diff --git a/README.md b/README.md
index 20ebf5f..de6a51f 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ Launch the environment:
 time vagrant up --provider=libvirt --no-destroy-on-error --no-tty
 ```
 
-Access the [Nexus home page](https://nexus.example.com) and login as the `admin` user and password `admin`.
+Access the [Nexus home page](https://nexus.example.com) and login as the `admin` user and password `password`.
 
 You can also login with one of the example accounts, e.g. `alice.doe` and password `password`.
 
@@ -155,7 +155,7 @@ You can also access the database cli shell as:
 sudo -i                               # switch to the root user.
 systemctl stop nexus                  # make sure nexus is not running while you use the database.
 su -s /bin/bash nexus                 # switch to the nexus user.
-nexus_home=/opt/nexus/nexus-3.87.1-01 # make sure you have the correct version here.
+nexus_home=/opt/nexus/nexus-3.93.1-04 # make sure you have the correct version here.
 nexus_data="$(realpath $nexus_home/../sonatype-work/nexus3)"
 install -d $nexus_data/../tmp
 rm -f $nexus_data/../tmp/h2-*.jar
diff --git a/provision/execute-provision.groovy-script.sh b/provision/execute-provision.groovy-script.sh
index cd41fb0..46add89 100644
--- a/provision/execute-provision.groovy-script.sh
+++ b/provision/execute-provision.groovy-script.sh
@@ -6,7 +6,7 @@ nexus_domain=$(hostname --fqdn)
 . /vagrant/provision/nexus-groovy.sh
 
 # NB this is the default nexus password, which will be changed to
-#    'admin' by the provision.groovy script that we run bellow.
+#    'password' by the provision.groovy script that we run bellow.
 admin_password='admin123'
 
 # list existing scripts.
diff --git a/provision/nexus-groovy.sh b/provision/nexus-groovy.sh
index a181d31..9efddb6 100644
--- a/provision/nexus-groovy.sh
+++ b/provision/nexus-groovy.sh
@@ -2,7 +2,7 @@
 set -euxo pipefail
 
 admin_username=${admin_username:-admin}
-admin_password=${admin_password:-admin}
+admin_password=${admin_password:-password}
 
 # see https://help.sonatype.com/display/NXRM3/REST+and+Integration+API
 # see https://nexus.example.com/swagger-ui/
diff --git a/provision/provision-nexus.sh b/provision/provision-nexus.sh
index e4e66c9..92acb43 100644
--- a/provision/provision-nexus.sh
+++ b/provision/provision-nexus.sh
@@ -35,12 +35,12 @@ pushd /opt/nexus
 # see https://help.sonatype.com/en/download-archives---repository-manager-3.html
 # see https://help.sonatype.com/en/release-notes.html
 # see https://help.sonatype.com/en/sonatype-nexus-repository.html
-nexus_version=3.87.1-01
+nexus_version=3.93.1-04
 nexus_home=/opt/nexus/nexus-$nexus_version
 nexus_tarball=nexus-$nexus_version-linux-x86_64.tar.gz
 nexus_download_url=https://download.sonatype.com/nexus/3/$nexus_tarball
 wget -q $nexus_download_url
-tar xf $nexus_tarball # NB this creates the $nexus_home (e.g. nexus-3.87.1-01) and sonatype-work directories.
+tar xf $nexus_tarball # NB this creates the $nexus_home (e.g. nexus-3.93.1-04) and sonatype-work directories.
 rm $nexus_tarball
 sed -i -E 's,#!.+,#!/usr/bin/bash,g' "$nexus_home/bin/nexus"
 install -d -o nexus -g nexus -m 700 .java # java preferences are saved here (the default java.util.prefs.userRoot preference).
@@ -160,7 +160,7 @@ unset GNUPGHOME
 bash /vagrant/provision/execute-provision.groovy-script.sh
 
 # set the api credentials.
-api_auth="admin:admin"
+api_auth="admin:password"
 
 
 # accept the End User License Agreement (EULA).
diff --git a/provision/provision-nexus/Makefile b/provision/provision-nexus/Makefile
index a2f690e..2e6f05e 100644
--- a/provision/provision-nexus/Makefile
+++ b/provision/provision-nexus/Makefile
@@ -17,7 +17,7 @@ binaries: binaries-download
 
 binaries-download:
 	mkdir -p binaries
-	wget -qO- https://download.sonatype.com/nexus/3/nexus-3.87.1-01-unix.tar.gz \
+	wget -qO- https://download.sonatype.com/nexus/3/nexus-3.93.1-04-unix.tar.gz \
 		| tar xzf - --strip-components 1 -C binaries
 
 clean:
diff --git a/provision/provision-nexus/pom.xml b/provision/provision-nexus/pom.xml
index f55f2f5..480421c 100644
--- a/provision/provision-nexus/pom.xml
+++ b/provision/provision-nexus/pom.xml
@@ -8,7 +8,7 @@
   <version>1.0-SNAPSHOT</version>
 
   <properties>
-    <nx-version>3.87.1-01</nx-version>
+    <nx-version>3.93.1-04</nx-version>
   </properties>
   <dependencies>
     <dependency>
diff --git a/provision/provision-nexus/src/main/groovy/provision.groovy b/provision/provision-nexus/src/main/groovy/provision.groovy
index 14c6673..84c6d5f 100644
--- a/provision/provision-nexus/src/main/groovy/provision.groovy
+++ b/provision/provision-nexus/src/main/groovy/provision.groovy
@@ -63,7 +63,7 @@ security.anonymousAccess = true
 // NB we set it to something different than the default (admin123) to get
 //    rid of the "Default Admin Credentials" warning... and because this
 //    password is easier to remember.
-security.securitySystem.changePassword('admin', 'admin')
+security.securitySystem.changePassword('admin', 'password')
 
 
 // create users in the deployer role.
diff --git a/provision/use-apt-repository.sh b/provision/use-apt-repository.sh
index 79504b0..c676ea0 100644
--- a/provision/use-apt-repository.sh
+++ b/provision/use-apt-repository.sh
@@ -33,6 +33,12 @@ curl \
 user = "alice.doe:password"
 EOF
 
+# wait until the Release file exists.
+# NB for some reason, after an upload, nexus seems to refresh the repo in
+#    background, so its unclear when its ready. here we loop and hope for
+#    the best.
+bash -c "while [[ -z \"\$(wget -qO- https://$nexus_domain/repository/apt-hosted/dists/noble/Release | grep '/Packages$')\" ]]; do sleep 5; done"
+
 # import the apt-hosted key.
 nexus_apt_hosted_keyring_path="/etc/apt/keyrings/$nexus_domain-apt-hosted.gpg"
 gpg --dearmor -o "$nexus_apt_hosted_keyring_path" </vagrant/shared/apt-hosted-public.key