diff --git a/src/remo/README.md b/src/remo/README.md
index d598515..c541b11 100644
--- a/src/remo/README.md
+++ b/src/remo/README.md
@@ -85,3 +85,21 @@ hola bundle deploy -p src/remo/src --app-id remo --port 8080
 ```
 
 Or install it from the Hola web catalog once published.
+
+## Beta channel
+
+Remo pre-releases are published on the catalog's `beta` channel as bundle
+pre-releases (for example `remo 0.11.0-beta.2`, which pins upstream
+`remo-web:4.4.0rc2`). Install one beside your stable copy without the
+allow-multiple override:
+
+```bash
+hola install remo --channel beta --as remo-beta
+```
+
+A beta copy starts with empty data (it tests boot, routing and SSO, not a data
+migration) and follows the `beta` channel for upgrades until you change it. The
+4.4 pre-release adds two dormant-by-default console surfaces you can enable at
+install or later from the deployment's configuration: **Host maintenance from
+the console** (`REMO_WEB_HOST_ADMIN`) and **Host registry management from the
+console** (`REMO_WEB_REGISTRY_ADMIN`). Both sit behind Hola's forward-auth.
diff --git a/src/remo/package.json b/src/remo/package.json
index 09d6372..e8748b1 100644
--- a/src/remo/package.json
+++ b/src/remo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "remo",
-  "version": "0.10.1",
+  "version": "0.11.0-beta.2",
   "description": "Remo — browser terminal for remote development instances (Hola app package)",
   "license": "MIT",
   "oci": {
diff --git a/src/remo/src/compose.yaml b/src/remo/src/compose.yaml
index 408b7e2..2d1acb3 100644
--- a/src/remo/src/compose.yaml
+++ b/src/remo/src/compose.yaml
@@ -1,6 +1,6 @@
 services:
   remo-web:
-    image: ghcr.io/get2knowio/remo-web:4.3.4@sha256:7fa42084acb972aeea9f8581aef3d80a9643a17bfc8ecc4961fd21b0b4c52edf
+    image: ghcr.io/get2knowio/remo-web:4.4.0rc2@sha256:d85677da75a7618b8bfa91baea4fe4e160de632f9507176dffcf4997fc1a2fd9
     environment:
       # Host-header allowlist (no wildcards). Traefik serves the public host;
       # loopback is kept so the container healthcheck below is accepted.
@@ -20,6 +20,11 @@ services:
       # through (Traefik copies it onto the request). Both from manifest defaultEnv.
       REMO_WEB_OPERATOR_AUTH: "${REMO_WEB_OPERATOR_AUTH}"
       REMO_WEB_FORWARD_AUTH_HEADER: "${REMO_WEB_FORWARD_AUTH_HEADER}"
+      # 4.4 opt-in admin surfaces (both dormant unless exactly "enabled"; an
+      # empty value is treated as unset by remo-web, so an unset Hola param is
+      # safe). Both sit behind Hola's forward-auth operator identity.
+      REMO_WEB_HOST_ADMIN: "${REMO_WEB_HOST_ADMIN}"
+      REMO_WEB_REGISTRY_ADMIN: "${REMO_WEB_REGISTRY_ADMIN}"
     volumes:
       # Writable state volume (REMO_HOME). remo-web generates its service SSH
       # identity here (web-identity/) and stores the registry pushed by
diff --git a/src/remo/src/manifest.json b/src/remo/src/manifest.json
index c28fd97..0587465 100644
--- a/src/remo/src/manifest.json
+++ b/src/remo/src/manifest.json
@@ -1,6 +1,6 @@
 {
   "name": "remo",
-  "version": "0.10.1",
+  "version": "0.11.0-beta.2",
   "title": "Remo",
   "description": "Browser terminal for your Remo-managed remote development instances",
   "icon": "https://raw.githubusercontent.com/try-hola/apps/main/icons/remo.svg",
@@ -27,7 +27,11 @@
       "isSecret": false,
       "type": "enum",
       "options": [
-        { "value": "forward", "label": "Forward auth (Authentik / Traefik)", "description": "Trust the proxy-injected identity header named by REMO_WEB_FORWARD_AUTH_HEADER." }
+        {
+          "value": "forward",
+          "label": "Forward auth (Authentik / Traefik)",
+          "description": "Trust the proxy-injected identity header named by REMO_WEB_FORWARD_AUTH_HEADER."
+        }
       ],
       "description": "How remo-web authenticates the operator who mints adoption/pairing codes. Behind Hola's Authentik forward-auth, `forward` trusts the proxy-injected identity header named by REMO_WEB_FORWARD_AUTH_HEADER.",
       "label": "Operator auth mode"
@@ -38,25 +42,75 @@
       "isSecret": false,
       "description": "The trusted request header carrying the authenticated user, injected by Hola's Traefik forward-auth from Authentik's outpost. Default matches Authentik (X-authentik-username) — Authentik's equivalent of X-Forwarded-User. Only read when REMO_WEB_OPERATOR_AUTH=forward.",
       "label": "Forward-auth identity header"
+    },
+    {
+      "key": "REMO_WEB_HOST_ADMIN",
+      "value": "",
+      "isSecret": false,
+      "type": "enum",
+      "options": [
+        {
+          "value": "",
+          "label": "Dormant (default)",
+          "description": "Host maintenance from the console is off; every gated route answers 404."
+        },
+        {
+          "value": "enabled",
+          "label": "Enabled",
+          "description": "Turn on host maintenance from the browser: clone/delete/rebuild projects and open a host shell. Gated by the forward-auth operator identity."
+        }
+      ],
+      "description": "New in 4.4: gates the mutating host-maintenance surface (project clone/delete/rebuild, host shell). Leave dormant unless you want console-driven maintenance; it is protected by Hola's forward-auth either way.",
+      "label": "Host maintenance from the console"
+    },
+    {
+      "key": "REMO_WEB_REGISTRY_ADMIN",
+      "value": "",
+      "isSecret": false,
+      "type": "enum",
+      "options": [
+        {
+          "value": "",
+          "label": "Dormant (default)",
+          "description": "Host registry management from the console is off; every gated route answers 404."
+        },
+        {
+          "value": "enabled",
+          "label": "Enabled",
+          "description": "Let the console add, remove and configure SSH hosts (no workstation CLI needed). Larger blast radius than host maintenance: it changes which machines the service will SSH into."
+        }
+      ],
+      "description": "New in 4.4: gates the registry-management surface (add/remove/configure hosts from the console via the embedded CLI). Separate from host maintenance because registry mutation changes which machines the service SSHes into. Protected by Hola's forward-auth either way.",
+      "label": "Host registry management from the console"
     }
   ],
   "defaults": {
     "ports": [
-      { "container": 8080, "protocol": "tcp" }
+      {
+        "container": 8080,
+        "protocol": "tcp"
+      }
     ],
     "volumes": [
-      { "containerPath": "/home/remo/.config/remo" }
+      {
+        "containerPath": "/home/remo/.config/remo"
+      }
     ]
   },
   "auth": {
     "mode": "forward-auth",
     "forwardAuth": {
-      "bypassPaths": ["/api/v1/setup/"]
+      "bypassPaths": [
+        "/api/v1/setup/"
+      ]
     }
   },
   "upgrade": {
     "breaking": true,
-    "upgradeNotesUrl": "https://github.com/get2knowio/remo/blob/main/CHANGELOG.md"
+    "preUpgradeBackup": "recommended",
+    "upgradeNotesUrl": "https://github.com/get2knowio/remo/releases/tag/rc-4.4.0rc2"
   },
-  "accepts": ["backup@1"]
+  "accepts": [
+    "backup@1"
+  ]
 }