.list.chroot
index 87c98871..fb5c25ee 100644
--- a/config/package-lists/lernstick-kde.list.chroot
+++ b/config/package-lists/lernstick-kde.list.chroot
@@ -15,12 +15,11 @@ lernstick-klickety
 lernstick-klines
 lernstick-kmahjongg
 lernstick-kmines
-lernstick-knotes
+#lernstick-knotes
 lernstick-konsole
 lernstick-kpat
 lernstick-kreversi
 lernstick-ksudoku
-#lernstick-ksysguard
 lernstick-ksystemlog
 lernstick-ktorrent
 lernstick-kwalletmanager
diff --git a/config/package-lists/lernstick-lxde.list.chroot b/config/package-lists/lernstick-lxde.list.chroot
index eb7cc521..8ca4e98f 100644
--- a/config/package-lists/lernstick-lxde.list.chroot
+++ b/config/package-lists/lernstick-lxde.list.chroot
@@ -1,11 +1,12 @@
+lernstick-diodon
 lernstick-galculator
 lernstick-gnome-system-tools
 lernstick-gpicview
-#lernstick-lxmusic
+lernstick-lxmusic
 lernstick-lxtask
 lernstick-lxterminal
 lernstick-obconf
-lernstick-parcellite
+#lernstick-parcellite
 lernstick-pcmanfm
 lernstick-usermode
 lernstick-xarchiver
diff --git a/config/package-lists/lernstick-mini.list.chroot b/config/package-lists/lernstick-mini.list.chroot
index bfcff8dc..744d3895 100644
--- a/config/package-lists/lernstick-mini.list.chroot
+++ b/config/package-lists/lernstick-mini.list.chroot
@@ -11,7 +11,6 @@ jbackpack-full
 #lernstick-amarok-utils
 #lernstick-apper
 lernstick-arandr
-#lernstick-avidemux-qt
 lernstick-brasero
 lernstick-calibre
 lernstick-dconf-editor
@@ -21,12 +20,10 @@ lernstick-fritzing
 lernstick-fsview
 #lernstick-gdebi-kde
 lernstick-gnome-characters
-lernstick-gnome-dictionary
 lernstick-gnome-logs
 lernstick-gnome-screenshot
 lernstick-gnome-software
 lernstick-gparted
-#lernstick-handbrake-gtk
 lernstick-hugin
 lernstick-info
 lernstick-konqueror
@@ -36,12 +33,6 @@ lernstick-mein-klett
 lernstick-menu-xdg
 lernstick-mille-feuilles
 lernstick-mount-exchange
-# mypaint is currently not co-installable with gimp, see
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894757
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897909
-# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906144
-# Therefore we can install mypaint only from flathub
-#lernstick-mypaint
 #lernstick-nitroshare
 lernstick-okular
 lernstick-openclipart
@@ -66,7 +57,6 @@ lernstick-xjadeo
 lernstick-xlogo-online
 lernstick-xsane
 lernstick-xscreensaver
-#lernstick-zenmap
+lernstick-zenmap
 lernstick-zynaddsubfx
 #tuxedo-wmi-dkms
-#xlogo-ide
diff --git a/config/package-lists/lernstick-standard.list.chroot b/config/package-lists/lernstick-standard.list.chroot
index e16c333e..bf044eab 100644
--- a/config/package-lists/lernstick-standard.list.chroot
+++ b/config/package-lists/lernstick-standard.list.chroot
@@ -1,51 +1,21 @@
 bluej
-#gdevelop
 geogebra5
 geogebra6
 lernstick-bluej
 lernstick-colobot
-lernstick-gimp
 #lernstick-gimp-draw-arrow-plugin
 lernstick-greenfoot
 lernstick-kstars
 lernstick-languagetool-server
-#lernstick-minetest-game-carbone-ng
-lernstick-minetest-game-tutorial
-#lernstick-minetest-mod-dreambuilder
 lernstick-playonlinux
 lernstick-stellarium
 lernstick-tuxpaint
-#lernstick-virtualbox
+lernstick-virtualbox
 lernstick-wine
 lernstick-winetricks
-libreoffice-kf5
+libreoffice-kf6
 libreoffice-plasma
 live-enigma
-minetest-mod-3d-armor
-minetest-mod-basic-materials
-minetest-mod-character-creator
-minetest-mod-craftguide
-#minetest-mod-currency
-minetest-mod-ethereal
-minetest-mod-homedecor
-minetest-mod-infinite-chest
-minetest-mod-lucky-block
-minetest-mod-maidroid
-minetest-mod-mesecons
-minetest-mod-meshport
-minetest-mod-moreblocks
-minetest-mod-moreores
-minetest-mod-nether
-minetest-mod-pipeworks
-minetest-mod-protector
-minetest-mod-quartz
-minetest-mod-skyblock
-minetest-mod-throwing-arrows
-minetest-mod-unifieddyes
-minetest-mod-unified-inventory
-minetest-mod-worldedit
-#minetest-mod-xdecor in bookworm throws an error message: could not load image "xpanes_space.png"
-#minetest-mod-xdecor
 #omnitux
 #tigerjython
 wine-gecko
diff --git a/config/package-lists/lernstick-xfce.list.chroot b/config/package-lists/lernstick-xfce.list.chroot
index 9585a14a..2b117a72 100644
--- a/config/package-lists/lernstick-xfce.list.chroot
+++ b/config/package-lists/lernstick-xfce.list.chroot
@@ -1,5 +1,6 @@
 lernstick-mousepad
 #lernstick-orage
+lernstick-pavucontrol
 lernstick-ristretto
 lernstick-thunar
 lernstick-thunar-volman
diff --git a/config/package-lists/libreoffice-core.list.chroot b/config/package-lists/libreoffice-core.list.chroot
index 802eeaf4..c1be289a 100644
--- a/config/package-lists/libreoffice-core.list.chroot
+++ b/config/package-lists/libreoffice-core.list.chroot
@@ -44,6 +44,5 @@ libreoffice-style-elementary
 libreoffice-style-karasa-jaga
 libreoffice-style-sifr
 libreoffice-style-sukapura
-#libreoffice-style-tango
 libreoffice-templatepack
 libreoffice-writer
diff --git a/config/package-lists/xfce.list.chroot b/config/package-lists/xfce.list.chroot
index a8881757..70598d6e 100644
--- a/config/package-lists/xfce.list.chroot
+++ b/config/package-lists/xfce.list.chroot
@@ -14,8 +14,8 @@ xfce4-cpugraph-plugin
 xfce4-datetime-plugin
 xfce4-indicator-plugin
 xfce4-mailwatch-plugin
-#xfce4-notes
-#xfce4-notes-plugin
+xfce4-notes
+xfce4-notes-plugin
 xfce4-notifyd
 xfce4-places-plugin
 xfce4-power-manager
@@ -24,7 +24,6 @@ xfce4-sensors-plugin
 xfce4-systemload-plugin
 xfce4-taskmanager
 xfce4-terminal
-#xfce4-volumed
 xfce4-weather-plugin
 xfce4-whiskermenu-plugin
 xfce4-xkb-plugin
diff --git a/functions.sh b/functions.sh
index 9584dd81..c62d8e7a 100755
--- a/functions.sh
+++ b/functions.sh
@@ -43,6 +43,11 @@ cache_cleanup()
 		do
 			BASE_NAME=$(basename ${FILE})
 			PACKAGE_NAME=$(echo ${BASE_NAME} | sed 's/_.*//')
+			if ! ls ${DIR}/${PACKAGE_NAME}_* > /dev/null 2>&1
+			then
+				echo "package $PACKAGE_NAME not found"
+				break
+			fi
 			VERSIONS=$(ls ${DIR}/${PACKAGE_NAME}_*)
 			COUNTER=$(echo ${VERSIONS} | wc -w)
 			if [ ${COUNTER} -gt 1 ]
@@ -77,7 +82,7 @@ build_image()
 	# GRUB
 	GRUB_THEME_DIR="config/includes.binary/boot/grub/themes/lernstick"
 	cp templates/theme.txt ${GRUB_THEME_DIR}
-	sed -i "s|title-text.*|title-text: \"Lernstick Debian 12 (Version ${TODAY})\"|1" \
+	sed -i "s|title-text.*|title-text: \"Lernstick Debian 13 (Version ${TODAY})\"|1" \
 		${GRUB_THEME_DIR}/theme.txt
 
 	# update configuration
@@ -97,10 +102,10 @@ build_image()
 		--chroot-squashfs-compression-level 22 \
 		--chroot-squashfs-compression-type zstd \
 		--debootstrap-options "--include=ca-certificates,openssl" \
-		--distribution bookworm \
+		--distribution trixie \
 		--firmware-chroot false \
 		--iso-volume "lernstick${ISO_SUFFIX} ${TODAY}" \
-		--linux-packages linux-image-6.12.9+bpo \
+		--linux-packages linux-image-6.18.15+deb13 \
 		--mirror-binary ${MIRROR_SYSTEM} \
 		--mirror-binary-security ${MIRROR_SECURITY_SYSTEM} \
 		--mirror-bootstrap ${MIRROR_BUILD} \
@@ -108,11 +113,6 @@ build_image()
 		--source ${SOURCE} \
 		--updates true \
 		--verbose
-		#--linux-packages linux-image-6.1.0-0.deb11.7 \
-		# let's hope that we are no longer encountering machines that just freeze with isohybrid images:
-		# https://lists.debian.org/debian-live/2011/08/msg00144.html
-		# if this is still a problem we need to change back from the default of "iso-hybrid" to plain "iso"
-		# --binary-images iso \
 
 	# build image (and produce a log file)
 	lb build 2>&1 | tee logfile.txt
@@ -120,12 +120,12 @@ build_image()
 	ISO_FILE="live-image-amd64.hybrid.iso"
 	if [ -f ${ISO_FILE} ]
 	then
-		PREFIX="lernstick_debian12${ISO_SUFFIX}_${TODAY}"
+		PREFIX="lernstick_debian13${ISO_SUFFIX}_${TODAY}"
 		IMAGE="${PREFIX}.iso"
 		mv ${ISO_FILE} ${IMAGE}
 		# we must update the zsync file because we renamed the iso file
 		echo "Updating zsync file..." | tee -a logfile.txt
-		rm *.zsync
+		rm -f *.zsync
 		zsyncmake -C ${IMAGE} -u ${IMAGE}
 		echo "Creating MD5 for iso..." | tee -a logfile.txt
 		md5sum ${IMAGE} > ${IMAGE}.md5
@@ -164,7 +164,4 @@ build_image()
 	then
 		mv logfile.txt "${BUILD_DIR}"
 	fi
-
-	# hello, wake up!!! :-)
-	#eject
 }
diff --git a/scripts/create_pbuilder_chroots.sh b/scripts/create_pbuilder_chroots.sh
index 4abf96ec..c77a7ab1 100755
--- a/scripts/create_pbuilder_chroots.sh
+++ b/scripts/create_pbuilder_chroots.sh
@@ -1,18 +1,18 @@
 #!/bin/sh
 
-BIND_MOUNT=/home/debian12/lernstick/backports/bookworm/
-LS_KEYRING=/tmp/lernstick-12.gpg
-OTHER_MIRRORS="deb https://security.debian.org/debian-security bookworm-security main contrib non-free|deb https://packages.lernstick.ch/lernstick lernstick-12-backports main contrib non-free|deb https://packages.lernstick.ch/lernstick lernstick-12-backports-staging main contrib non-free|deb https://packages.lernstick.ch/lernstick lernstick-12-thirdparty-staging main contrib non-free|deb https://packages.lernstick.ch/lernstick lernstick-12-staging main contrib non-free"
+BIND_MOUNT=/home/debian13/lernstick/backports/trixie/
+LS_KEYRING=/tmp/lernstick-13.gpg
+OTHER_MIRRORS="deb https://security.debian.org/debian-security trixie-security main contrib non-free non-free-firmware|deb https://packages.lernstick.ch/lernstick lernstick-13-backports main contrib non-free non-free-firmware|deb https://packages.lernstick.ch/lernstick lernstick-13-backports-staging main contrib non-free non-free-firmware|deb https://packages.lernstick.ch/lernstick lernstick-13-thirdparty-staging main contrib non-free non-free-firmware|deb https://packages.lernstick.ch/lernstick lernstick-13-staging main contrib non-free non-free-firmware"
 
 # pbuilder needs the "dearmored" version of our keyfile
-gpg --yes --output $LS_KEYRING --dearmor $(dirname $0)/../config/archives/lernstick-12.key
+gpg --yes --output $LS_KEYRING --dearmor $(dirname $0)/../config/archives/lernstick-13.key
 
 # main version (Bullseye 64 Bit)
 pbuilder create \
-	--basetgz /var/cache/pbuilder/base-bookworm-bpo.tar.gz \
+	--basetgz /var/cache/pbuilder/base-trixie-bpo.tar.gz \
 	--bindmounts $BIND_MOUNT \
 	--components "main contrib non-free non-free-firmware" \
-	--distribution bookworm \
+	--distribution trixie \
 	--extrapackages ca-certificates \
 	--keyring $LS_KEYRING \
 	--othermirror "$OTHER_MIRRORS"
@@ -20,10 +20,10 @@ pbuilder create \
 # second version for backporting 32 Bit packages (e.g. wine)
 pbuilder create \
 	--architecture i386 \
-	--basetgz /var/cache/pbuilder/base-bookworm32-bpo.tar.gz \
+	--basetgz /var/cache/pbuilder/base-trixie32-bpo.tar.gz \
 	--bindmounts $BIND_MOUNT \
 	--components "main contrib non-free non-free-firmware" \
-	--distribution bookworm \
+	--distribution trixie \
 	--extrapackages ca-certificates \
 	--keyring $LS_KEYRING \
 	--othermirror "$OTHER_MIRRORS"
diff --git a/templates/proxam-moodle-rdp/lernstickWelcome b/templates/proxam-moodle-rdp/lernstickWelcome
new file mode 100644
index 00000000..9224ecd2
--- /dev/null
+++ b/templates/proxam-moodle-rdp/lernstickWelcome
@@ -0,0 +1,4 @@
+AutoStartInstaller=false
+ShowNotUsedInfo=false
+ShowReadOnlyInfo=false
+SearchExamServer=false
\ No newline at end of file
diff --git a/templates/proxam-moodle-rdp/proxam-download-files b/templates/proxam-moodle-rdp/proxam-download-files
new file mode 100644
index 00000000..e3e80a7a
--- /dev/null
+++ b/templates/proxam-moodle-rdp/proxam-download-files
@@ -0,0 +1,147 @@
+#!/bin/bash
+# Download approved student files from the ProXam backend to ~/Desktop/Exam-Files/.
+# Authenticates via Moodle credentials OR email+token through the student portal API.
+#
+# Usage: proxam-download-files --moodle <username> <password>
+#        proxam-download-files --token <email> <token>
+#
+# Requires: curl, jq
+# API:
+#   POST /student/auth                             → {token (JWT), tickets[{token, exam}]}
+#   POST /student/auth/token                       → {token (JWT), tickets[{token, exam}]}
+#   GET  /proxam/ticket/student-files/:token       → [{id, filename, size, mimeType}]
+#   GET  /proxam/ticket/student-files/:token/:fileId → file download
+
+set -e
+
+CONFIG_FILE="/etc/proxam-moodle-rdp.conf"
+API_URL=""
+
+if [ -f "${CONFIG_FILE}" ]; then
+	. "${CONFIG_FILE}"
+fi
+
+: "${API_URL:=https://api.proxam.at}"
+
+MODE="${1}"
+ARG1="${2}"
+ARG2="${3}"
+DEST_DIR="${HOME}/Desktop/Exam-Files"
+
+case "${MODE}" in
+	--moodle)
+		if [ -z "${ARG1}" ] || [ -z "${ARG2}" ]; then
+			echo "Usage: proxam-download-files --moodle <username> <password>" >&2
+			exit 1
+		fi
+		AUTH_RESPONSE="$(curl -sf --max-time 15 \
+			-X POST \
+			-H "Content-Type: application/json" \
+			-d "$(jq -n --arg u "${ARG1}" --arg p "${ARG2}" \
+				'{username: $u, password: $p}')" \
+			"${API_URL}/student/auth")" || {
+			echo "ERROR: Authentication failed. Check your Moodle username and password." >&2
+			exit 1
+		}
+		;;
+	--token)
+		if [ -z "${ARG1}" ] || [ -z "${ARG2}" ]; then
+			echo "Usage: proxam-download-files --token <email> <token>" >&2
+			exit 1
+		fi
+		AUTH_RESPONSE="$(curl -sf --max-time 15 \
+			-X POST \
+			-H "Content-Type: application/json" \
+			-d "$(jq -n --arg e "${ARG1}" --arg t "${ARG2}" \
+				'{email: $e, token: $t}')" \
+			"${API_URL}/student/auth/token")" || {
+			echo "ERROR: Authentication failed. Check your email and token." >&2
+			exit 1
+		}
+		;;
+	*)
+		# Legacy: positional args = Moodle mode
+		USERNAME="${MODE}"
+		PASSWORD="${ARG1}"
+		if [ -z "${USERNAME}" ] || [ -z "${PASSWORD}" ]; then
+			echo "Usage: proxam-download-files --moodle <username> <password>" >&2
+			echo "       proxam-download-files --token <email> <token>" >&2
+			exit 1
+		fi
+		AUTH_RESPONSE="$(curl -sf --max-time 15 \
+			-X POST \
+			-H "Content-Type: application/json" \
+			-d "$(jq -n --arg u "${USERNAME}" --arg p "${PASSWORD}" \
+				'{username: $u, password: $p}')" \
+			"${API_URL}/student/auth")" || {
+			echo "ERROR: Authentication failed. Check your Moodle username and password." >&2
+			exit 1
+		}
+		;;
+esac
+
+# Check for error in response.
+AUTH_ERROR="$(echo "${AUTH_RESPONSE}" | jq -r '.message // empty')"
+if [ -n "${AUTH_ERROR}" ]; then
+	echo "ERROR: ${AUTH_ERROR}" >&2
+	exit 1
+fi
+
+FULLNAME="$(echo "${AUTH_RESPONSE}" | jq -r '.fullname // "Student"')"
+echo "Logged in as: ${FULLNAME}"
+
+# Extract all ticket tokens.
+TICKETS="$(echo "${AUTH_RESPONSE}" | jq -c '.tickets[]')"
+if [ -z "${TICKETS}" ]; then
+	echo "No exam tickets found for your account."
+	exit 0
+fi
+
+mkdir -p "${DEST_DIR}"
+TOTAL_DOWNLOADED=0
+
+# For each ticket, download approved files into an exam subfolder.
+echo "${TICKETS}" | while IFS= read -r TICKET; do
+	TICKET_TOKEN="$(echo "${TICKET}" | jq -r '.token')"
+	EXAM_NAME="$(echo "${TICKET}" | jq -r '.exam.name // "Exam"')"
+
+	# Fetch file list for this ticket.
+	FILE_LIST="$(curl -sf --max-time 15 \
+		"${API_URL}/proxam/ticket/student-files/${TICKET_TOKEN}")" || continue
+
+	COUNT="$(echo "${FILE_LIST}" | jq 'length')"
+	if [ "${COUNT}" -eq 0 ]; then
+		continue
+	fi
+
+	# Sanitize exam name for directory.
+	SAFE_EXAM="$(echo "${EXAM_NAME}" | tr -cs '[:alnum:] ._-' '_' | head -c 100)"
+	EXAM_DIR="${DEST_DIR}/${SAFE_EXAM}"
+	mkdir -p "${EXAM_DIR}"
+
+	echo "Exam: ${EXAM_NAME} — ${COUNT} file(s)"
+
+	echo "${FILE_LIST}" | jq -c '.[]' | while IFS= read -r ENTRY; do
+		FILE_ID="$(echo "${ENTRY}" | jq -r '.id')"
+		FILENAME="$(echo "${ENTRY}" | jq -r '.filename')"
+		SIZE="$(echo "${ENTRY}" | jq -r '.size')"
+
+		# Sanitize filename to prevent directory traversal.
+		SAFE_NAME="$(basename "${FILENAME}")"
+		if [ -z "${SAFE_NAME}" ] || [ "${SAFE_NAME}" = "." ] || [ "${SAFE_NAME}" = ".." ]; then
+			SAFE_NAME="file_${FILE_ID}"
+		fi
+
+		echo "  → ${SAFE_NAME} (${SIZE} bytes)"
+
+		if curl -sf --max-time 120 \
+			-o "${EXAM_DIR}/${SAFE_NAME}" \
+			"${API_URL}/proxam/ticket/student-files/${TICKET_TOKEN}/${FILE_ID}"; then
+			TOTAL_DOWNLOADED=$((TOTAL_DOWNLOADED + 1))
+		else
+			echo "    FAILED to download ${SAFE_NAME}" >&2
+		fi
+	done
+done
+
+echo "Done. Files saved to ${DEST_DIR}"
diff --git a/templates/proxam-moodle-rdp/proxam-firewall-whitelist.conf b/templates/proxam-moodle-rdp/proxam-firewall-whitelist.conf
new file mode 100644
index 00000000..4f0f18a7
--- /dev/null
+++ b/templates/proxam-moodle-rdp/proxam-firewall-whitelist.conf
@@ -0,0 +1,12 @@
+# ProXam platform whitelist for lernstick-firewall (Squid proxy).
+# Format: ^proto://host
+
+# Public marketing website.
+^https://proxam\.at
+^https://www\.proxam\.at
+
+# Moodle instance used for exam access.
+^https://moodle\.proxam\.at
+
+# ProXam backend API and student/admin endpoints.
+^https://api\.proxam\.at
\ No newline at end of file
diff --git a/templates/proxam-moodle-rdp/proxam-moodle-rdp-launcher b/templates/proxam-moodle-rdp/proxam-moodle-rdp-launcher
new file mode 100644
index 00000000..644da6e6
--- /dev/null
+++ b/templates/proxam-moodle-rdp/proxam-moodle-rdp-launcher
@@ -0,0 +1,167 @@
+#!/bin/bash
+
+set -e
+
+CONFIG_FILE="/etc/proxam-moodle-rdp.conf"
+MOODLE_URL=""
+REMMINA_PROFILE=""
+
+if [ -f "${CONFIG_FILE}" ]
+then
+	. "${CONFIG_FILE}"
+fi
+
+DOWNLOAD_DIR="${HOME}/Desktop/Exam-Files"
+
+ask_moodle_credentials()
+{
+	# Returns "username|password" or empty on cancel.
+	CREDENTIALS="$(zenity --forms \
+		--title="Moodle Login" \
+		--text="Enter your Moodle credentials to download exam files." \
+		--add-entry="Username" \
+		--add-password="Password" \
+		--separator="|" \
+		--width=420)" || true
+	echo "${CREDENTIALS}"
+}
+
+ask_token_credentials()
+{
+	# Returns "email|token" or empty on cancel.
+	CREDENTIALS="$(zenity --forms \
+		--title="Token Login" \
+		--text="Enter your email and exam token." \
+		--add-entry="E-Mail" \
+		--add-entry="Token" \
+		--separator="|" \
+		--width=420)" || true
+	echo "${CREDENTIALS}"
+}
+
+open_moodle()
+{
+	if [ -z "${MOODLE_URL}" ]
+	then
+		zenity --error \
+			--title="Moodle URL missing" \
+			--text="Set MOODLE_URL in /etc/proxam-moodle-rdp.conf before starting the exam browser."
+		return
+	fi
+
+	firefox-esr --kiosk "${MOODLE_URL}" &
+	wait $! || true
+}
+
+open_remote_desktop()
+{
+	if [ -n "${REMMINA_PROFILE}" ] && [ -f "${REMMINA_PROFILE}" ]
+	then
+		remmina -c "${REMMINA_PROFILE}" &
+	else
+		remmina &
+	fi
+
+	wait $! || true
+}
+
+download_files()
+{
+	AUTH_MODE="$(zenity --list \
+		--title="Download Exam Files" \
+		--text="How do you want to log in?" \
+		--column="Method" \
+		"Moodle Login" \
+		"Email + Token" \
+		--height=220 \
+		--width=380)" || return
+
+	case "${AUTH_MODE}" in
+		"Moodle Login")
+			CREDENTIALS="$(ask_moodle_credentials)"
+			if [ -z "${CREDENTIALS}" ]; then return; fi
+			USERNAME="$(echo "${CREDENTIALS}" | cut -d'|' -f1)"
+			PASSWORD="$(echo "${CREDENTIALS}" | cut -d'|' -f2)"
+			if [ -z "${USERNAME}" ] || [ -z "${PASSWORD}" ]; then
+				zenity --error --title="Login Error" --text="Username and password are required." --width=380
+				return
+			fi
+			OUTPUT="$(proxam-download-files --moodle "${USERNAME}" "${PASSWORD}" 2>&1)" || true
+			;;
+		"Email + Token")
+			CREDENTIALS="$(ask_token_credentials)"
+			if [ -z "${CREDENTIALS}" ]; then return; fi
+			EMAIL="$(echo "${CREDENTIALS}" | cut -d'|' -f1)"
+			TOKEN="$(echo "${CREDENTIALS}" | cut -d'|' -f2)"
+			if [ -z "${EMAIL}" ] || [ -z "${TOKEN}" ]; then
+				zenity --error --title="Login Error" --text="Email and token are required." --width=380
+				return
+			fi
+			OUTPUT="$(proxam-download-files --token "${EMAIL}" "${TOKEN}" 2>&1)" || true
+			;;
+		*)
+			return
+			;;
+	esac
+
+	if [ -d "${DOWNLOAD_DIR}" ] && [ "$(ls -A "${DOWNLOAD_DIR}" 2>/dev/null)" ]
+	then
+		zenity --info \
+			--title="Download Complete" \
+			--text="Files saved to:\n${DOWNLOAD_DIR}\n\n${OUTPUT}" \
+			--width=480
+		# Open the file manager at the download directory.
+		nautilus "${DOWNLOAD_DIR}" &
+	else
+		zenity --warning \
+			--title="No Files" \
+			--text="${OUTPUT:-No approved files found or download failed.}" \
+			--width=480
+	fi
+}
+
+open_file_manager()
+{
+	if [ -d "${DOWNLOAD_DIR}" ]
+	then
+		nautilus "${DOWNLOAD_DIR}" &
+	else
+		nautilus "${HOME}/Desktop" &
+	fi
+}
+
+while true
+do
+	CHOICE="$(zenity --list \
+		--title="Exam Launcher" \
+		--text="Select the application you want to use." \
+		--column="Application" \
+		"Moodle Exam" \
+		"Download Exam Files" \
+		"Open Files" \
+		"Windows Remote Desktop" \
+		"Quit" \
+		--height=340 \
+		--width=420)" || exit 0
+
+	case "${CHOICE}" in
+		"Moodle Exam")
+			open_moodle
+			;;
+		"Download Exam Files")
+			download_files
+			;;
+		"Open Files")
+			open_file_manager
+			;;
+		"Windows Remote Desktop")
+			open_remote_desktop
+			;;
+		"Quit")
+			exit 0
+			;;
+		*)
+			exit 0
+			;;
+	esac
+done
\ No newline at end of file
diff --git a/templates/proxam-moodle-rdp/proxam-moodle-rdp.conf b/templates/proxam-moodle-rdp/proxam-moodle-rdp.conf
new file mode 100644
index 00000000..9350e203
--- /dev/null
+++ b/templates/proxam-moodle-rdp/proxam-moodle-rdp.conf
@@ -0,0 +1,8 @@
+# Moodle page opened by the launcher in kiosk mode.
+MOODLE_URL="https://moodle.proxam.at"
+
+# ProXam backend API URL for file downloads.
+API_URL="https://api.proxam.at"
+
+# Optional Remmina profile. Leave empty to open the normal connection manager.
+REMMINA_PROFILE=""
\ No newline at end of file
diff --git a/templates/proxam-moodle-rdp/proxam-moodle-rdp.desktop b/templates/proxam-moodle-rdp/proxam-moodle-rdp.desktop
new file mode 100644
index 00000000..61fcc556
--- /dev/null
+++ b/templates/proxam-moodle-rdp/proxam-moodle-rdp.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Version=1.0
+Name=Exam Launcher
+Comment=Open Moodle in kiosk mode or start Windows Remote Desktop
+Exec=/usr/local/bin/proxam-moodle-rdp-launcher
+Terminal=false
+Categories=Education;Network;
+X-GNOME-Autostart-enabled=true
\ No newline at end of file
diff --git a/templates/xmlboot.config b/templates/xmlboot.config
index 25d67ca8..af57a915 100644
--- a/templates/xmlboot.config
+++ b/templates/xmlboot.config
@@ -251,7 +251,7 @@
     <layout width="800" height="600" x="40" y="160" font="font_size_15.fnt"/>
   </timeout>
   <system>
-    <text>Lernstick Debian 12</text>
+    <text>Lernstick Debian 13</text>
     <version its:translate="no">(Version YYYY-MM-DD)</version>
     <layout width="1366" height="768" x="60" y="745" font="font_size_10.fnt"/>
     <layout width="1280" height="1024" x="66" y="1000" font="font_size_15.fnt"/>