diff --git a/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh b/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh
new file mode 100755
index 0000000..6fb8cdb
--- /dev/null
+++ b/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Builder artifact dirs + docker CLI home for PHP-FPM (often user=nobody, HOME=/).
+#
+# Usage (on app node as root):
+#   sudo ./prepare-be-builder-dirs.sh
+set -euo pipefail
+
+BROADCAST_ROOT="${1:-/var/www/ac/broadcast}"
+BUILDS="${BROADCAST_ROOT}/builds"
+DOCKER_HOME="${BROADCAST_ROOT}"
+DOWNLOADS="${2:-/var/www/localhost/htdocs/apps/app/androidcast_project/downloads}"
+OTA_ROOT="${3:-/var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts}"
+
+mkdir -p "${BUILDS}" "${DOCKER_HOME}/.docker" "${DOWNLOADS}" "${OTA_ROOT}/v0/ota/channel"
+chown -R nginx:nginx "${BROADCAST_ROOT}" "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
+chmod -R 775 "${BUILDS}" "${DOCKER_HOME}/.docker" "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
+
+# PHP-FPM www pool is often nobody; builds run as that user.
+if getent group docker >/dev/null 2>&1; then
+  usermod -aG docker nobody 2>/dev/null || true
+fi
+chown nobody:nobody "${DOCKER_HOME}/.docker" 2>/dev/null || true
+chmod 775 "${DOCKER_HOME}/.docker" 2>/dev/null || true
+
+echo "Builder dirs ready:"
+echo "  artifacts: ${BUILDS}"
+echo "  docker home: ${DOCKER_HOME}/.docker (for nobody + nginx)"
+echo "  downloads: ${DOWNLOADS}"
+echo "  ota mount: ${OTA_ROOT}"
diff --git a/sim/cluster0/scripts/compose-lab-backend.sh b/sim/cluster0/scripts/compose-lab-backend.sh
index 2c47690..8ce6ba5 100755
--- a/sim/cluster0/scripts/compose-lab-backend.sh
+++ b/sim/cluster0/scripts/compose-lab-backend.sh
@@ -138,6 +138,7 @@ overlay_lab_seed_api() {
   fi
 }
 overlay_lab_seed_api media_pipelines.php
+overlay_lab_seed_api grafana-auth-check.php
 
 overlay_lab_seed_public() {
   _rel="$1"
@@ -363,6 +364,7 @@ $config['build'] = array_merge([
     'ci_version' => '00.01.00.1000',
     'repo_root' => '/var/www/ac/workspace',
     'artifacts_root' => '/var/www/ac/broadcast/builds',
+    'docker_home' => '/var/www/ac/broadcast',
     'ota_mount' => '/var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts',
     'downloads_mount' => '/var/www/localhost/htdocs/apps/app/androidcast_project/downloads',
     'ota_base_url' => 'https://apps.f0xx.org',
diff --git a/sim/cluster0/scripts/deploy-hub-downloads.sh b/sim/cluster0/scripts/deploy-hub-downloads.sh
index d4914c2..14de557 100644
--- a/sim/cluster0/scripts/deploy-hub-downloads.sh
+++ b/sim/cluster0/scripts/deploy-hub-downloads.sh
@@ -20,9 +20,9 @@ else
   log "WARN: Session Studio jar not built at ${STUDIO_JAR}"
 fi
 
-# Prefer staging channel APK; fall back to stable.
+# Prefer nightly (latest CI), then staging, then stable.
 apk_src=""
-for ch in staging stable; do
+for ch in nightly staging stable; do
   channel_json="${OTA_ROOT}/channel/${ch}.json"
   [ -f "$channel_json" ] || continue
   manifest_url="$(sed -n 's/.*"manifestUrl"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$channel_json" | head -1)"
@@ -54,7 +54,7 @@ if [ -n "$apk_src" ]; then
   install -m 644 "$apk_src" "${DOWNLOADS_ROOT}/${base}.apk"
   log "installed APK → ${DOWNLOADS_ROOT}/android_cast-latest.apk (from ${apk_src})"
 else
-  log "WARN: no OTA .apk/.otapkg found under ${OTA_ROOT}/channel/{staging,stable}.json"
+  log "WARN: no OTA .apk/.otapkg found under ${OTA_ROOT}/channel/{nightly,staging,stable}.json"
 fi
 
 chown -R nginx:nginx "$DOWNLOADS_ROOT" 2>/dev/null || true