diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7d3659e85..49470917f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,7 +78,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
-          python-version: "3.11"
+          python-version: "3.14"
       # Byte-compile sources — catches syntax errors without installing deps.
       - run: python -m compileall -q app.py core routes src services scripts tests
 
@@ -138,9 +138,9 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
-          python-version: "3.11"
+          python-version: "3.14"
           cache: pip
-      - run: pip install -r requirements.txt
+      - run: pip install -r requirements.txt -r requirements-dev.txt
         if: steps.docs-check.outputs.docs_only != 'true'
       - run: mkdir -p data  # sqlite DB lives at ./data/app.db
         if: steps.docs-check.outputs.docs_only != 'true'
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index efb38ed242..ed50c9a700 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,7 +36,7 @@ Manual development uses Python 3.11+:
 ```bash
 python3 -m venv venv
 source venv/bin/activate
-pip install -r requirements.txt
+pip install -r requirements.txt -r requirements-dev.txt  # drop -dev to run the app without test tooling
 python -m uvicorn app:app --host 127.0.0.1 --port 7000
 ```
 
diff --git a/README.md b/README.md
index e5ee3fc575..44661d9016 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,10 @@ Deploy **Odysseus** on Render in one click. Get a self-hosted AI workspace — c
 
 https://github.com/user-attachments/assets/53277926-7b65-4687-8a0a-42878bd549a8
 
+<p align="center">
+  <img src="docs/odysseus-browser.jpg" alt="The Odysseus workspace — chat composer with the sidebar of tools: chat, email, calendar, deep research, notes, tasks, and more" width="800">
+</p>
+
 ## What you get
 
 This Blueprint provisions three services on Render:
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000000..cdc3aa65bf
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,11 @@
+# Development / test dependencies — NOT installed in the production image.
+# The hosted Render image (Dockerfile.render) installs only requirements.txt,
+# and tests/ is excluded from the build context (.dockerignore), so this test
+# tooling stays out of the shipped container. Install locally with:
+#   pip install -r requirements.txt -r requirements-dev.txt
+pytest==9.1.1
+pytest-asyncio==1.4.0
+# starlette.testclient prefers httpx2 since Starlette 1.2.0 and warns on every
+# TestClient import when only classic httpx is present. Runtime code keeps
+# using `httpx` (in requirements.txt); this is test-client only.
+httpx2==2.7.0
diff --git a/requirements.txt b/requirements.txt
index 917ccce01a..4932056339 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -45,9 +45,5 @@ mcp==1.28.1
 pyotp==2.10.0
 qrcode[pil]==8.2
 croniter==6.2.4
-pytest==9.1.1
-pytest-asyncio==1.4.0
-# starlette.testclient prefers httpx2 since Starlette 1.2.0 and warns on every
-# TestClient import when only classic httpx is present. Runtime code keeps
-# using `httpx` above; this is test-client only.
-httpx2==2.7.0
+# Test/dev tooling (pytest, pytest-asyncio, httpx2) lives in requirements-dev.txt
+# so it stays out of the production image — see that file.