diff --git a/e2e-server/src/main.ts b/e2e-server/src/main.ts
index 87839d1..bc35444 100644
--- a/e2e-server/src/main.ts
+++ b/e2e-server/src/main.ts
@@ -5,7 +5,9 @@
 
 // The built package rather than the source: the point of this harness is
 // that what gets published works on a real server, and the source needs
-// build-time defines that only the library's own config supplies.
+// build-time defines that only the library's own config supplies. It is
+// built under a version above any release (see build:e2e-app), as the
+// server bundles a copy of its own and the newest one is the page's viewer.
 import { registerDefaultHandlers } from '../../dist/index.mjs'
 
 // What a host app does, and nothing more: the point of the harness is that
diff --git a/e2e-server/tests/restrictedShares.spec.ts b/e2e-server/tests/restrictedShares.spec.ts
index 990891c..9641214 100644
--- a/e2e-server/tests/restrictedShares.spec.ts
+++ b/e2e-server/tests/restrictedShares.spec.ts
@@ -2,7 +2,7 @@
  * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-import { runOcc } from '@nextcloud/e2e-test-server/docker'
+import { User } from '@nextcloud/e2e-test-server'
 import { createRandomUser } from '@nextcloud/e2e-test-server/playwright'
 import { expect, test } from '@playwright/test'
 import { basic, openFromList, signIn, upload } from './support.ts'
@@ -19,12 +19,18 @@ test.describe('A share that forbids downloading', () => {
 	// With viewing without download allowed, the default, the server hands
 	// such a file out anyway and there is nothing for the viewer to get
 	// past. The restriction only bites once an admin turns that off.
-	test.beforeAll(async () => {
-		await runOcc(['config:app:set', 'core', 'shareapi_allow_view_without_download', '--value=false', '--type=boolean'])
+	// Through the API rather than occ: the web server keeps the app config
+	// in its own APCu, which a change from the command line does not clear.
+	const setting = '/ocs/v2.php/apps/provisioning_api/api/v1/config/apps/core/shareapi_allow_view_without_download'
+	const asAdmin = { Authorization: basic(new User('admin', 'admin')), 'OCS-APIRequest': 'true' }
+
+	test.beforeAll(async ({ request }) => {
+		const response = await request.post(setting, { headers: asAdmin, form: { value: 'no' } })
+		expect(response.status(), 'turning viewing without download off').toBe(200)
 	})
 
-	test.afterAll(async () => {
-		await runOcc(['config:app:delete', 'core', 'shareapi_allow_view_without_download'])
+	test.afterAll(async ({ request }) => {
+		await request.delete(setting, { headers: asAdmin })
 	})
 
 	test('still shows the picture, through the preview the viewer asks for', async ({ page, request }) => {
diff --git a/package.json b/package.json
index 846a445..4c05b14 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
 		"test:coverage": "vitest run --coverage",
 		"test:e2e": "playwright test",
 		"test:e2e:server": "playwright test --config playwright.server.config.ts",
-		"build:e2e-app": "npm run build && vite build --config e2e-server/vite.config.ts",
+		"build:e2e-app": "VIEWER_VERSION=2.99999.0-e2e npm run build && vite build --config e2e-server/vite.config.ts",
 		"test:watch": "vitest watch",
 		"typecheck": "vue-tsc --noEmit -p tsconfig.check.json",
 		"watch": "vite --mode development build --watch",
diff --git a/vite.config.ts b/vite.config.ts
index 8e99e81..d1ed607 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -89,8 +89,9 @@ export default defineConfig((env) => {
 		replace: {
 			__TRANSLATIONS__: JSON.stringify(translations),
 			__TRANSLATIONS_EAGER__: JSON.stringify(eagerTranslations),
-			// A copy has to know its own version to offer itself as a candidate
-			__VIEWER_VERSION__: JSON.stringify(version),
+			// A copy has to know its own version to offer itself as a candidate.
+			// The e2e app overrides it, to be elected over the copy the server bundles
+			__VIEWER_VERSION__: JSON.stringify(process.env.VIEWER_VERSION ?? version),
 		},
 		DTSPluginOptions: {
 			rollupTypes: env.mode === 'production',