diff --git a/.gitignore b/.gitignore
index 444527a..e934dac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,10 @@ public/
 _import/
 docs/superpowers/
 
+# synced from node_modules/medium-zoom by scripts/sync-vendor-assets.js
+# (see the preantora/preantora-local npm scripts)
+ui/supplemental/js/vendor/
+
 # macOS and IDEs
 .DS_Store
 .vscode/
diff --git a/AGENTS.md b/AGENTS.md
index 12ebea3..82dfef7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,7 +21,8 @@ This is the consolidated documentation **monorepo**. It supersedes the previous
 - `ui/supplemental/` -- supplemental files layered onto the stock Antora default UI
 - `global-attributes.yml` -- site-wide AsciiDoc attributes
 - `sync/` -- the retired upstream import tooling (`manifest.yml`, `patches/`); kept for provenance
-- `test/` -- Node test suite
+- `extension-tests/` -- Node test suite
+- `scripts/` -- one-off build helpers (e.g. `sync-vendor-assets.js`, wired as `preantora`/`preantora-local`)
 - `package.json` -- npm scripts
 
 ## Development Conventions
diff --git a/README.md b/README.md
index 66d504c..10a0f05 100644
--- a/README.md
+++ b/README.md
@@ -33,8 +33,10 @@ antora-extensions/       comp-version, latest/next-alias, sitemap-cleanup, globa
 asciidoc-extensions/     tabs, remote-include
 global-attributes.yml    site-wide AsciiDoc attributes (local)
 ui/supplemental/         branding + Pagefind modal search on the stock UI
+ui/supplemental/js/vendor/ gitignored; synced from node_modules by scripts/sync-vendor-assets.js
 content/<product>/<ver>/ each version is a folder with its own antora.yml
 sync/                    retired upstream-mirror tooling, kept as provenance
+scripts/                 build-time helpers (npm `pre*` hooks), e.g. sync-vendor-assets.js
 .github/workflows/ci.yml build → pagefind → deploy to GitHub Pages
 ```
 
diff --git a/extension-tests/latest-alias.test.js b/extension-tests/latest-alias.test.js
index fe2a97e..bbef299 100644
--- a/extension-tests/latest-alias.test.js
+++ b/extension-tests/latest-alias.test.js
@@ -10,7 +10,7 @@ const assert = require('node:assert/strict')
 const fs = require('node:fs')
 const path = require('node:path')
 
-const { latestByComponent } = require('./helpers/latest-versions')
+const { latestByComponent } = require('./latest-versions')
 
 const PUBLIC = path.join(__dirname, '..', 'public')
 
diff --git a/extension-tests/latest-versions.js b/extension-tests/latest-versions.js
index 2ca17da..d0c4496 100644
--- a/extension-tests/latest-versions.js
+++ b/extension-tests/latest-versions.js
@@ -15,7 +15,7 @@
 const fs = require('node:fs')
 const path = require('node:path')
 
-const CONTENT = path.join(__dirname, '..', '..', 'content')
+const CONTENT = path.join(__dirname, '..', 'content')
 
 // Numeric, segment-wise ascending compare ('10.16' > '10.9', not the string order).
 function compareVersions (a, b) {
diff --git a/extension-tests/next-alias.test.js b/extension-tests/next-alias.test.js
index bb45647..ecb6b1d 100644
--- a/extension-tests/next-alias.test.js
+++ b/extension-tests/next-alias.test.js
@@ -16,7 +16,7 @@ const assert = require('node:assert/strict')
 const fs = require('node:fs')
 const path = require('node:path')
 
-const { latestByComponent, nextTargetByComponent } = require('./helpers/latest-versions')
+const { latestByComponent, nextTargetByComponent } = require('./latest-versions')
 
 const PUBLIC = path.join(__dirname, '..', 'public')
 
diff --git a/extension-tests/page-aliases.test.js b/extension-tests/page-aliases.test.js
index e656325..9da671f 100644
--- a/extension-tests/page-aliases.test.js
+++ b/extension-tests/page-aliases.test.js
@@ -80,6 +80,12 @@ test('the relocated ocis security page keeps its old URL alive', (t) => {
   const broken = []
   for (const { file } of aliased) {
     const version = file.split('/')[2]
+    // site.yml names rendered ocis versions explicitly (not a `content/ocis/*`
+    // glob) and its own comment says an unlisted version folder "could safely be
+    // deleted if outdated" -- content/ocis/8.0 is exactly that: on disk, never
+    // rendered. Skip versions this build didn't publish at all instead of
+    // flagging them as a broken alias.
+    if (!fs.existsSync(path.join(PUBLIC, 'ocis', version))) continue
     const stub = path.join(PUBLIC, 'ocis', version, 'security', 'security.html')
     if (!fs.existsSync(stub)) {
       broken.push(`ocis/${version}/security/security.html is missing`)
diff --git a/extension-tests/static-files.test.js b/extension-tests/static-files.test.js
index 5581417..4ef53f9 100644
--- a/extension-tests/static-files.test.js
+++ b/extension-tests/static-files.test.js
@@ -14,7 +14,7 @@ const assert = require('node:assert/strict')
 const fs = require('node:fs')
 const path = require('node:path')
 
-const { latestByComponent } = require('./helpers/latest-versions')
+const { latestByComponent } = require('./latest-versions')
 
 const ROOT = path.join(__dirname, '..')
 const PUBLIC = path.join(ROOT, 'public')
@@ -213,3 +213,21 @@ test('root static files are not published under the UI output dir', (t) => {
   // ui.yml is consumed by the UI loader; it must never be published itself.
   assert.ok(!fs.existsSync(path.join(PUBLIC, 'assets', 'ui.yml')), 'ui.yml leaked into the build output')
 })
+
+test('the medium-zoom vendor bundle synced from node_modules is published', (t) => {
+  if (!fs.existsSync(path.join(PUBLIC, 'index.html'))) {
+    t.skip('public/ not built (run `npm run antora` to enable)')
+    return
+  }
+  // ui/supplemental/js/vendor/ is gitignored and repopulated from node_modules by
+  // scripts/sync-vendor-assets.js (wired as preantora/preantora-local). Every
+  // page still references js/vendor/medium-zoom.min.js regardless, so a build
+  // that skips that step (e.g. `npx antora` directly) publishes green with a
+  // 404'ing <script> and dead image zoom -- this guard fails loudly instead.
+  for (const name of ['medium-zoom.min.js', 'LICENSE-medium-zoom.txt']) {
+    assert.ok(
+      fs.existsSync(path.join(PUBLIC, 'assets/js/vendor', name)),
+      `assets/js/vendor/${name} is missing -- did the build run through \`npm run antora\` (not \`npx antora\` directly), so preantora's sync-vendor-assets.js had a chance to run?`
+    )
+  }
+})
diff --git a/package-lock.json b/package-lock.json
index 00e7083..cc6b920 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,8 @@
         "antora": "^3.2.0",
         "asciidoctor": "^4.0.11",
         "asciidoctor-kroki": "^1.0.1",
-        "js-yaml": "^5.4.1"
+        "js-yaml": "^5.4.1",
+        "medium-zoom": "^1.1.0"
       },
       "devDependencies": {
         "@sntke/antora-mermaid-extension": "^0.0.13",
@@ -1476,6 +1477,12 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/medium-zoom": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/medium-zoom/-/medium-zoom-1.1.0.tgz",
+      "integrity": "sha512-ewyDsp7k4InCUp3jRmwHBRFGyjBimKps/AJLjRSox+2q/2H4p/PNpQf+pwONWlJiOudkBXtbdmVbFjqyybfTmQ==",
+      "license": "MIT"
+    },
     "node_modules/merge2": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
diff --git a/package.json b/package.json
index 6b7755c..881d5ea 100644
--- a/package.json
+++ b/package.json
@@ -4,18 +4,21 @@
   "homepage": "https://github.com/owncloud/docs.owncloud.com#readme",
   "license": "AGPL-3.0-or-later",
   "scripts": {
+    "preantora": "node scripts/sync-vendor-assets.js",
     "antora": "antora --stacktrace site.yml",
+    "preantora-local": "node scripts/sync-vendor-assets.js",
     "antora-local": "antora --stacktrace --url http://localhost:8080 site.yml",
     "pagefind": "pagefind --site public",
     "build": "npm run antora && npm run pagefind",
-    "test": "node --test test/*.test.js",
+    "test": "node --test extension-tests/*.test.js",
     "serve": "http-server public/ -d -i"
   },
   "dependencies": {
     "antora": "^3.2.0",
     "asciidoctor": "^4.0.11",
     "asciidoctor-kroki": "^1.0.1",
-    "js-yaml": "^5.4.1"
+    "js-yaml": "^5.4.1",
+    "medium-zoom": "^1.1.0"
   },
   "devDependencies": {
     "@sntke/antora-mermaid-extension": "^0.0.13",
diff --git a/scripts/sync-vendor-assets.js b/scripts/sync-vendor-assets.js
new file mode 100644
index 0000000..ca8ebe9
--- /dev/null
+++ b/scripts/sync-vendor-assets.js
@@ -0,0 +1,34 @@
+'use strict'
+
+// Copies prebuilt browser bundles out of node_modules into the Antora UI
+// supplemental tree. ui/supplemental is layered onto the stock UI bundle as
+// plain files (site.yml ui.supplemental_files) -- there is no bundler step of
+// our own -- so real npm dependencies (tracked in package.json/package-lock.json,
+// and by Dependabot) still need their browser build placed on disk before
+// Antora runs. Wired up as `preantora`/`preantora-local` in package.json.
+//
+// To vendor another package's browser build the same way, add an entry below
+// rather than writing a new script.
+const VENDOR_FILES = [
+  { package: 'medium-zoom', src: 'dist/medium-zoom.min.js', dest: 'js/vendor/medium-zoom.min.js' },
+  { package: 'medium-zoom', src: 'LICENSE', dest: 'js/vendor/LICENSE-medium-zoom.txt' },
+]
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const ROOT = path.join(__dirname, '..')
+const VENDOR_DIR = path.join(ROOT, 'ui/supplemental/js/vendor')
+
+// Wiped and repopulated on every run (this directory only ever holds files this
+// script manages -- see the .gitignore entry), so dropping an entry from
+// VENDOR_FILES actually removes the stale file instead of leaving it on disk
+// for any local checkout or reused CI workspace that copied it in previously.
+fs.rmSync(VENDOR_DIR, { recursive: true, force: true })
+
+for (const { package: pkg, src, dest } of VENDOR_FILES) {
+  const from = path.join(ROOT, 'node_modules', pkg, src)
+  const to = path.join(ROOT, 'ui/supplemental', dest)
+  fs.mkdirSync(path.dirname(to), { recursive: true })
+  fs.copyFileSync(from, to)
+}
diff --git a/ui/supplemental/css/medium-zoom.css b/ui/supplemental/css/medium-zoom.css
new file mode 100644
index 0000000..52fbeab
--- /dev/null
+++ b/ui/supplemental/css/medium-zoom.css
@@ -0,0 +1,21 @@
+/*
+ * medium-zoom (js/vendor/medium-zoom.min.js) injects its own stylesheet for the
+ * overlay and the zoom transition, but that stylesheet sets no stacking order.
+ * The stock Antora default UI goes up to z-index 4 (navbar, toolbar), so without
+ * this the navbar would sit on top of the zoomed image and its backdrop.
+ *
+ * `body >` on the overlay bumps our specificity above the library's own
+ * `.medium-zoom-overlay` rule, so we stay correct even if a future release adds
+ * a z-index there (it injects its <style> after this stylesheet, so a plain
+ * class-vs-class tie would otherwise go to source order, i.e. to them).
+ *
+ * `--opened` (not the bare `medium-zoom-image` class) targets only the zoomed
+ * clone medium-zoom appends to <body>: the bare class stays on every bound
+ * image for as long as it's attached, so using it here would promote every
+ * doc image on the page to z-index 1000 the moment anything gives one
+ * `position: relative/absolute/sticky` (a caption overlay, a figure badge).
+ */
+body > .medium-zoom-overlay,
+img.medium-zoom-image--opened {
+  z-index: 1000;
+}
diff --git a/ui/supplemental/js/medium-zoom-init.js b/ui/supplemental/js/medium-zoom-init.js
new file mode 100644
index 0000000..11c5349
--- /dev/null
+++ b/ui/supplemental/js/medium-zoom-init.js
@@ -0,0 +1,19 @@
+/*
+ * Click-to-zoom for images, restoring the behavior the retired custom UI
+ * (docs-ui) provided via its webpack-bundled `js/vendor/medium-zoom.js`.
+ *
+ * Binds medium-zoom to every image Asciidoctor emits:
+ *   span.image img     -- inline images (`image:file[]`)
+ *   div.imageblock img -- block images (`image::file[]`), including svg
+ * With that, no `role` or attribute is needed in the page source: all images
+ * are zoomable.
+ *
+ * Loaded with `defer` after js/vendor/medium-zoom.min.js so the global is in
+ * place -- deferred external scripts execute in document order.
+ */
+;(function () {
+  'use strict'
+
+  if (typeof window.mediumZoom !== 'function') return
+  window.mediumZoom('span.image img, div.imageblock img', { background: '#fff', margin: 10 })
+})()
diff --git a/ui/supplemental/partials/footer-scripts.hbs b/ui/supplemental/partials/footer-scripts.hbs
index a394ab1..a26ba3d 100644
--- a/ui/supplemental/partials/footer-scripts.hbs
+++ b/ui/supplemental/partials/footer-scripts.hbs
@@ -6,3 +6,8 @@
 {{!-- Companion behavior for the AsciiDoc tabs extension (asciidoc-extensions/tabs.js):
       removes the is-loading fallback and wires tab switching. --}}
 <script src="{{{uiRootPath}}}/js/tabs.js"></script>
+{{!-- Click-to-zoom for images. `defer` on both (not `async`) because the init
+      script needs the global the vendored library defines, and deferred external
+      scripts run in document order. --}}
+<script defer src="{{{uiRootPath}}}/js/vendor/medium-zoom.min.js"></script>
+<script defer src="{{{uiRootPath}}}/js/medium-zoom-init.js"></script>
diff --git a/ui/supplemental/partials/head-styles.hbs b/ui/supplemental/partials/head-styles.hbs
index 81a5081..36d97e8 100644
--- a/ui/supplemental/partials/head-styles.hbs
+++ b/ui/supplemental/partials/head-styles.hbs
@@ -2,3 +2,4 @@
     <link rel="stylesheet" href="{{{siteRootPath}}}/pagefind/pagefind-component-ui.css">
     <link rel="stylesheet" href="{{{uiRootPath}}}/css/owncloud.css">
     <link rel="stylesheet" href="{{{uiRootPath}}}/css/tabs.css">
+    <link rel="stylesheet" href="{{{uiRootPath}}}/css/medium-zoom.css">