diff --git a/.gitignore b/.gitignore
index 14e6c4a79..7135c1b32 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,5 @@ tools/__pycache__/
 externals/
 .env
 .vagrant
-api/docs/api-docs.html
\ No newline at end of file
+api/docs/api-docs.html
+*.code-workspace
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d41cb25b7..81bd1dd54 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+Next
+----
+
+* Place PHP version into a global variable
+
 Version 64 (September 2, 2023)
 ------------------------------
 
diff --git a/README.md b/README.md
index 06815cc79..c6f1bab61 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,7 @@ This is a challenge faced by everyone who runs their own mail server, with or wi
 Contributing and Development
 ----------------------------
 
-Mail-in-a-Box is an open source project. Your contributions and pull requests are welcome. See [CONTRIBUTING](CONTRIBUTING.md) to get started. 
+Mail-in-a-Box is an open source project. Your contributions and pull requests are welcome. See [CONTRIBUTING](CONTRIBUTING.md) to get started.
 
 
 The Acknowledgements
diff --git a/conf/nginx-top.conf b/conf/nginx-top.conf
index c3f4c0d69..126225937 100644
--- a/conf/nginx-top.conf
+++ b/conf/nginx-top.conf
@@ -7,6 +7,6 @@
 ##       your own --- please do not ask for help from us.
 
 upstream php-fpm {
-	server unix:/var/run/php/php8.0-fpm.sock;
+	server unix:/var/run/php/php{{phpver}}-fpm.sock;
 }
 
diff --git a/management/backup.py b/management/backup.py
index c2ef7676e..41dfa2cc7 100755
--- a/management/backup.py
+++ b/management/backup.py
@@ -12,7 +12,7 @@
 import rtyaml
 from exclusiveprocess import Lock
 
-from utils import load_environment, shell, wait_for_service
+from utils import load_environment, shell, wait_for_service, get_php_version
 
 def backup_status(env):
 	# If backups are dissbled, return no status.
@@ -262,6 +262,7 @@ def get_target_type(config):
 
 def perform_backup(full_backup):
 	env = load_environment()
+	php_fpm = f"php{get_php_version()}-fpm"
 
 	# Create an global exclusive lock so that the backup script
 	# cannot be run more than one.
@@ -297,7 +298,7 @@ def service_command(service, command, quit=None):
 			if quit:
 				sys.exit(code)
 
-	service_command("php8.0-fpm", "stop", quit=True)
+	service_command(php_fpm, "stop", quit=True)
 	service_command("postfix", "stop", quit=True)
 	service_command("dovecot", "stop", quit=True)
 	service_command("postgrey", "stop", quit=True)
@@ -334,7 +335,7 @@ def service_command(service, command, quit=None):
 		service_command("postgrey", "start", quit=False)
 		service_command("dovecot", "start", quit=False)
 		service_command("postfix", "start", quit=False)
-		service_command("php8.0-fpm", "start", quit=False)
+		service_command(php_fpm, "start", quit=False)
 
 	# Remove old backups. This deletes all backup data no longer needed
 	# from more than 3 days ago.
diff --git a/management/utils.py b/management/utils.py
index b5ca7e597..f249c420a 100644
--- a/management/utils.py
+++ b/management/utils.py
@@ -178,6 +178,10 @@ def wait_for_service(port, public, env, timeout):
 				return False
 		time.sleep(min(timeout/4, 1))
 
+def get_php_version():
+	# Gets the version of PHP installed in the system.
+	return shell("check_output", ["/usr/bin/php", "-v"])[4:7]
+
 if __name__ == "__main__":
 	from web_update import get_web_domains
 	env = load_environment()
diff --git a/management/web_update.py b/management/web_update.py
index e23bb2d88..034987309 100644
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -7,7 +7,7 @@
 from mailconfig import get_mail_domains
 from dns_update import get_custom_dns_config, get_dns_zones
 from ssl_certificates import get_ssl_certificates, get_domain_ssl_files, check_certificate
-from utils import shell, safe_domain_name, sort_domains
+from utils import shell, safe_domain_name, sort_domains, get_php_version
 
 def get_web_domains(env, include_www_redirects=True, include_auto=True, exclude_dns_elsewhere=True):
 	# What domains should we serve HTTP(S) for?
@@ -83,6 +83,7 @@ def read_conf(conf_fn):
 
 	# Build an nginx configuration file.
 	nginx_conf = read_conf("nginx-top.conf")
+	nginx_conf = re.sub("{{phpver}}", get_php_version(), nginx_conf)
 
 	# Load the templates.
 	template0 = read_conf("nginx.conf")
diff --git a/setup/functions.sh b/setup/functions.sh
index 151c5f407..9041f5f94 100644
--- a/setup/functions.sh
+++ b/setup/functions.sh
@@ -4,6 +4,8 @@
 # -o pipefail: don't ignore errors in the non-last command in a pipeline
 set -euo pipefail
 
+# This global variable pinpoints the PHP version for the whole MiaB app
+# Upgrade it only with care and tests. Nextcloud versions depend on it.
 PHP_VER=8.0
 
 function hide_output {
diff --git a/setup/web.sh b/setup/web.sh
index 392b6d923..009989d95 100755
--- a/setup/web.sh
+++ b/setup/web.sh
@@ -124,7 +124,7 @@ chmod a+r /var/lib/mailinabox/mozilla-autoconfig.xml
 
 # Create a generic mta-sts.txt file which is exposed via the
 # nginx configuration at /.well-known/mta-sts.txt
-# more documentation is available on: 
+# more documentation is available on:
 # https://www.uriports.com/blog/mta-sts-explained/
 # default mode is "enforce". In /etc/mailinabox.conf change
 # "MTA_STS_MODE=testing" which means "Messages will be delivered
diff --git a/setup/zpush.sh b/setup/zpush.sh
index 51b197ffe..e2294d45d 100755
--- a/setup/zpush.sh
+++ b/setup/zpush.sh
@@ -41,7 +41,7 @@ if [ $needs_update == 1 ]; then
 	mv /tmp/z-push/*/src /usr/local/lib/z-push
 	rm -rf /tmp/z-push.zip /tmp/z-push
 
-	# Create admin and top scripts with PHP_VER  
+	# Create admin and top scripts with PHP_VER
 	rm -f /usr/sbin/z-push-{admin,top}
     echo '#!/bin/bash' > /usr/sbin/z-push-admin
     echo php$PHP_VER /usr/local/lib/z-push/z-push-admin.php '"$@"' >> /usr/sbin/z-push-admin
@@ -49,7 +49,7 @@ if [ $needs_update == 1 ]; then
     echo '#!/bin/bash' > /usr/sbin/z-push-top
     echo php$PHP_VER /usr/local/lib/z-push/z-push-top.php '"$@"' >> /usr/sbin/z-push-top
     chmod 755 /usr/sbin/z-push-top
-	
+
 	echo $VERSION > /usr/local/lib/z-push/version
 fi
 
diff --git a/tools/mail.py b/tools/mail.py
deleted file mode 100755
index f7d5b4105..000000000
--- a/tools/mail.py
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-# This script has moved.
-management/cli.py "$@"
diff --git a/tools/owncloud-restore.sh b/tools/owncloud-restore.sh
index cdeec4e97..58543d931 100755
--- a/tools/owncloud-restore.sh
+++ b/tools/owncloud-restore.sh
@@ -26,7 +26,7 @@ if [ ! -f $1/config.php ]; then
 fi
 
 echo "Restoring backup from $1"
-service php8.0-fpm stop
+service php$PHP_VER-fpm stop
 
 # remove the current ownCloud/Nextcloud installation
 rm -rf /usr/local/lib/owncloud/
@@ -45,5 +45,5 @@ chown www-data:www-data $STORAGE_ROOT/owncloud/config.php
 
 sudo -u www-data php$PHP_VER /usr/local/lib/owncloud/occ maintenance:mode --off
 
-service php8.0-fpm start
+service php$PHP_VER-fpm start
 echo "Done"
diff --git a/tools/owncloud-unlockadmin.sh b/tools/owncloud-unlockadmin.sh
index 0b7ffc9c7..8b8bf8f57 100755
--- a/tools/owncloud-unlockadmin.sh
+++ b/tools/owncloud-unlockadmin.sh
@@ -8,15 +8,15 @@
 
 source /etc/mailinabox.conf # load global vars
 
-ADMIN=$(./mail.py user admins | head -n 1)
-test -z "$1" || ADMIN=$1 
+ADMIN=$(./management/cli.py user admins | head -n 1)
+test -z "$1" || ADMIN=$1
 
 echo I am going to unlock admin features for $ADMIN.
 echo You can provide another user to unlock as the first argument of this script.
 echo
 echo WARNING: you could break mail-in-a-box when fiddling around with Nextcloud\'s admin interface
 echo If in doubt, press CTRL-C to cancel.
-echo 
+echo
 echo Press enter to continue.
 read